diff --git a/.config/nextest.toml b/.config/nextest.toml
index 2a4cd2cb93..11ec94cc1a 100644
--- a/.config/nextest.toml
+++ b/.config/nextest.toml
@@ -1,3 +1,10 @@
 # Minimum cargo-nextest for this repository: GHSA-vc25-qg58-w57c is fixed in 0.9.150 and CI
 # installs exactly that version, so an older nextest refuses to run (exit 92 REQUIRED_VERSION_NOT_MET).
 nextest-version = "0.9.150"
+
+# These measurements require a quiet runner. Their in-process SERIAL mutex only
+# serializes cargo test; nextest gives each test its own process. Reserve all slots
+# so other tests cannot charge their CPU/render-worker time to a frame budget.
+[[profile.default.overrides]]
+filter = 'package(pdfcraft-ui-egui) & binary(perf)'
+threads-required = "num-test-threads"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a5c2ba7f7f..d8549142f7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,6 +12,7 @@ on:
 
 permissions:
   contents: write
+  packages: write
 
 concurrency:
   group: release-${{ github.ref }}
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 8da4b0a200..fc88e8b664 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -36,181 +36,181 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `crates/ui-egui/src/i18n/ko.tsv` | Korean interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Korean UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/ro.tsv` | Romanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels and user-facing messages; AI-assisted and not yet reviewed line by line by a native Romanian speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Romanian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/fi.tsv` | Finnish interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: AI-assisted (Claude Code) clean-room translations of PdfCraft's English UI labels and user-facing messages; not yet proofread by a native Finnish speaker; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 calculation-order, text-format, print, thumbnail, layer, comment-reshape and signature labels (previously English placeholders) are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Finnish UI strings, compiled in by crates/ui-egui/src/i18n.rs |
-| `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-center.svg` | Lucide icon "align-center" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square-terminal.svg` | Lucide icon "square-terminal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-terminal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-code.svg` | Lucide icon "file-code" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-code.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-spreadsheet.svg` | Lucide icon "file-spreadsheet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-spreadsheet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-justify.svg` | Lucide icon "align-justify" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-justify.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/align-right.svg` | Lucide icon "align-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/columns-3.svg` | Lucide icon "columns-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rows-3.svg` | Lucide icon "rows-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rows-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/flip-horizontal-2.svg` | Lucide icon "flip-horizontal-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-horizontal-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/flip-vertical-2.svg` | Lucide icon "flip-vertical-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-vertical-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/app-window.svg` | Lucide icon "app-window" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/app-window.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/arrow-left-right.svg` | Lucide icon "arrow-left-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-left-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/arrow-up-down.svg` | Lucide icon "arrow-up-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/arrow-up-right.svg` | Lucide icon "arrow-up-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/badge-check.svg` | Lucide icon "badge-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/badge-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bandage.svg` | Lucide icon "bandage" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bandage.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bell.svg` | Lucide icon "bell" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bell.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/blend.svg` | Lucide icon "blend" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/blend.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bold.svg` | Lucide icon "bold" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bold.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/book-open.svg` | Lucide icon "book-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/book-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bookmark.svg` | Lucide icon "bookmark" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/bookmark-plus.svg` | Lucide icon "bookmark-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/braces.svg` | Lucide icon "braces" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/braces.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/brush-cleaning.svg` | Lucide icon "brush-cleaning" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush-cleaning.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/brush.svg` | Lucide icon "brush" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/camera.svg` | Lucide icon "camera" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/camera.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/check-circle-2.svg` | Lucide icon "check-circle-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check-circle-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/check.svg` | Lucide icon "check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-down.svg` | Lucide icon "chevron-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-left.svg` | Lucide icon "chevron-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-right.svg` | Lucide icon "chevron-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevron-up.svg` | Lucide icon "chevron-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevrons-left.svg` | Lucide icon "chevrons-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/chevrons-right.svg` | Lucide icon "chevrons-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-check.svg` | Lucide icon "circle-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-dashed.svg` | Lucide icon "circle-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-dot.svg` | Lucide icon "circle-dot" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dot.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-help.svg` | Lucide icon "circle-help" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-help.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle.svg` | Lucide icon "circle" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/clock-3.svg` | Lucide icon "clock-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/clock.svg` | Lucide icon "clock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/cloud-upload.svg` | Lucide icon "cloud-upload" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud-upload.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/cloud.svg` | Lucide icon "cloud" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/code-xml.svg` | Lucide icon "code-xml" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/code-xml.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/columns-2.svg` | Lucide icon "columns-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/compass.svg` | Lucide icon "compass" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/compass.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/contrast.svg` | Lucide icon "contrast" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/contrast.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/copy-plus.svg` | Lucide icon "copy-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/copy.svg` | Lucide icon "copy" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/crop.svg` | Lucide icon "crop" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/crop.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/droplet.svg` | Lucide icon "droplet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/droplet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/ellipsis-vertical.svg` | Lucide icon "ellipsis-vertical" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis-vertical.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/ellipsis.svg` | Lucide icon "ellipsis" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/eraser.svg` | Lucide icon "eraser" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eraser.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/external-link.svg` | Lucide icon "external-link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/external-link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/eye-off.svg` | Lucide icon "eye-off" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye-off.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/eye.svg` | Lucide icon "eye" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-check.svg` | Lucide icon "file-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-down.svg` | Lucide icon "file-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-input.svg` | Lucide icon "file-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-lock-2.svg` | Lucide icon "file-lock-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-lock-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-minus.svg` | Lucide icon "file-minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-output.svg` | Lucide icon "file-output" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-output.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-pen-line.svg` | Lucide icon "file-pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-plus-2.svg` | Lucide icon "file-plus-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-plus.svg` | Lucide icon "file-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-scan.svg` | Lucide icon "file-scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-search.svg` | Lucide icon "file-search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-symlink.svg` | Lucide icon "file-symlink" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-symlink.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-text.svg` | Lucide icon "file-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/file-x.svg` | Lucide icon "file-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/files.svg` | Lucide icon "files" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/files.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/film.svg` | Lucide icon "film" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/film.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/filter.svg` | Lucide icon "filter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/filter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/folder-open.svg` | Lucide icon "folder-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/folder-plus.svg` | Lucide icon "folder-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/folder.svg` | Lucide icon "folder" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/gauge.svg` | Lucide icon "gauge" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/gauge.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/git-compare.svg` | Lucide icon "git-compare" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/git-compare.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/globe.svg` | Lucide icon "globe" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/globe.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/grid-3x3.svg` | Lucide icon "grid-3x3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/grid-3x3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/hand.svg` | Lucide icon "hand" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hand.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/hash.svg` | Lucide icon "hash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/heading.svg` | Lucide icon "heading" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/heading.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/highlighter.svg` | Lucide icon "highlighter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/highlighter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/house.svg` | Lucide icon "house" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/house.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/image-plus.svg` | Lucide icon "image-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/image.svg` | Lucide icon "image" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/info.svg` | Lucide icon "info" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/info.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/italic.svg` | Lucide icon "italic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/italic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/languages.svg` | Lucide icon "languages" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/languages.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/lasso.svg` | Lucide icon "lasso" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lasso.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/layers.svg` | Lucide icon "layers" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layers.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/layout-grid.svg` | Lucide icon "layout-grid" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layout-grid.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/link-2.svg` | Lucide icon "link-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/link.svg` | Lucide icon "link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/list-checks.svg` | Lucide icon "list-checks" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-checks.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/list-ordered.svg` | Lucide icon "list-ordered" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-ordered.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/list.svg` | Lucide icon "list" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/lock-open.svg` | Lucide icon "lock-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/lock.svg` | Lucide icon "lock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/maximize-2.svg` | Lucide icon "maximize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/maximize.svg` | Lucide icon "maximize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-circle-reply.svg` | Lucide icon "message-circle-reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-circle-reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square-text.svg` | Lucide icon "message-square-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square.svg` | Lucide icon "message-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/messages-square.svg` | Lucide icon "messages-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/messages-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/mic.svg` | Lucide icon "mic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/minimize.svg` | Lucide icon "minimize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/minimize-2.svg` | Lucide icon "minimize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/minus.svg` | Lucide icon "minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/moon.svg` | Lucide icon "moon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/moon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/mouse-pointer-2.svg` | Lucide icon "mouse-pointer-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mouse-pointer-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/move.svg` | Lucide icon "move" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/navigation.svg` | Lucide icon "navigation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/navigation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/paint-bucket.svg` | Lucide icon "paint-bucket" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paint-bucket.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/palette.svg` | Lucide icon "palette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/palette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/panel-left.svg` | Lucide icon "panel-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/panel-right.svg` | Lucide icon "panel-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/panels-top-left.svg` | Lucide icon "panels-top-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panels-top-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/paperclip.svg` | Lucide icon "paperclip" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paperclip.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pen-line.svg` | Lucide icon "pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pen-tool.svg` | Lucide icon "pen-tool" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-tool.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pencil.svg` | Lucide icon "pencil" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pencil.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pipette.svg` | Lucide icon "pipette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pipette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/plus.svg` | Lucide icon "plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/presentation.svg` | Lucide icon "presentation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/presentation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/printer.svg` | Lucide icon "printer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/printer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rectangle-horizontal.svg` | Lucide icon "rectangle-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rectangle-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/redo-2.svg` | Lucide icon "redo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/redo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/replace.svg` | Lucide icon "replace" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/replace.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rotate-ccw.svg` | Lucide icon "rotate-ccw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-ccw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/rotate-cw.svg` | Lucide icon "rotate-cw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-cw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/ruler.svg` | Lucide icon "ruler" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ruler.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/save.svg` | Lucide icon "save" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/save.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/scan-text.svg` | Lucide icon "scan-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/scan.svg` | Lucide icon "scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/scissors.svg` | Lucide icon "scissors" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scissors.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/search.svg` | Lucide icon "search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/send.svg` | Lucide icon "send" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/send.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/settings-2.svg` | Lucide icon "settings-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/settings.svg` | Lucide icon "settings" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/share-2.svg` | Lucide icon "share-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/share-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/shield-check.svg` | Lucide icon "shield-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/shield-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/signature.svg` | Lucide icon "signature" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/signature.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sliders-horizontal.svg` | Lucide icon "sliders-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sliders-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sparkles.svg` | Lucide icon "sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/spline.svg` | Lucide icon "spline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/spline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square-dashed-mouse-pointer.svg` | Lucide icon "square-dashed-mouse-pointer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed-mouse-pointer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square-dashed.svg` | Lucide icon "square-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/square.svg` | Lucide icon "square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/squares-subtract.svg` | Lucide icon "squares-subtract" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/squares-subtract.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/stamp.svg` | Lucide icon "stamp" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/stamp.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/star.svg` | Lucide icon "star" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/star.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sticky-note.svg` | Lucide icon "sticky-note" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sticky-note.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/strikethrough.svg` | Lucide icon "strikethrough" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/strikethrough.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/sun.svg` | Lucide icon "sun" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sun.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/swatch-book.svg` | Lucide icon "swatch-book" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/swatch-book.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/tag.svg` | Lucide icon "tag" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/tag.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/text-cursor-input.svg` | Lucide icon "text-cursor-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-cursor-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/text-select.svg` | Lucide icon "text-select" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-select.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/trash-2.svg` | Lucide icon "trash-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/trash.svg` | Lucide icon "trash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/triangle-alert.svg` | Lucide icon "triangle-alert" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/triangle-alert.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/type.svg` | Lucide icon "type" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/type.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/underline.svg` | Lucide icon "underline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/underline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/undo-2.svg` | Lucide icon "undo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/undo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/user-round.svg` | Lucide icon "user-round" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/user-round.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/wand-sparkles.svg` | Lucide icon "wand-sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wand-sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/wrench.svg` | Lucide icon "wrench" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wrench.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/x.svg` | Lucide icon "x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/zoom-in.svg` | Lucide icon "zoom-in" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-in.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/zoom-out.svg` | Lucide icon "zoom-out" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-out.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/accessibility.svg` | Lucide icon "accessibility" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-left.svg` | Lucide icon "align-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-center.svg` | Lucide icon "align-center" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square-terminal.svg` | Lucide icon "square-terminal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-terminal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-code.svg` | Lucide icon "file-code" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-code.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-spreadsheet.svg` | Lucide icon "file-spreadsheet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-spreadsheet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-justify.svg` | Lucide icon "align-justify" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-justify.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/align-right.svg` | Lucide icon "align-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/columns-3.svg` | Lucide icon "columns-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rows-3.svg` | Lucide icon "rows-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rows-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/flip-horizontal-2.svg` | Lucide icon "flip-horizontal-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-horizontal-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/flip-vertical-2.svg` | Lucide icon "flip-vertical-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-vertical-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/app-window.svg` | Lucide icon "app-window" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/app-window.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/arrow-left-right.svg` | Lucide icon "arrow-left-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-left-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/arrow-up-down.svg` | Lucide icon "arrow-up-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/arrow-up-right.svg` | Lucide icon "arrow-up-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/badge-check.svg` | Lucide icon "badge-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/badge-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bandage.svg` | Lucide icon "bandage" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bandage.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bell.svg` | Lucide icon "bell" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bell.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/blend.svg` | Lucide icon "blend" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/blend.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bold.svg` | Lucide icon "bold" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bold.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/book-open.svg` | Lucide icon "book-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/book-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bookmark.svg` | Lucide icon "bookmark" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/bookmark-plus.svg` | Lucide icon "bookmark-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/braces.svg` | Lucide icon "braces" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/braces.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/brush-cleaning.svg` | Lucide icon "brush-cleaning" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush-cleaning.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/brush.svg` | Lucide icon "brush" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/camera.svg` | Lucide icon "camera" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/camera.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/check-circle-2.svg` | Lucide icon "check-circle-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check-circle-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/check.svg` | Lucide icon "check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-down.svg` | Lucide icon "chevron-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-left.svg` | Lucide icon "chevron-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-right.svg` | Lucide icon "chevron-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevron-up.svg` | Lucide icon "chevron-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevrons-left.svg` | Lucide icon "chevrons-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/chevrons-right.svg` | Lucide icon "chevrons-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-check.svg` | Lucide icon "circle-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-dashed.svg` | Lucide icon "circle-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-dot.svg` | Lucide icon "circle-dot" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dot.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-help.svg` | Lucide icon "circle-help" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-help.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle.svg` | Lucide icon "circle" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/clock-3.svg` | Lucide icon "clock-3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock-3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/clock.svg` | Lucide icon "clock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/cloud-upload.svg` | Lucide icon "cloud-upload" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud-upload.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/cloud.svg` | Lucide icon "cloud" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/code-xml.svg` | Lucide icon "code-xml" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/code-xml.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/columns-2.svg` | Lucide icon "columns-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/compass.svg` | Lucide icon "compass" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/compass.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/contrast.svg` | Lucide icon "contrast" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/contrast.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/copy-plus.svg` | Lucide icon "copy-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/copy.svg` | Lucide icon "copy" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/crop.svg` | Lucide icon "crop" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/crop.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/droplet.svg` | Lucide icon "droplet" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/droplet.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/ellipsis-vertical.svg` | Lucide icon "ellipsis-vertical" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis-vertical.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/ellipsis.svg` | Lucide icon "ellipsis" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/eraser.svg` | Lucide icon "eraser" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eraser.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/external-link.svg` | Lucide icon "external-link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/external-link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/eye-off.svg` | Lucide icon "eye-off" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye-off.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/eye.svg` | Lucide icon "eye" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-check.svg` | Lucide icon "file-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-down.svg` | Lucide icon "file-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-input.svg` | Lucide icon "file-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-lock-2.svg` | Lucide icon "file-lock-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-lock-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-minus.svg` | Lucide icon "file-minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-output.svg` | Lucide icon "file-output" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-output.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-pen-line.svg` | Lucide icon "file-pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-plus-2.svg` | Lucide icon "file-plus-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-plus.svg` | Lucide icon "file-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-scan.svg` | Lucide icon "file-scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-search.svg` | Lucide icon "file-search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-symlink.svg` | Lucide icon "file-symlink" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-symlink.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-text.svg` | Lucide icon "file-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/file-x.svg` | Lucide icon "file-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/files.svg` | Lucide icon "files" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/files.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/film.svg` | Lucide icon "film" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/film.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/filter.svg` | Lucide icon "filter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/filter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/folder-open.svg` | Lucide icon "folder-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/folder-plus.svg` | Lucide icon "folder-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/folder.svg` | Lucide icon "folder" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/gauge.svg` | Lucide icon "gauge" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/gauge.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/git-compare.svg` | Lucide icon "git-compare" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/git-compare.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/globe.svg` | Lucide icon "globe" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/globe.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/grid-3x3.svg` | Lucide icon "grid-3x3" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/grid-3x3.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/hand.svg` | Lucide icon "hand" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hand.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/hash.svg` | Lucide icon "hash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/heading.svg` | Lucide icon "heading" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/heading.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/highlighter.svg` | Lucide icon "highlighter" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/highlighter.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/house.svg` | Lucide icon "house" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/house.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/image-plus.svg` | Lucide icon "image-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/image.svg` | Lucide icon "image" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/info.svg` | Lucide icon "info" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/info.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/italic.svg` | Lucide icon "italic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/italic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/languages.svg` | Lucide icon "languages" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/languages.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/lasso.svg` | Lucide icon "lasso" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lasso.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/layers.svg` | Lucide icon "layers" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layers.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/layout-grid.svg` | Lucide icon "layout-grid" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layout-grid.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/link-2.svg` | Lucide icon "link-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/link.svg` | Lucide icon "link" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/list-checks.svg` | Lucide icon "list-checks" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-checks.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/list-ordered.svg` | Lucide icon "list-ordered" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-ordered.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/list.svg` | Lucide icon "list" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/lock-open.svg` | Lucide icon "lock-open" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock-open.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/lock.svg` | Lucide icon "lock" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/maximize-2.svg` | Lucide icon "maximize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/maximize.svg` | Lucide icon "maximize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-circle-reply.svg` | Lucide icon "message-circle-reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-circle-reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square-text.svg` | Lucide icon "message-square-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square.svg` | Lucide icon "message-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/messages-square.svg` | Lucide icon "messages-square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/messages-square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/mic.svg` | Lucide icon "mic" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mic.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/minimize.svg` | Lucide icon "minimize" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/minimize-2.svg` | Lucide icon "minimize-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/minus.svg` | Lucide icon "minus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/moon.svg` | Lucide icon "moon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/moon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/mouse-pointer-2.svg` | Lucide icon "mouse-pointer-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mouse-pointer-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/move.svg` | Lucide icon "move" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/navigation.svg` | Lucide icon "navigation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/navigation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/paint-bucket.svg` | Lucide icon "paint-bucket" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paint-bucket.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/palette.svg` | Lucide icon "palette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/palette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/panel-left.svg` | Lucide icon "panel-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/panel-right.svg` | Lucide icon "panel-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/panels-top-left.svg` | Lucide icon "panels-top-left" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panels-top-left.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/paperclip.svg` | Lucide icon "paperclip" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paperclip.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pen-line.svg` | Lucide icon "pen-line" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-line.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pen-tool.svg` | Lucide icon "pen-tool" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-tool.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pencil.svg` | Lucide icon "pencil" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pencil.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pipette.svg` | Lucide icon "pipette" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pipette.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/plus.svg` | Lucide icon "plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/presentation.svg` | Lucide icon "presentation" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/presentation.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/printer.svg` | Lucide icon "printer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/printer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rectangle-horizontal.svg` | Lucide icon "rectangle-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rectangle-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/redo-2.svg` | Lucide icon "redo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/redo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/replace.svg` | Lucide icon "replace" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/replace.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rotate-ccw.svg` | Lucide icon "rotate-ccw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-ccw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/rotate-cw.svg` | Lucide icon "rotate-cw" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-cw.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/ruler.svg` | Lucide icon "ruler" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ruler.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/save.svg` | Lucide icon "save" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/save.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/scan-text.svg` | Lucide icon "scan-text" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan-text.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/scan.svg` | Lucide icon "scan" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/scissors.svg` | Lucide icon "scissors" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scissors.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/search.svg` | Lucide icon "search" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/search.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/send.svg` | Lucide icon "send" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/send.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/settings-2.svg` | Lucide icon "settings-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/settings.svg` | Lucide icon "settings" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/share-2.svg` | Lucide icon "share-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/share-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/shield-check.svg` | Lucide icon "shield-check" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/shield-check.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/signature.svg` | Lucide icon "signature" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/signature.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sliders-horizontal.svg` | Lucide icon "sliders-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sliders-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sparkles.svg` | Lucide icon "sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/spline.svg` | Lucide icon "spline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/spline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square-dashed-mouse-pointer.svg` | Lucide icon "square-dashed-mouse-pointer" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed-mouse-pointer.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square-dashed.svg` | Lucide icon "square-dashed" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/square.svg` | Lucide icon "square" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/squares-subtract.svg` | Lucide icon "squares-subtract" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/squares-subtract.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/stamp.svg` | Lucide icon "stamp" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/stamp.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/star.svg` | Lucide icon "star" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/star.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sticky-note.svg` | Lucide icon "sticky-note" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sticky-note.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/strikethrough.svg` | Lucide icon "strikethrough" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/strikethrough.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/sun.svg` | Lucide icon "sun" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sun.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/swatch-book.svg` | Lucide icon "swatch-book" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/swatch-book.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/tag.svg` | Lucide icon "tag" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/tag.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/text-cursor-input.svg` | Lucide icon "text-cursor-input" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-cursor-input.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/text-select.svg` | Lucide icon "text-select" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-select.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/trash-2.svg` | Lucide icon "trash-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/trash.svg` | Lucide icon "trash" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/triangle-alert.svg` | Lucide icon "triangle-alert" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/triangle-alert.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/type.svg` | Lucide icon "type" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/type.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/underline.svg` | Lucide icon "underline" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/underline.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/undo-2.svg` | Lucide icon "undo-2" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/undo-2.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/user-round.svg` | Lucide icon "user-round" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/user-round.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/wand-sparkles.svg` | Lucide icon "wand-sparkles" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wand-sparkles.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/wrench.svg` | Lucide icon "wrench" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wrench.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/x.svg` | Lucide icon "x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/zoom-in.svg` | Lucide icon "zoom-in" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-in.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/zoom-out.svg` | Lucide icon "zoom-out" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-out.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/fonts/Inter-Regular.ttf` | Inter Regular | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels; slanted fallback glyphs in Fill & Sign typed signatures for characters Dancing Script lacks (Cyrillic, Greek), drawn as filled paths |
 | `assets/fonts/Inter-Medium.ttf` | Inter Medium | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels |
 | `assets/fonts/Inter-SemiBold.ttf` | Inter SemiBold | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels |
@@ -269,31 +269,31 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `docs/images/pdfcraft-tools.png` | PdfCraft screenshot: All tools | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README: tool catalogue. Shows PdfCraft UI, Lucide icons, the showcase PDF built from the [[fetched]] OFL fonts, and the ArtCraft mark (Storyteller trademark from docs/brand/, not covered by this licence) |
 | `docs/images/pdfcraft-twoup.png` | PdfCraft screenshot: Two-up reading | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README: layouts. Shows only PdfCraft UI, Lucide icons and the showcase PDF built from the [[fetched]] OFL fonts |
 | `docs/images/pdfcraft-viewer.png` | PdfCraft screenshot: Viewer with comments | PdfCraft contributors (generated by `cargo xtask screenshots`) | MIT OR Apache-2.0 | this repository | README hero. Shows only PdfCraft UI, Lucide icons and the showcase PDF built from the [[fetched]] OFL fonts |
-| `assets/icons/pin.svg` | Lucide icon "pin" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pin.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/move-right.svg` | Lucide icon "move-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/reply.svg` | Lucide icon "reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/thumbs-up.svg` | Lucide icon "thumbs-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/thumbs-down.svg` | Lucide icon "thumbs-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square-plus.svg` | Lucide icon "message-square-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/circle-x.svg` | Lucide icon "circle-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pin.svg` | Lucide icon "pin" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pin.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/move-right.svg` | Lucide icon "move-right" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-right.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/reply.svg` | Lucide icon "reply" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/reply.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/thumbs-up.svg` | Lucide icon "thumbs-up" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-up.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/thumbs-down.svg` | Lucide icon "thumbs-down" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-down.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square-plus.svg` | Lucide icon "message-square-plus" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-plus.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/circle-x.svg` | Lucide icon "circle-x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/ui-egui/tests/data/form.pdf` | One-page AcroForm test fixture (text, check box, radio group, combo box) | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects, no third-party content | Form-filling UI tests (crates/ui-egui/tests/it/forms.rs, commands.rs) |
-| `assets/icons/pentagon.svg` | Lucide icon "pentagon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pentagon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/message-square-quote.svg` | Lucide icon "message-square-quote" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-quote.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pentagon.svg` | Lucide icon "pentagon" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pentagon.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/message-square-quote.svg` | Lucide icon "message-square-quote" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-quote.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/sign/tests/data/openssl-signed.pdf` | One-page PDF signed with OpenSSL CMS (adbe.pkcs7.detached) by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl cms -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/it/pdf.rs): a signature PdfCraft did not make |
-| `assets/icons/clipboard-paste.svg` | Lucide icon "clipboard-paste" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clipboard-paste.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/clipboard-paste.svg` | Lucide icon "clipboard-paste" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clipboard-paste.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/fonts/DancingScript.ttf` | Dancing Script (variable) | The Dancing Script Project Authors (Pablo Impallari) | OFL-1.1 | https://github.com/google/fonts/blob/9710da1eacb3be272583c3224dcb70f9da6eadbb/ofl/dancingscript/DancingScript%5Bwght%5D.ttf | Fill & Sign typed signatures and initials: the typed name's glyph outlines, drawn as filled paths (the font file itself is not embedded in PDFs) |
 | `packaging/macos/dmg/background.svg` | PdfCraft macOS DMG window background | @XusBadia | MIT OR Apache-2.0 | Original work for this repository, derived from the PdfCraft app icon (assets/app-icon/pdfcraft.svg, referenced via an SVG image element, not copied) | Finder window of the macOS DMG; rendered to background.tiff by packaging/macos/dmg/generate.py |
 | `packaging/macos/dmg/background.tiff` | PdfCraft macOS DMG window background (rendered) | @XusBadia | MIT OR Apache-2.0 | Rendered from packaging/macos/dmg/background.svg by packaging/macos/dmg/generate.py | 1x + 2x HiDPI 16-colour palette TIFF copied into the macOS DMG by packaging/macos/package.sh; includes the app icon and the free LittleCMS built-in sRGB profile |
 | `crates/sign/tests/data/x509-rsa-sha1.pdf` | One-page PDF with a legacy adbe.x509.rsa_sha1 signature by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl dgst -sha1 -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/it/pdf.rs): the legacy adbe.x509.rsa_sha1 format |
-| `assets/icons/monitor.svg` | Lucide icon "monitor" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/monitor.svg` | Lucide icon "monitor" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/ui-egui/src/i18n/vi.tsv` | Vietnamese interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels; PhotoCraft and VectorCraft Vietnamese catalogs used only as translation memory when English source and semantic context matched; original catalog reviewed by a native Vietnamese-speaking contributor; 2026-10-15 coverage additions are AI-assisted and not separately native-reviewed; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-check wordings are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Vietnamese UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/sl.tsv` | Slovene interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-18 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Slovene UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `vendor/vello_common/assets/probe.png` | vello_common probe reference image (rendered from probe.rgba) | Linebender vello contributors | MIT OR Apache-2.0 | vello_common 0.0.8 (crates.io), vendored in vendor/vello_common; regenerated by its vello_sparse_tests regenerate_probe_reference binary | Reference picture of the vendored vello_common probe module, for people only; the build reads probe.rgba, not this file |
 | `crates/ui-egui/src/i18n/nb.tsv` | Norwegian Bokmål interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Norwegian Bokmål UI strings, compiled in by crates/ui-egui/src/i18n.rs |
-| `assets/icons/superscript.svg` | Lucide icon "superscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/superscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/subscript.svg` | Lucide icon "subscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/subscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/pilcrow.svg` | Lucide icon "pilcrow" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pilcrow.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/icons/move-horizontal.svg` | Lucide icon "move-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/superscript.svg` | Lucide icon "superscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/superscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/subscript.svg` | Lucide icon "subscript" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/subscript.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/pilcrow.svg` | Lucide icon "pilcrow" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pilcrow.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
+| `assets/icons/move-horizontal.svg` | Lucide icon "move-horizontal" | Lucide Contributors (portions Cole Bemis, Feather) | ISC AND MIT | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-horizontal.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `crates/ui-egui/src/i18n/sq.tsv` | Albanian interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 signature-appearance labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Albanian UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/th.tsv` | Thai interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Thai UI strings, compiled in by crates/ui-egui/src/i18n.rs |
 | `crates/ui-egui/src/i18n/ca.tsv` | Catalan interface translation catalog | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: clean-room translations of PdfCraft's English UI labels, written from their meaning; no proprietary localisation resources; 2026-10-22 page-gap labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 text-field-table labels are contributor-original AI-assisted translations from English, not separately native-reviewed; 2026-10-22 secured-document notice labels are contributor-original AI-assisted translations from English, not separately native-reviewed; the 2026-10-22 reply-count label is an AI-assisted translation from English, not separately native-reviewed | Catalan UI strings, compiled in by crates/ui-egui/src/i18n.rs |
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index 84f71f904e..76f4cf40a8 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -296,7 +296,7 @@ path = "assets/icons/accessibility.svg"
 title = "Lucide icon \"accessibility\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/accessibility.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -307,7 +307,7 @@ path = "assets/icons/align-left.svg"
 title = "Lucide icon \"align-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -318,7 +318,7 @@ path = "assets/icons/align-center.svg"
 title = "Lucide icon \"align-center\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-center.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -329,7 +329,7 @@ path = "assets/icons/square-terminal.svg"
 title = "Lucide icon \"square-terminal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-terminal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -340,7 +340,7 @@ path = "assets/icons/file-code.svg"
 title = "Lucide icon \"file-code\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-code.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -351,7 +351,7 @@ path = "assets/icons/file-spreadsheet.svg"
 title = "Lucide icon \"file-spreadsheet\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-spreadsheet.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -362,7 +362,7 @@ path = "assets/icons/align-justify.svg"
 title = "Lucide icon \"align-justify\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-justify.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -373,7 +373,7 @@ path = "assets/icons/align-right.svg"
 title = "Lucide icon \"align-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/align-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -384,7 +384,7 @@ path = "assets/icons/columns-3.svg"
 title = "Lucide icon \"columns-3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -395,7 +395,7 @@ path = "assets/icons/rows-3.svg"
 title = "Lucide icon \"rows-3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rows-3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -406,7 +406,7 @@ path = "assets/icons/flip-horizontal-2.svg"
 title = "Lucide icon \"flip-horizontal-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-horizontal-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -417,7 +417,7 @@ path = "assets/icons/flip-vertical-2.svg"
 title = "Lucide icon \"flip-vertical-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/flip-vertical-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -428,7 +428,7 @@ path = "assets/icons/app-window.svg"
 title = "Lucide icon \"app-window\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/app-window.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -439,7 +439,7 @@ path = "assets/icons/arrow-left-right.svg"
 title = "Lucide icon \"arrow-left-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-left-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -450,7 +450,7 @@ path = "assets/icons/arrow-up-down.svg"
 title = "Lucide icon \"arrow-up-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -461,7 +461,7 @@ path = "assets/icons/arrow-up-right.svg"
 title = "Lucide icon \"arrow-up-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/arrow-up-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -472,7 +472,7 @@ path = "assets/icons/badge-check.svg"
 title = "Lucide icon \"badge-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/badge-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -483,7 +483,7 @@ path = "assets/icons/bandage.svg"
 title = "Lucide icon \"bandage\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bandage.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -494,7 +494,7 @@ path = "assets/icons/bell.svg"
 title = "Lucide icon \"bell\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bell.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -505,7 +505,7 @@ path = "assets/icons/blend.svg"
 title = "Lucide icon \"blend\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/blend.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -516,7 +516,7 @@ path = "assets/icons/bold.svg"
 title = "Lucide icon \"bold\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bold.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -527,7 +527,7 @@ path = "assets/icons/book-open.svg"
 title = "Lucide icon \"book-open\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/book-open.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -538,7 +538,7 @@ path = "assets/icons/bookmark.svg"
 title = "Lucide icon \"bookmark\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -549,7 +549,7 @@ path = "assets/icons/bookmark-plus.svg"
 title = "Lucide icon \"bookmark-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/bookmark-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -560,7 +560,7 @@ path = "assets/icons/braces.svg"
 title = "Lucide icon \"braces\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/braces.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -571,7 +571,7 @@ path = "assets/icons/brush-cleaning.svg"
 title = "Lucide icon \"brush-cleaning\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush-cleaning.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -582,7 +582,7 @@ path = "assets/icons/brush.svg"
 title = "Lucide icon \"brush\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/brush.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -593,7 +593,7 @@ path = "assets/icons/camera.svg"
 title = "Lucide icon \"camera\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/camera.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -604,7 +604,7 @@ path = "assets/icons/check-circle-2.svg"
 title = "Lucide icon \"check-circle-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check-circle-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -615,7 +615,7 @@ path = "assets/icons/check.svg"
 title = "Lucide icon \"check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -626,7 +626,7 @@ path = "assets/icons/chevron-down.svg"
 title = "Lucide icon \"chevron-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -637,7 +637,7 @@ path = "assets/icons/chevron-left.svg"
 title = "Lucide icon \"chevron-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -648,7 +648,7 @@ path = "assets/icons/chevron-right.svg"
 title = "Lucide icon \"chevron-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -659,7 +659,7 @@ path = "assets/icons/chevron-up.svg"
 title = "Lucide icon \"chevron-up\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevron-up.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -670,7 +670,7 @@ path = "assets/icons/chevrons-left.svg"
 title = "Lucide icon \"chevrons-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -681,7 +681,7 @@ path = "assets/icons/chevrons-right.svg"
 title = "Lucide icon \"chevrons-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/chevrons-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -692,7 +692,7 @@ path = "assets/icons/circle-check.svg"
 title = "Lucide icon \"circle-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -703,7 +703,7 @@ path = "assets/icons/circle-dashed.svg"
 title = "Lucide icon \"circle-dashed\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dashed.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -714,7 +714,7 @@ path = "assets/icons/circle-dot.svg"
 title = "Lucide icon \"circle-dot\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-dot.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -725,7 +725,7 @@ path = "assets/icons/circle-help.svg"
 title = "Lucide icon \"circle-help\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-help.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -736,7 +736,7 @@ path = "assets/icons/circle.svg"
 title = "Lucide icon \"circle\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -747,7 +747,7 @@ path = "assets/icons/clock-3.svg"
 title = "Lucide icon \"clock-3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock-3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -758,7 +758,7 @@ path = "assets/icons/clock.svg"
 title = "Lucide icon \"clock\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clock.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -769,7 +769,7 @@ path = "assets/icons/cloud-upload.svg"
 title = "Lucide icon \"cloud-upload\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud-upload.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -780,7 +780,7 @@ path = "assets/icons/cloud.svg"
 title = "Lucide icon \"cloud\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/cloud.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -791,7 +791,7 @@ path = "assets/icons/code-xml.svg"
 title = "Lucide icon \"code-xml\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/code-xml.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -802,7 +802,7 @@ path = "assets/icons/columns-2.svg"
 title = "Lucide icon \"columns-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/columns-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -813,7 +813,7 @@ path = "assets/icons/compass.svg"
 title = "Lucide icon \"compass\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/compass.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -824,7 +824,7 @@ path = "assets/icons/contrast.svg"
 title = "Lucide icon \"contrast\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/contrast.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -835,7 +835,7 @@ path = "assets/icons/copy-plus.svg"
 title = "Lucide icon \"copy-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -846,7 +846,7 @@ path = "assets/icons/copy.svg"
 title = "Lucide icon \"copy\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/copy.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -857,7 +857,7 @@ path = "assets/icons/crop.svg"
 title = "Lucide icon \"crop\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/crop.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -868,7 +868,7 @@ path = "assets/icons/droplet.svg"
 title = "Lucide icon \"droplet\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/droplet.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -879,7 +879,7 @@ path = "assets/icons/ellipsis-vertical.svg"
 title = "Lucide icon \"ellipsis-vertical\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis-vertical.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -890,7 +890,7 @@ path = "assets/icons/ellipsis.svg"
 title = "Lucide icon \"ellipsis\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ellipsis.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -901,7 +901,7 @@ path = "assets/icons/eraser.svg"
 title = "Lucide icon \"eraser\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eraser.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -912,7 +912,7 @@ path = "assets/icons/external-link.svg"
 title = "Lucide icon \"external-link\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/external-link.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -923,7 +923,7 @@ path = "assets/icons/eye-off.svg"
 title = "Lucide icon \"eye-off\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye-off.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -934,7 +934,7 @@ path = "assets/icons/eye.svg"
 title = "Lucide icon \"eye\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/eye.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -945,7 +945,7 @@ path = "assets/icons/file-check.svg"
 title = "Lucide icon \"file-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -956,7 +956,7 @@ path = "assets/icons/file-down.svg"
 title = "Lucide icon \"file-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -967,7 +967,7 @@ path = "assets/icons/file-input.svg"
 title = "Lucide icon \"file-input\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-input.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -978,7 +978,7 @@ path = "assets/icons/file-lock-2.svg"
 title = "Lucide icon \"file-lock-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-lock-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -989,7 +989,7 @@ path = "assets/icons/file-minus.svg"
 title = "Lucide icon \"file-minus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-minus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1000,7 +1000,7 @@ path = "assets/icons/file-output.svg"
 title = "Lucide icon \"file-output\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-output.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1011,7 +1011,7 @@ path = "assets/icons/file-pen-line.svg"
 title = "Lucide icon \"file-pen-line\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-pen-line.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1022,7 +1022,7 @@ path = "assets/icons/file-plus-2.svg"
 title = "Lucide icon \"file-plus-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1033,7 +1033,7 @@ path = "assets/icons/file-plus.svg"
 title = "Lucide icon \"file-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1044,7 +1044,7 @@ path = "assets/icons/file-scan.svg"
 title = "Lucide icon \"file-scan\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-scan.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1055,7 +1055,7 @@ path = "assets/icons/file-search.svg"
 title = "Lucide icon \"file-search\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-search.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1066,7 +1066,7 @@ path = "assets/icons/file-symlink.svg"
 title = "Lucide icon \"file-symlink\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-symlink.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1077,7 +1077,7 @@ path = "assets/icons/file-text.svg"
 title = "Lucide icon \"file-text\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-text.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1088,7 +1088,7 @@ path = "assets/icons/file-x.svg"
 title = "Lucide icon \"file-x\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/file-x.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1099,7 +1099,7 @@ path = "assets/icons/files.svg"
 title = "Lucide icon \"files\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/files.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1110,7 +1110,7 @@ path = "assets/icons/film.svg"
 title = "Lucide icon \"film\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/film.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1121,7 +1121,7 @@ path = "assets/icons/filter.svg"
 title = "Lucide icon \"filter\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/filter.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1132,7 +1132,7 @@ path = "assets/icons/folder-open.svg"
 title = "Lucide icon \"folder-open\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-open.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1143,7 +1143,7 @@ path = "assets/icons/folder-plus.svg"
 title = "Lucide icon \"folder-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1154,7 +1154,7 @@ path = "assets/icons/folder.svg"
 title = "Lucide icon \"folder\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/folder.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1165,7 +1165,7 @@ path = "assets/icons/gauge.svg"
 title = "Lucide icon \"gauge\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/gauge.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1176,7 +1176,7 @@ path = "assets/icons/git-compare.svg"
 title = "Lucide icon \"git-compare\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/git-compare.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1187,7 +1187,7 @@ path = "assets/icons/globe.svg"
 title = "Lucide icon \"globe\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/globe.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1198,7 +1198,7 @@ path = "assets/icons/grid-3x3.svg"
 title = "Lucide icon \"grid-3x3\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/grid-3x3.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1209,7 +1209,7 @@ path = "assets/icons/hand.svg"
 title = "Lucide icon \"hand\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hand.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1220,7 +1220,7 @@ path = "assets/icons/hash.svg"
 title = "Lucide icon \"hash\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/hash.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1231,7 +1231,7 @@ path = "assets/icons/heading.svg"
 title = "Lucide icon \"heading\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/heading.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1242,7 +1242,7 @@ path = "assets/icons/highlighter.svg"
 title = "Lucide icon \"highlighter\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/highlighter.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1253,7 +1253,7 @@ path = "assets/icons/house.svg"
 title = "Lucide icon \"house\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/house.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1264,7 +1264,7 @@ path = "assets/icons/image-plus.svg"
 title = "Lucide icon \"image-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1275,7 +1275,7 @@ path = "assets/icons/image.svg"
 title = "Lucide icon \"image\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/image.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1286,7 +1286,7 @@ path = "assets/icons/info.svg"
 title = "Lucide icon \"info\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/info.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1297,7 +1297,7 @@ path = "assets/icons/italic.svg"
 title = "Lucide icon \"italic\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/italic.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1308,7 +1308,7 @@ path = "assets/icons/languages.svg"
 title = "Lucide icon \"languages\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/languages.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1319,7 +1319,7 @@ path = "assets/icons/lasso.svg"
 title = "Lucide icon \"lasso\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lasso.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1330,7 +1330,7 @@ path = "assets/icons/layers.svg"
 title = "Lucide icon \"layers\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layers.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1341,7 +1341,7 @@ path = "assets/icons/layout-grid.svg"
 title = "Lucide icon \"layout-grid\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/layout-grid.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1352,7 +1352,7 @@ path = "assets/icons/link-2.svg"
 title = "Lucide icon \"link-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1363,7 +1363,7 @@ path = "assets/icons/link.svg"
 title = "Lucide icon \"link\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/link.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1374,7 +1374,7 @@ path = "assets/icons/list-checks.svg"
 title = "Lucide icon \"list-checks\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-checks.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1385,7 +1385,7 @@ path = "assets/icons/list-ordered.svg"
 title = "Lucide icon \"list-ordered\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list-ordered.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1396,7 +1396,7 @@ path = "assets/icons/list.svg"
 title = "Lucide icon \"list\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/list.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1407,7 +1407,7 @@ path = "assets/icons/lock-open.svg"
 title = "Lucide icon \"lock-open\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock-open.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1418,7 +1418,7 @@ path = "assets/icons/lock.svg"
 title = "Lucide icon \"lock\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/lock.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1429,7 +1429,7 @@ path = "assets/icons/maximize-2.svg"
 title = "Lucide icon \"maximize-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1440,7 +1440,7 @@ path = "assets/icons/maximize.svg"
 title = "Lucide icon \"maximize\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/maximize.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1451,7 +1451,7 @@ path = "assets/icons/message-circle-reply.svg"
 title = "Lucide icon \"message-circle-reply\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-circle-reply.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1462,7 +1462,7 @@ path = "assets/icons/message-square-text.svg"
 title = "Lucide icon \"message-square-text\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-text.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1473,7 +1473,7 @@ path = "assets/icons/message-square.svg"
 title = "Lucide icon \"message-square\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1484,7 +1484,7 @@ path = "assets/icons/messages-square.svg"
 title = "Lucide icon \"messages-square\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/messages-square.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1495,7 +1495,7 @@ path = "assets/icons/mic.svg"
 title = "Lucide icon \"mic\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mic.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1506,7 +1506,7 @@ path = "assets/icons/minimize.svg"
 title = "Lucide icon \"minimize\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1517,7 +1517,7 @@ path = "assets/icons/minimize-2.svg"
 title = "Lucide icon \"minimize-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minimize-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1528,7 +1528,7 @@ path = "assets/icons/minus.svg"
 title = "Lucide icon \"minus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/minus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1539,7 +1539,7 @@ path = "assets/icons/moon.svg"
 title = "Lucide icon \"moon\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/moon.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1550,7 +1550,7 @@ path = "assets/icons/mouse-pointer-2.svg"
 title = "Lucide icon \"mouse-pointer-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/mouse-pointer-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1561,7 +1561,7 @@ path = "assets/icons/move.svg"
 title = "Lucide icon \"move\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1572,7 +1572,7 @@ path = "assets/icons/navigation.svg"
 title = "Lucide icon \"navigation\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/navigation.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1583,7 +1583,7 @@ path = "assets/icons/paint-bucket.svg"
 title = "Lucide icon \"paint-bucket\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paint-bucket.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1594,7 +1594,7 @@ path = "assets/icons/palette.svg"
 title = "Lucide icon \"palette\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/palette.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1605,7 +1605,7 @@ path = "assets/icons/panel-left.svg"
 title = "Lucide icon \"panel-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1616,7 +1616,7 @@ path = "assets/icons/panel-right.svg"
 title = "Lucide icon \"panel-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panel-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1627,7 +1627,7 @@ path = "assets/icons/panels-top-left.svg"
 title = "Lucide icon \"panels-top-left\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/panels-top-left.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1638,7 +1638,7 @@ path = "assets/icons/paperclip.svg"
 title = "Lucide icon \"paperclip\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/paperclip.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1649,7 +1649,7 @@ path = "assets/icons/pen-line.svg"
 title = "Lucide icon \"pen-line\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-line.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1660,7 +1660,7 @@ path = "assets/icons/pen-tool.svg"
 title = "Lucide icon \"pen-tool\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pen-tool.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1671,7 +1671,7 @@ path = "assets/icons/pencil.svg"
 title = "Lucide icon \"pencil\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pencil.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1682,7 +1682,7 @@ path = "assets/icons/pipette.svg"
 title = "Lucide icon \"pipette\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pipette.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1693,7 +1693,7 @@ path = "assets/icons/plus.svg"
 title = "Lucide icon \"plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1704,7 +1704,7 @@ path = "assets/icons/presentation.svg"
 title = "Lucide icon \"presentation\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/presentation.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1715,7 +1715,7 @@ path = "assets/icons/printer.svg"
 title = "Lucide icon \"printer\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/printer.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1726,7 +1726,7 @@ path = "assets/icons/rectangle-horizontal.svg"
 title = "Lucide icon \"rectangle-horizontal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rectangle-horizontal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1737,7 +1737,7 @@ path = "assets/icons/redo-2.svg"
 title = "Lucide icon \"redo-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/redo-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1748,7 +1748,7 @@ path = "assets/icons/replace.svg"
 title = "Lucide icon \"replace\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/replace.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1759,7 +1759,7 @@ path = "assets/icons/rotate-ccw.svg"
 title = "Lucide icon \"rotate-ccw\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-ccw.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1770,7 +1770,7 @@ path = "assets/icons/rotate-cw.svg"
 title = "Lucide icon \"rotate-cw\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/rotate-cw.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1781,7 +1781,7 @@ path = "assets/icons/ruler.svg"
 title = "Lucide icon \"ruler\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/ruler.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1792,7 +1792,7 @@ path = "assets/icons/save.svg"
 title = "Lucide icon \"save\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/save.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1803,7 +1803,7 @@ path = "assets/icons/scan-text.svg"
 title = "Lucide icon \"scan-text\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan-text.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1814,7 +1814,7 @@ path = "assets/icons/scan.svg"
 title = "Lucide icon \"scan\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scan.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1825,7 +1825,7 @@ path = "assets/icons/scissors.svg"
 title = "Lucide icon \"scissors\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/scissors.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1836,7 +1836,7 @@ path = "assets/icons/search.svg"
 title = "Lucide icon \"search\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/search.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1847,7 +1847,7 @@ path = "assets/icons/send.svg"
 title = "Lucide icon \"send\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/send.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1858,7 +1858,7 @@ path = "assets/icons/settings-2.svg"
 title = "Lucide icon \"settings-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1869,7 +1869,7 @@ path = "assets/icons/settings.svg"
 title = "Lucide icon \"settings\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/settings.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1880,7 +1880,7 @@ path = "assets/icons/share-2.svg"
 title = "Lucide icon \"share-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/share-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1891,7 +1891,7 @@ path = "assets/icons/shield-check.svg"
 title = "Lucide icon \"shield-check\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/shield-check.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1902,7 +1902,7 @@ path = "assets/icons/signature.svg"
 title = "Lucide icon \"signature\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/signature.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1913,7 +1913,7 @@ path = "assets/icons/sliders-horizontal.svg"
 title = "Lucide icon \"sliders-horizontal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sliders-horizontal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1924,7 +1924,7 @@ path = "assets/icons/sparkles.svg"
 title = "Lucide icon \"sparkles\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sparkles.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1935,7 +1935,7 @@ path = "assets/icons/spline.svg"
 title = "Lucide icon \"spline\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/spline.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1946,7 +1946,7 @@ path = "assets/icons/square-dashed-mouse-pointer.svg"
 title = "Lucide icon \"square-dashed-mouse-pointer\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed-mouse-pointer.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1957,7 +1957,7 @@ path = "assets/icons/square-dashed.svg"
 title = "Lucide icon \"square-dashed\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square-dashed.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1968,7 +1968,7 @@ path = "assets/icons/square.svg"
 title = "Lucide icon \"square\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/square.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1979,7 +1979,7 @@ path = "assets/icons/squares-subtract.svg"
 title = "Lucide icon \"squares-subtract\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/squares-subtract.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -1990,7 +1990,7 @@ path = "assets/icons/stamp.svg"
 title = "Lucide icon \"stamp\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/stamp.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2001,7 +2001,7 @@ path = "assets/icons/star.svg"
 title = "Lucide icon \"star\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/star.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2012,7 +2012,7 @@ path = "assets/icons/sticky-note.svg"
 title = "Lucide icon \"sticky-note\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sticky-note.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2023,7 +2023,7 @@ path = "assets/icons/strikethrough.svg"
 title = "Lucide icon \"strikethrough\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/strikethrough.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2034,7 +2034,7 @@ path = "assets/icons/sun.svg"
 title = "Lucide icon \"sun\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/sun.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2045,7 +2045,7 @@ path = "assets/icons/swatch-book.svg"
 title = "Lucide icon \"swatch-book\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/swatch-book.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2056,7 +2056,7 @@ path = "assets/icons/tag.svg"
 title = "Lucide icon \"tag\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/tag.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2067,7 +2067,7 @@ path = "assets/icons/text-cursor-input.svg"
 title = "Lucide icon \"text-cursor-input\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-cursor-input.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2078,7 +2078,7 @@ path = "assets/icons/text-select.svg"
 title = "Lucide icon \"text-select\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/text-select.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2089,7 +2089,7 @@ path = "assets/icons/trash-2.svg"
 title = "Lucide icon \"trash-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2100,7 +2100,7 @@ path = "assets/icons/trash.svg"
 title = "Lucide icon \"trash\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/trash.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2111,7 +2111,7 @@ path = "assets/icons/triangle-alert.svg"
 title = "Lucide icon \"triangle-alert\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/triangle-alert.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2122,7 +2122,7 @@ path = "assets/icons/type.svg"
 title = "Lucide icon \"type\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/type.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2133,7 +2133,7 @@ path = "assets/icons/underline.svg"
 title = "Lucide icon \"underline\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/underline.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2144,7 +2144,7 @@ path = "assets/icons/undo-2.svg"
 title = "Lucide icon \"undo-2\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/undo-2.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2155,7 +2155,7 @@ path = "assets/icons/user-round.svg"
 title = "Lucide icon \"user-round\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/user-round.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2166,7 +2166,7 @@ path = "assets/icons/wand-sparkles.svg"
 title = "Lucide icon \"wand-sparkles\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wand-sparkles.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2177,7 +2177,7 @@ path = "assets/icons/wrench.svg"
 title = "Lucide icon \"wrench\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/wrench.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2188,7 +2188,7 @@ path = "assets/icons/x.svg"
 title = "Lucide icon \"x\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/x.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2199,7 +2199,7 @@ path = "assets/icons/zoom-in.svg"
 title = "Lucide icon \"zoom-in\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-in.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -2210,7 +2210,7 @@ path = "assets/icons/zoom-out.svg"
 title = "Lucide icon \"zoom-out\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-out.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3194,7 +3194,7 @@ path = "assets/icons/pin.svg"
 title = "Lucide icon \"pin\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pin.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3205,7 +3205,7 @@ path = "assets/icons/move-right.svg"
 title = "Lucide icon \"move-right\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-right.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3216,7 +3216,7 @@ path = "assets/icons/reply.svg"
 title = "Lucide icon \"reply\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/reply.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3227,7 +3227,7 @@ path = "assets/icons/thumbs-up.svg"
 title = "Lucide icon \"thumbs-up\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-up.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3238,7 +3238,7 @@ path = "assets/icons/thumbs-down.svg"
 title = "Lucide icon \"thumbs-down\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/thumbs-down.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3249,7 +3249,7 @@ path = "assets/icons/message-square-plus.svg"
 title = "Lucide icon \"message-square-plus\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-plus.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3260,7 +3260,7 @@ path = "assets/icons/circle-x.svg"
 title = "Lucide icon \"circle-x\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/circle-x.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3282,7 +3282,7 @@ path = "assets/icons/pentagon.svg"
 title = "Lucide icon \"pentagon\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pentagon.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3293,7 +3293,7 @@ path = "assets/icons/message-square-quote.svg"
 title = "Lucide icon \"message-square-quote\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/message-square-quote.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3315,7 +3315,7 @@ path = "assets/icons/clipboard-paste.svg"
 title = "Lucide icon \"clipboard-paste\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/clipboard-paste.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3408,7 +3408,7 @@ path = "assets/icons/monitor.svg"
 title = "Lucide icon \"monitor\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3461,7 +3461,7 @@ path = "assets/icons/superscript.svg"
 title = "Lucide icon \"superscript\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/superscript.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3472,7 +3472,7 @@ path = "assets/icons/subscript.svg"
 title = "Lucide icon \"subscript\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/subscript.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3483,7 +3483,7 @@ path = "assets/icons/pilcrow.svg"
 title = "Lucide icon \"pilcrow\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/pilcrow.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
@@ -3494,7 +3494,7 @@ path = "assets/icons/move-horizontal.svg"
 title = "Lucide icon \"move-horizontal\""
 author = "Lucide Contributors (portions Cole Bemis, Feather)"
 source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/move-horizontal.svg)"
-licence = "ISC"
+licence = "ISC AND MIT"
 licence_file = "assets/icons/LICENSE-lucide.txt"
 kind = "icon"
 usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
diff --git a/Cargo.lock b/Cargo.lock
index 0b00fac2f6..0d45bc8044 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4208,7 +4208,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "chrono",
  "craft-update",
@@ -4232,7 +4232,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-a11y"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4244,7 +4244,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-annot"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4255,7 +4255,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-audit"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "pdfcraft-content",
  "pdfcraft-cos",
@@ -4266,7 +4266,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-automation"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "base64 0.23.1",
  "flate2",
@@ -4288,7 +4288,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cli"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "base64 0.23.1",
  "pdfcraft-audit",
@@ -4306,11 +4306,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-compare"
-version = "0.16.1"
+version = "0.17.0"
 
 [[package]]
 name = "pdfcraft-content"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-cos",
@@ -4318,7 +4318,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-cos"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "chrono",
  "hayro-syntax",
@@ -4333,7 +4333,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-create"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "encoding_rs",
  "hayro-ccitt",
@@ -4352,7 +4352,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-crypt"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "aes",
  "md-5",
@@ -4364,7 +4364,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-edit"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "hayro-syntax",
  "kurbo 0.13.1",
@@ -4373,6 +4373,8 @@ dependencies = [
  "pdfcraft-cos",
  "pdfcraft-fonts",
  "pdfcraft-model",
+ "pdfcraft-render",
+ "proptest",
  "sha2 0.11.1",
  "thiserror 2.0.21",
  "unicode-bidi",
@@ -4380,7 +4382,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-engine"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "chrono",
  "craft-docpath",
@@ -4392,6 +4394,7 @@ dependencies = [
  "pdfcraft-annot",
  "pdfcraft-audit",
  "pdfcraft-compare",
+ "pdfcraft-content",
  "pdfcraft-cos",
  "pdfcraft-create",
  "pdfcraft-edit",
@@ -4423,14 +4426,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-export"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "flate2",
 ]
 
 [[package]]
 name = "pdfcraft-filters"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "fax",
  "flate2",
@@ -4443,7 +4446,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-fonts"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "harfrust",
  "pdfcraft-cos",
@@ -4453,7 +4456,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-forms"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4466,11 +4469,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-geom"
-version = "0.16.1"
+version = "0.17.0"
 
 [[package]]
 name = "pdfcraft-js"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "boa_engine",
  "chrono",
@@ -4478,7 +4481,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-measure"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4491,14 +4494,14 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-model"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "pdfcraft-cos",
 ]
 
 [[package]]
 name = "pdfcraft-ocr"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "ocrs",
  "pdfcraft-fonts",
@@ -4509,7 +4512,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-optimize"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "image",
  "pdfcraft-annot",
@@ -4525,11 +4528,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-oracle"
-version = "0.16.1"
+version = "0.17.0"
 
 [[package]]
 name = "pdfcraft-organize"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "hayro-syntax",
  "pdfcraft-content",
@@ -4540,7 +4543,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-platform"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "async-channel",
  "futures-lite",
@@ -4550,7 +4553,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-preflight"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "flate2",
  "pdfcraft-content",
@@ -4561,7 +4564,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-print"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "craft-print",
  "pdfcraft-content",
@@ -4573,7 +4576,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-redact"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-content",
@@ -4590,7 +4593,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-render"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "bytemuck",
  "flate2",
@@ -4609,7 +4612,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-sign"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "aes",
  "aws-lc-rs",
@@ -4645,11 +4648,11 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-testkit"
-version = "0.16.1"
+version = "0.17.0"
 
 [[package]]
 name = "pdfcraft-ui-egui"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "arboard",
  "base64 0.23.1",
@@ -4673,6 +4676,7 @@ dependencies = [
  "objc2 0.6.5",
  "objc2-app-kit 0.3.2",
  "objc2-foundation 0.3.2",
+ "pdfcraft-content",
  "pdfcraft-cos",
  "pdfcraft-engine",
  "pdfcraft-fonts",
@@ -4683,6 +4687,7 @@ dependencies = [
  "plist",
  "png 0.18.1",
  "pollster 1.0.1",
+ "proptest",
  "rfd",
  "rustix 1.1.5",
  "serde",
@@ -4701,7 +4706,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-web"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "eframe",
  "egui",
@@ -4713,7 +4718,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfa"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "base64 0.23.1",
  "image",
@@ -4727,7 +4732,7 @@ dependencies = [
 
 [[package]]
 name = "pdfcraft-xfdf"
-version = "0.16.1"
+version = "0.17.0"
 dependencies = [
  "pdfcraft-annot",
  "pdfcraft-cos",
diff --git a/Cargo.toml b/Cargo.toml
index 85d02570ba..c9db94b27b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ exclude = ["vendor"]
 default-members = ["crates/*", "apps/pdfcraft", "apps/pdfcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.16.1"
+version = "0.17.0"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.95"
@@ -26,39 +26,39 @@ craft-docpath = { version = "0.1.0", git = "https://github.com/storytold/craft-l
 # craft-update: app-specific pretend versions apply to startup and manual checks.
 craft-update = { git = "https://github.com/storytold/craft-libs", version = "=0.1.0", rev = "c5a1cbfb5f9049f9270955caffb5bee5997aebf7", features = ["egui"] }
 # internal
-pdfcraft-geom = { path = "crates/geom", version = "0.16.1" }
-pdfcraft-filters = { path = "crates/filters", version = "0.16.1" }
-pdfcraft-cos = { path = "crates/cos", version = "0.16.1" }
-pdfcraft-crypt = { path = "crates/crypt", version = "0.16.1" }
-pdfcraft-organize = { path = "crates/organize", version = "0.16.1" }
-pdfcraft-measure = { path = "crates/measure", version = "0.16.1" }
-pdfcraft-annot = { path = "crates/annot", version = "0.16.1" }
-pdfcraft-audit = { path = "crates/audit", version = "0.16.1" }
-pdfcraft-fonts = { path = "crates/fonts", version = "0.16.1" }
-pdfcraft-model = { path = "crates/model", version = "0.16.1" }
-pdfcraft-content = { path = "crates/content", version = "0.16.1" }
-pdfcraft-redact = { path = "crates/redact", version = "0.16.1" }
-pdfcraft-print = { path = "crates/print", version = "0.16.1" }
-pdfcraft-xfdf = { path = "crates/xfdf", version = "0.16.1" }
-pdfcraft-sign = { path = "crates/sign", version = "0.16.1" }
-pdfcraft-optimize = { path = "crates/optimize", version = "0.16.1" }
-pdfcraft-a11y = { path = "crates/a11y", version = "0.16.1" }
-pdfcraft-oracle = { path = "crates/oracle", version = "0.16.1" }
-pdfcraft-testkit = { path = "crates/testkit", version = "0.16.1" }
-pdfcraft-ocr = { path = "crates/ocr", version = "0.16.1" }
-pdfcraft-js = { path = "crates/js", version = "0.16.1" }
-pdfcraft-compare = { path = "crates/compare", version = "0.16.1" }
-pdfcraft-preflight = { path = "crates/preflight", version = "0.16.1" }
-pdfcraft-export = { path = "crates/export", version = "0.16.1" }
-pdfcraft-edit = { path = "crates/edit", version = "0.16.1" }
-pdfcraft-create = { path = "crates/create", version = "0.16.1" }
-pdfcraft-forms = { path = "crates/forms", version = "0.16.1" }
-pdfcraft-xfa = { path = "crates/xfa", version = "0.16.1" }
-pdfcraft-render = { path = "crates/render", version = "0.16.1" }
-pdfcraft-engine = { path = "crates/engine", version = "0.16.1" }
-pdfcraft-platform = { path = "crates/platform", version = "0.16.1" }
-pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.16.1" }
-pdfcraft-automation = { path = "crates/automation", version = "0.16.1", default-features = false }
+pdfcraft-geom = { path = "crates/geom", version = "0.17.0" }
+pdfcraft-filters = { path = "crates/filters", version = "0.17.0" }
+pdfcraft-cos = { path = "crates/cos", version = "0.17.0" }
+pdfcraft-crypt = { path = "crates/crypt", version = "0.17.0" }
+pdfcraft-organize = { path = "crates/organize", version = "0.17.0" }
+pdfcraft-measure = { path = "crates/measure", version = "0.17.0" }
+pdfcraft-annot = { path = "crates/annot", version = "0.17.0" }
+pdfcraft-audit = { path = "crates/audit", version = "0.17.0" }
+pdfcraft-fonts = { path = "crates/fonts", version = "0.17.0" }
+pdfcraft-model = { path = "crates/model", version = "0.17.0" }
+pdfcraft-content = { path = "crates/content", version = "0.17.0" }
+pdfcraft-redact = { path = "crates/redact", version = "0.17.0" }
+pdfcraft-print = { path = "crates/print", version = "0.17.0" }
+pdfcraft-xfdf = { path = "crates/xfdf", version = "0.17.0" }
+pdfcraft-sign = { path = "crates/sign", version = "0.17.0" }
+pdfcraft-optimize = { path = "crates/optimize", version = "0.17.0" }
+pdfcraft-a11y = { path = "crates/a11y", version = "0.17.0" }
+pdfcraft-oracle = { path = "crates/oracle", version = "0.17.0" }
+pdfcraft-testkit = { path = "crates/testkit", version = "0.17.0" }
+pdfcraft-ocr = { path = "crates/ocr", version = "0.17.0" }
+pdfcraft-js = { path = "crates/js", version = "0.17.0" }
+pdfcraft-compare = { path = "crates/compare", version = "0.17.0" }
+pdfcraft-preflight = { path = "crates/preflight", version = "0.17.0" }
+pdfcraft-export = { path = "crates/export", version = "0.17.0" }
+pdfcraft-edit = { path = "crates/edit", version = "0.17.0" }
+pdfcraft-create = { path = "crates/create", version = "0.17.0" }
+pdfcraft-forms = { path = "crates/forms", version = "0.17.0" }
+pdfcraft-xfa = { path = "crates/xfa", version = "0.17.0" }
+pdfcraft-render = { path = "crates/render", version = "0.17.0" }
+pdfcraft-engine = { path = "crates/engine", version = "0.17.0" }
+pdfcraft-platform = { path = "crates/platform", version = "0.17.0" }
+pdfcraft-ui-egui = { path = "crates/ui-egui", version = "0.17.0" }
+pdfcraft-automation = { path = "crates/automation", version = "0.17.0", default-features = false }
 
 # pdf
 hayro = "0.7.1"
diff --git a/LICENSES.toml b/LICENSES.toml
new file mode 100644
index 0000000000..d9ceb3180e
--- /dev/null
+++ b/LICENSES.toml
@@ -0,0 +1,159 @@
+# Stage 1 source documents only. Destinations are logical names, not packaging instructions.
+# licences lists audited full-text identifiers; omission grants no bundle applicability.
+
+[[document]]
+source = "LICENSE-APACHE"
+licences = ["Apache-2.0"]
+destination = "LICENSE-APACHE"
+sha256 = "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594"
+
+[[document]]
+source = "LICENSE-MIT"
+licences = ["MIT"]
+destination = "LICENSE-MIT"
+sha256 = "cd7032ea33b71427f188e34ffb4aee9d6868a57fd196037c5c8b2be03a2a0352"
+
+[[document]]
+source = "NOTICE"
+destination = "NOTICE"
+sha256 = "9f854f730719af962cd840529324d089e05e68a30bd245c50e33f96e009b4314"
+
+[[document]]
+source = "assets/app-icon/LICENSE-document.txt"
+destination = "assets/app-icon/LICENSE-document.txt"
+sha256 = "64a3137e3d5cc41e5b78d2ad8dd9ddddd6588283f9f7b3128aa6a8a50852fb9a"
+
+[[document]]
+source = "assets/app-icon/LICENSE.txt"
+destination = "assets/app-icon/LICENSE.txt"
+sha256 = "b768acafe6cbad8247eedf86b5b5381feefcd4ee0f8c7808b86811bc687cf37b"
+
+[[document]]
+source = "assets/fonts/OFL-DancingScript.txt"
+destination = "assets/fonts/OFL-DancingScript.txt"
+sha256 = "6f090277c00af96651ce6dbcc38ff1591047a3bffef486e80b6a32e8276a8201"
+
+[[document]]
+source = "assets/fonts/OFL-Inter.txt"
+destination = "assets/fonts/OFL-Inter.txt"
+sha256 = "262481e844521b326f5ecd053e59b98c8b2da78c8ee1bdbb6e8174305e54935a"
+
+[[document]]
+source = "assets/fonts/OFL-JetBrainsMono.txt"
+destination = "assets/fonts/OFL-JetBrainsMono.txt"
+sha256 = "a76abf002c49097d146e86740a3105a5d00450b1592e820a1109a8c5680cd697"
+
+[[document]]
+source = "assets/icons/LICENSE-lucide.txt"
+destination = "assets/icons/LICENSE-lucide.txt"
+sha256 = "b495047bd93a9b06913511076f504daba17d5bbeb3e0650f3bb53a4220329c57"
+
+[[document]]
+source = "docs/brand/LICENSE-brand.txt"
+destination = "docs/brand/LICENSE-brand.txt"
+sha256 = "0f33f48e7a96cd359d4e4e5b11424b13cebeb59cc70c77928186695e4173585c"
+
+[[document]]
+source = "licenses/CMap-LICENSE.txt"
+licences = ["BSD-3-Clause"]
+destination = "licenses/CMap-LICENSE.txt"
+sha256 = "742665db9c8e1bc72603c6d319ca3e90b83bd6d95202f0cd4ef11068a07a9c29"
+origin = "https://static.crates.io/crates/hayro-cmap/hayro-cmap-0.1.0.crate#assets/LICENSE.txt"
+
+[[document]]
+source = "licenses/egui-Hack-Regular.txt"
+licences = ["MIT", "Bitstream-Vera"]
+destination = "licenses/egui-Hack-Regular.txt"
+sha256 = "47c0cccbeec7e8614548cc485588b28149e7874188df5f41b36efebcee285c87"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/Hack-Regular.txt"
+
+[[document]]
+source = "licenses/egui-OFL.txt"
+licences = ["OFL-1.1"]
+destination = "licenses/egui-OFL.txt"
+sha256 = "6a73f9541c2de74158c0e7cf6b0a58ef774f5a780bf191f2d7ec9cc53efe2bf2"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/OFL.txt"
+
+[[document]]
+source = "licenses/egui-UFL.txt"
+licences = ["Ubuntu-font-1.0"]
+destination = "licenses/egui-UFL.txt"
+sha256 = "2f0015108d68627bd788d313f529c21ff4da2c2c42a5e1f3883acc83480f9002"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/UFL.txt"
+
+[[document]]
+source = "licenses/egui-emoji-icon-font-mit-license.txt"
+licences = ["MIT"]
+destination = "licenses/egui-emoji-icon-font-mit-license.txt"
+sha256 = "b9d2c1d909aa149996fd4c91dcb92b2362a04431640c1d200959da94caf8cde1"
+origin = "https://raw.githubusercontent.com/emilk/egui/0.36.2/crates/epaint_default_fonts/fonts/emoji-icon-font-mit-license.txt"
+
+[[document]]
+source = "vendor/hayro-interpret/LICENSE-APACHE"
+licences = ["Apache-2.0"]
+destination = "vendor/hayro-interpret/LICENSE-APACHE"
+sha256 = "0cec06e0e55fbc3dc5cee4fca9b607f66cb8f4e4dbcf3b3c013594dd156732e9"
+
+[[document]]
+source = "vendor/hayro-interpret/LICENSE-MIT"
+licences = ["MIT"]
+destination = "vendor/hayro-interpret/LICENSE-MIT"
+sha256 = "51b50e6120c344dcc146bbd6375ca1c78e079d97c8bea76e67a53d6ff0efebac"
+
+[[document]]
+source = "vendor/hayro-interpret/assets/CGATS_LICENSE.txt"
+destination = "vendor/hayro-interpret/assets/CGATS_LICENSE.txt"
+sha256 = "469d87b5fa48f8aaf69e25f4fcac3a309c97dbb7d561b917638abdb640e004d9"
+
+[[document]]
+source = "vendor/hayro-interpret/assets/LICENSE_FOXIT"
+destination = "vendor/hayro-interpret/assets/LICENSE_FOXIT"
+sha256 = "b578cdd2345840ada550bd12519533812320d5f1d21cf4c1c7e1b1b0a31c98b7"
+
+[[document]]
+source = "vendor/hayro-cmap/assets/LICENSE.txt"
+licences = ["BSD-3-Clause"]
+destination = "vendor/hayro-cmap/assets/LICENSE.txt"
+sha256 = "742665db9c8e1bc72603c6d319ca3e90b83bd6d95202f0cd4ef11068a07a9c29"
+
+[[document]]
+source = "vendor/vello_common/LICENSE-MIT"
+licences = ["MIT"]
+destination = "vendor/vello_common/LICENSE-MIT"
+sha256 = "adf157330f722fe7cfd5964a2a6974eff851b718228c6735724a11706e6f4dec"
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/Ubuntu-Light.ttf"
+licence = "Ubuntu-font-1.0"
+documents = ["licenses/egui-UFL.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/Hack-Regular.ttf"
+licence = "MIT AND Bitstream-Vera"
+documents = ["licenses/egui-Hack-Regular.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/NotoEmoji-Regular.ttf"
+licence = "OFL-1.1"
+documents = ["licenses/egui-OFL.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/emoji-icon-font.ttf"
+licence = "MIT"
+documents = ["licenses/egui-emoji-icon-font-mit-license.txt"]
+
+[[bundled]]
+crate = "epaint_default_fonts"
+path = "fonts/egui-icons.ttf"
+licence = "MIT"
+documents = ["licenses/egui-emoji-icon-font-mit-license.txt"]
+
+[[bundled]]
+crate = "hayro-interpret"
+path = "src/font/generated/metrics.rs"
+licence = "MIT OR Apache-2.0"
+documents = ["vendor/hayro-interpret/LICENSE-MIT", "vendor/hayro-interpret/LICENSE-APACHE"]
diff --git a/NOTICE b/NOTICE
index 63a8fe672c..e8f31ade2f 100644
--- a/NOTICE
+++ b/NOTICE
@@ -12,7 +12,7 @@ Third-party material
 This product bundles third-party material under its own licenses, listed below. The per-file
 list (author, source, license) is in ATTRIBUTION.md.
 
-- Lucide icons (assets/icons/*.svg) — ISC License. See assets/icons/LICENSE-lucide.txt.
+- Lucide icons (assets/icons/*.svg) — ISC and MIT licences (Feather-derived icons). See assets/icons/LICENSE-lucide.txt.
   The Windows PDF file icon (assets/app-icon/pdfcraft-document.svg and .ico) adapts Lucide's
   file-text outline and combines it with contributor-original artwork. See
   assets/app-icon/LICENSE-document.txt (ISC AND (MIT OR Apache-2.0)), packaged as
diff --git a/README.md b/README.md
index 9599a54844..3c1b67936a 100644
--- a/README.md
+++ b/README.md
@@ -140,6 +140,8 @@ Search the whole document as you type, step through matches with <kbd>⌘G</kbd>
 
 ## Navigate long documents
 
+Launch with `pdfcraft --two-paged file.pdf` (or `pdfcraft file.pdf --two-paged`) to open each command-line PDF in noncontinuous two-page view. This optional launch override does not change saved default-layout preferences or PDFs restored from the previous session. An explicit `--layout` option takes precedence on the active document regardless of argument order; `--default-layout` retains its existing behavior for subsequently opened documents.
+
 Right-click a PDF tab to close it, reopen the last closed file-backed tab, or reveal its file. Closing still asks about unsaved changes. Reopening reads the saved file from disk; it does not restore discarded edits. Reveal selects the file in Explorer or Finder. On Linux and FreeBSD it requests `org.freedesktop.FileManager1.ShowItems`, falling back to opening the containing directory with `xdg-open` when that service is unavailable. Reopen and Reveal are unavailable on the web; Reveal is also unavailable for pathless documents.
 
 Bookmarks, page thumbnails and the document's own page labels (i, ii, 1, 2…) keep you oriented in long documents. Search bookmark titles in the Bookmarks panel to find nested entries even when their parents are collapsed. Matches keep their ancestors for context; Clear restores the unfiltered tree without changing its expansion state.
@@ -545,9 +547,18 @@ stand on its own.
 | <img src="https://raw.githubusercontent.com/storytold/vectorcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.vectorcraft.png" alt="" width="32" height="32"> | **VectorCraft** | Vector illustration | [GitHub](https://github.com/storytold/vectorcraft) | [Website](https://getartcraft.com/apps/vectorcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/filmcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.filmcraft.png" alt="" width="32" height="32"> | **FilmCraft** | Video editing, color and sound | [GitHub](https://github.com/storytold/filmcraft) | [Website](https://getartcraft.com/apps/filmcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/lightcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.lightcraft.png" alt="" width="32" height="32"> | **LightCraft** | Photo library and raw development | [GitHub](https://github.com/storytold/lightcraft) | [Website](https://getartcraft.com/apps/lightcraft) |
-| <img src="https://raw.githubusercontent.com/storytold/pdfcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png" alt="" width="32" height="32"> | **PdfCraft** | **Reading, organizing and protecting PDFs · you are here** | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/pdfcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.pdfcraft.png" alt="" width="32" height="32"> | **PdfCraft** | Reading, organizing and protecting PDFs | [GitHub](https://github.com/storytold/pdfcraft) | [Website](https://getartcraft.com/apps/pdfcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/effectcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.effectcraft.png" alt="" width="32" height="32"> | **EffectCraft** | Motion graphics and visual effects | [GitHub](https://github.com/storytold/effectcraft) | [Website](https://getartcraft.com/apps/effectcraft) |
 | <img src="https://raw.githubusercontent.com/storytold/designcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.designcraft.png" alt="" width="32" height="32"> | **DesignCraft** | Page layout and publishing | [GitHub](https://github.com/storytold/designcraft) | [Website](https://getartcraft.com/apps/designcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/figcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.figcraft.png" alt="" width="32" height="32"> | **FigCraft** | Interface design and prototyping | [GitHub](https://github.com/storytold/figcraft) | [Website](https://getartcraft.com/apps/figcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/wordcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.wordcraft.png" alt="" width="32" height="32"> | **WordCraft** | Word processing and documents | [GitHub](https://github.com/storytold/wordcraft) | [Website](https://getartcraft.com/apps/wordcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/soundcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.soundcraft.png" alt="" width="32" height="32"> | **SoundCraft** | Audio recording and editing | [GitHub](https://github.com/storytold/soundcraft) | [Website](https://getartcraft.com/apps/soundcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/deckcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.deckcraft.png" alt="" width="32" height="32"> | **DeckCraft** | Presentations and slide decks | [GitHub](https://github.com/storytold/deckcraft) | [Website](https://getartcraft.com/apps/deckcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/cadcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.cadcraft.png" alt="" width="32" height="32"> | **CADCraft** | Computer-aided design | [GitHub](https://github.com/storytold/cadcraft) | [Website](https://getartcraft.com/apps/cadcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/gridcraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.gridcraft.png" alt="" width="32" height="32"> | **GridCraft** | Spreadsheets and data | [GitHub](https://github.com/storytold/gridcraft) | [Website](https://getartcraft.com/apps/gridcraft) |
+| <img src="https://raw.githubusercontent.com/storytold/texturecraft/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.texturecraft.png" alt="" width="32" height="32"> | **TextureCraft** | 3D texture painting | [GitHub](https://github.com/storytold/texturecraft) | [Website](https://getartcraft.com/apps/texturecraft) |
+| <img src="https://raw.githubusercontent.com/storytold/craft-anything/main/assets/app-icon/hicolor/64x64/apps/ai.storyteller.craft-anything.png" alt="" width="32" height="32"> | **Craft Anything** | See how any software works, then build your own | [GitHub](https://github.com/storytold/craft-anything) | [Website](https://getartcraft.com/apps/craft-anything) |
+| <img src="https://raw.githubusercontent.com/tangency-labs/solidcraft/main/assets/icons/app/linux/exports/hicolor/64x64/apps/io.tangencylabs.solidcraft.png" alt="" width="32" height="32"> | **SolidCraft** | Parametric 3D CAD by Tangency Labs (community app) | [GitHub](https://github.com/tangency-labs/solidcraft) | |
 
 And [**ArtCraft**](https://getartcraft.com/) itself, our AI image and video studio for artists who want real control.
 
diff --git a/ROADMAP.md b/ROADMAP.md
index 56f6237e8d..74d9241e1c 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,5 +1,11 @@
 # PdfCraft roadmap
 
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 further review: inherited drawing/text state, affine image gestures, paste/selection ownership, no-op scripts and menu permissions; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 latest comments: explicit image-paste events, mixed-size field refresh, and documented mixed-script normalization with Undo; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 review follow-up: preserve image crop/tag/stream ownership, resize in page orientation, harden clipboard and text formatting, and reload installed fonts; estimates unchanged)
+
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: GBK rasters compared with explicit Unicode and independently selected installed faces; wrong-glyph and wrong-family negative controls fail; estimates unchanged)
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: integrate main fa5f9f8c; retain CJK viewer and upstream raster regressions, restore explicit display_config imports; estimates unchanged)
 > **Last reviewed:** 2026-10-28 · **Last updated:** 2026-10-28 · **Change:** patch (M2, PR #4172: integrate main 5af10276; retain both roadmap histories and viewer-only CJK font policy; estimates unchanged)
@@ -213,6 +219,16 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-11-01 (M14, #5572):** Preferences ▸ Documents and view sets how many recent files to keep, from 0 to 50 with 12 by default. At 0 Home has no Recent section and File ▸ Open Recent is disabled. The list is cut when Preferences closes, so the number can pass through 0 on its way to another.
+
+- 2026-11-01: PR #2155 further review preserves inherited Form text state and soft-mask chronology during Arrange, composes crop-group moves in the proper scope, and uses affine/press-relative image resize plus a shared rotation pivot. No-op script buttons preserve hidden source text; paste coordinates, visible selection ownership, and Snapshot/Export permissions have dedicated regressions. Candidate only; estimates unchanged.
+
+- 2026-11-01: PR #2155 latest follow-up handles explicit image-paste events without release-time guesses, refreshes the font-size field when a selection becomes mixed, and specifies mixed-script normalization with exact Undo restoration. Candidate only; estimates unchanged.
+
+- 2026-11-01: PR #2155 review follow-up preserves editor crops through group moves and keeps arranged artwork outside added-item streams; unsafe nested-tag extraction is refused. Image handles and flips follow page orientation, added images accept general transforms, and clipboard/text/Home/font-discovery edge cases have focused regressions. Candidate only; estimates unchanged.
+- 2026-11-01: PR #2155 maintainer edits remove redundant image/text helpers and add regressions for crop ownership, arrange scope/state fidelity, clipboard precedence, crop-drag bounds, and font scanning. Transform and Unicode-script tools complete the headless paths.
+
+- **2026-10-18 (M3, #1354, local candidate):** Integrated --two-paged with current main, retaining upstream modal/picker ownership and single-tab reuse. Native launch/opening/password regressions, negative checks against the old wrapper, visual inspection, formatting, strict scoped Clippy, layers, assets, parity and scoped WASM compilation pass. Three existing socket tests are unavailable in this workspace; one existing network test remains ignored. No push or GitHub merge; estimates unchanged.
 - **2026-10-31 (M2, PR #4172 review):** Added same-machine pixel oracles for GBK Song, Hei, Kai and FangSong, including all four subset-prefixed Founder aliases. Reference PDFs use explicit Unicode mappings and independently selected installed faces; font data and rasters remain in memory. All eight cases ran; wrong-glyph and wrong-family production mutations each failed the new assertion and were restored. Validation: 422 renderer unit tests, renderer all-target Clippy with -D warnings, formatting, layers/assets/parity and renderer WASM checks passed; existing optional-patch/WASM warnings and parity notes remain. Estimates unchanged.
 
 - **2026-10-31 (M2, PR #4172):** Integrated main fa5f9f8c, retaining both roadmap histories and raster regression groups. Restored display_config and thumbnail_config imports after the upstream explicit-import migration. Validation: 422 renderer unit tests, engine/UI all-target checks, scoped all-target Clippy with -D warnings, formatting, layers, assets, parity and renderer/engine WASM checks passed. Existing optional-patch/WASM warnings and parity notes remain; no full engine/UI runtime test rerun. Display-only font policy and estimates unchanged.
@@ -805,3 +821,5 @@ PR #2133 retains document-local Pages sidebar focus for Ctrl/Cmd+A and Escape af
 ## Button export-value refresh (2026-10-30)
 
 PR #1952 retains per-widget checkbox/radio export-value editing in the split form-authoring and Prepare modules. Caption editing remains supported. Tests cover preserved appearances and selection, invalid/locked refusals, data-format round trips, and Apply/Cancel/Undo. Current-head hosted validation is pending; feature estimates are unchanged.
+
+- **2026-10-31 (#1577):** Reconciled the page-shadow preference with split viewer, organizer, settings and control modules, preserving upstream page-gap shadow suppression. CI validation pending.
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index 814730f344..5bc5c5c372 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -1,6 +1,8 @@
 //! PdfCraft desktop app.
 //!
 //! Usage: `pdfcraft [options] [files…]` (`-h` / `--help` prints a short version of this, [`USAGE`]).
+//! `--two-paged` opens each command-line PDF in noncontinuous two-page view, without changing defaults.
+//! An explicit `--layout` takes precedence for the active document, regardless of argument order.
 //! `--create-images [images…]` stages the images in one PDF and asks for the page DPI.
 //!
 //! View options (applied after the files open; also the seed of the UI control channel):
@@ -8,7 +10,7 @@
 //!  --theme light|dark|system  --language auto|<code>  --mode all|read|edit|convert|sign  --tool <catalogue id>  --left open|closed
 //!  --organize on  --fields on  --dialog properties|shortcuts|about  --palette <query>  --home on
 //!  --cover on|off  --default-layout single|continuous|two-up|two-page  --default-continuous on|off  --default-zoom fit-width|fit-page|<percent>  --always-default-view on|off
-//!  --page-gaps on|off  --default-page-gaps on|off
+//!  --page-gaps on|off  --default-page-gaps on|off  --recent-files 0..50
 //!  --combine-view grid|list  --combine-zoom 60..200`
 //!
 //! `--new-window` opens a window of its own. Without it, on Windows, a launch that only names files
@@ -40,6 +42,7 @@ mod motion;
 mod reopen;
 mod settings;
 mod single_instance;
+mod startup;
 mod text_scale;
 #[cfg(test)]
 #[path = "windows_manifest.rs"]
@@ -63,6 +66,7 @@ Usage: pdfcraft [options] [files…]
 Opens the files in the PdfCraft desktop app.
 
 Options:
+  --two-paged                 open command-line PDFs in noncontinuous two-page view
   --new-window                open a window of its own instead of passing the files to a running PdfCraft
   --create-images [images…]   put the images in one PDF and ask for the page DPI
   --control <file>            enable the UI control channel (pdfcraft-cli ui --control <file> …)
@@ -218,28 +222,16 @@ fn main() -> eframe::Result {
             let _ = std::io::Write::write_fmt(&mut std::io::stderr(), format_args!("pdfcraft: {report}\n"));
         }
     }));
-    let mut files = Vec::new();
-    let mut options: Vec<(String, String)> = Vec::new();
-    let mut control_file: Option<String> = None;
-    let mut create_images = false;
-    let mut new_window = false;
-    let mut args = std::env::args().skip(1);
-    while let Some(a) = args.next() {
-        match a.as_str() {
-            "--version" => return print_and_exit(&format!("pdfcraft {}", pdfcraft_engine::build_info::version())),
-            // Before any window or log file, so a scripted call returns (#4076).
-            "-h" | "--help" => return print_and_exit(USAGE),
-            "--control" => control_file = args.next(),
-            "--create-images" => create_images = true,
-            "--new-window" => new_window = true,
-            flag if flag.starts_with("--") => {
-                let value = args.next().unwrap_or_default();
-                options.push((flag.trim_start_matches("--").to_string(), value));
-            }
-            _ => files.push(path_from_arg(a)),
-        }
+    let mut startup = startup::Arguments::parse(std::env::args().skip(1));
+    if startup.version {
+        return print_and_exit(&format!("pdfcraft {}", pdfcraft_engine::build_info::version()));
     }
-    let files = rejoin_split_paths(files, |p| std::path::Path::new(p).is_file());
+    if startup.help {
+        return print_and_exit(USAGE);
+    }
+    startup.files = rejoin_split_paths(startup.files, |p| std::path::Path::new(p).is_file());
+    let may_hand_off = startup.may_hand_off();
+    let startup::Arguments { files, options, control_file, create_images, two_paged, .. } = startup;
     let integrated = cfg!(target_os = "macos");
     // GNOME on Wayland leaves the window frame to the app (src/decorations.rs).
     let window_controls = if cfg!(any(target_os = "macos", target_os = "windows")) { None } else { decorations::app_drawn() };
@@ -260,7 +252,6 @@ fn main() -> eframe::Result {
     // Explorer double-click, a file manager or `xdg-open`) hands them to the PdfCraft already
     // running and exits (#282, #317, #1726). Any option means the caller wants this launch's own
     // window.
-    let may_hand_off = !new_window && !files.is_empty() && options.is_empty() && control_file.is_none() && !create_images;
     // Absolute for this instance too: links relative to a document resolve against its folder,
     // never the working directory.
     let files = single_instance::absolute(&files);
@@ -270,7 +261,7 @@ fn main() -> eframe::Result {
         single_instance::Claim::Alone => None,
     };
     let choice = renderer_choice(std::env::var("PDFCRAFT_RENDERER").ok().as_deref());
-    let launch = Launch { files, options, control_file, create_images, integrated, window_controls };
+    let launch = Launch { files, options, control_file, create_images, integrated, window_controls, two_paged };
     // Finder, Open With and the Dock deliver files as Apple events, not arguments; catch the one
     // that launched us as well as later ones. Lives until the event loop returns.
     #[cfg(target_os = "macos")]
@@ -380,6 +371,7 @@ struct Launch {
     integrated: bool,
     /// The window buttons the app draws, when the desktop leaves the frame to it.
     window_controls: Option<pdfcraft_ui_egui::window_controls::Layout>,
+    two_paged: bool,
 }
 
 /// Whether the window is a native Wayland one (not X11 or XWayland).
@@ -400,7 +392,7 @@ fn app_creator<'a>(
     instance: Option<&'a single_instance::Server>,
     #[cfg(target_os = "macos")] apple_events: &'a apple_events::AppleEvents,
 ) -> eframe::AppCreator<'a> {
-    let Launch { files, options, control_file, create_images, integrated, window_controls } = launch;
+    let Launch { files, options, control_file, create_images, integrated, window_controls, two_paged } = launch;
     Box::new(move |cc| {
         started.set(true);
         let mut app = PdfCraftApp::new();
@@ -467,6 +459,7 @@ fn app_creator<'a>(
                 &[("folder", &w.folder.display().to_string()), ("error", &w.error)],
             );
         }
+        let defer_layout = two_paged && !files.is_empty() && !create_images;
         if create_images {
             if let Err(e) = app.begin_image_import_paths(&files) {
                 app.notify(e);
@@ -475,12 +468,11 @@ fn app_creator<'a>(
             // With the preference on, last session's files come back first; files named on
             // the command line open after them, in front (#442).
             app.reopen_last_files(&files);
-            for f in files {
-                app.open_path(&f);
-            }
+            startup::open_files(&mut app, &files, two_paged);
         }
         for (k, v) in options {
-            if let Err(e) = app.set_option(&k, &v) {
+            let result = if defer_layout && k == "layout" { app.set_launch_layout(&v) } else { app.set_option(&k, &v) };
+            if let Err(e) = result {
                 log::warn!("--{k} {v}: {e}");
             }
         }
diff --git a/apps/pdfcraft/src/startup.rs b/apps/pdfcraft/src/startup.rs
new file mode 100644
index 0000000000..be25da45b6
--- /dev/null
+++ b/apps/pdfcraft/src/startup.rs
@@ -0,0 +1,244 @@
+//! Native launch arguments and per-file view overrides (#1354).
+use pdfcraft_ui_egui::PdfCraftApp;
+
+#[derive(Default)]
+pub(super) struct Arguments {
+    pub files: Vec<String>,
+    pub options: Vec<(String, String)>,
+    pub control_file: Option<String>,
+    pub create_images: bool,
+    pub new_window: bool,
+    pub two_paged: bool,
+    pub version: bool,
+    pub help: bool,
+}
+
+impl Arguments {
+    pub fn may_hand_off(&self) -> bool {
+        !self.new_window && !self.files.is_empty() && self.options.is_empty() && self.control_file.is_none() && !self.create_images && !self.two_paged
+    }
+
+    pub fn parse(args: impl IntoIterator<Item = String>) -> Self {
+        let mut parsed = Self::default();
+        let mut args = args.into_iter();
+        while let Some(a) = args.next() {
+            match a.as_str() {
+                "--version" => {
+                    parsed.version = true;
+                    break;
+                }
+                "-h" | "--help" => {
+                    parsed.help = true;
+                    break;
+                }
+                "--control" => parsed.control_file = args.next(),
+                "--create-images" => parsed.create_images = true,
+                "--new-window" => parsed.new_window = true,
+                "--two-paged" => parsed.two_paged = true,
+                flag if flag.starts_with("--two-paged=") => {
+                    // It has no value: do not consume the following filename on malformed use.
+                    log::warn!("{flag}: use --two-paged without a value");
+                }
+                flag if flag.starts_with("--") => {
+                    let value = args.next().unwrap_or_default();
+                    parsed.options.push((flag.trim_start_matches("--").to_string(), value));
+                }
+                _ => parsed.files.push(super::path_from_arg(a)),
+            }
+        }
+        parsed
+    }
+}
+
+pub(super) fn open_files(app: &mut PdfCraftApp, files: &[String], two_paged: bool) {
+    for path in files {
+        if two_paged {
+            // The per-file override wins over initial view without changing saved defaults.
+            app.open_path_with_display(path, pdfcraft_ui_egui::canvas::PageLayout::TwoUp, false);
+        } else {
+            app.open_path(path);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn parse(args: &[&str]) -> Arguments {
+        Arguments::parse(args.iter().map(|s| s.to_string()))
+    }
+
+    #[test]
+    fn standalone_flag_keeps_files_in_either_position() {
+        for args in
+            [["--two-paged", "first.pdf", "second.pdf"], ["first.pdf", "--two-paged", "second.pdf"], ["first.pdf", "second.pdf", "--two-paged"]]
+        {
+            let parsed = parse(&args);
+            assert!(parsed.two_paged);
+            assert_eq!(parsed.files, ["first.pdf", "second.pdf"]);
+            assert!(parsed.options.is_empty());
+            assert!(!parsed.may_hand_off());
+        }
+        let empty = parse(&["--two-paged"]);
+        assert!(empty.two_paged && empty.files.is_empty());
+        let normal = parse(&["first.pdf", "second.pdf"]);
+        assert!(!normal.two_paged);
+        assert!(normal.may_hand_off());
+        for args in [
+            &["--new-window", "first.pdf"][..],
+            &["--layout", "two-page", "first.pdf"],
+            &["--control", "control.json", "first.pdf"],
+            &["--create-images", "first.png"],
+        ] {
+            assert!(!parse(args).may_hand_off());
+        }
+    }
+
+    #[test]
+    fn existing_layout_options_are_preserved_in_either_order() {
+        for args in [["--two-paged", "--layout", "single", "file.pdf"], ["--layout", "single", "--two-paged", "file.pdf"]] {
+            let parsed = parse(&args);
+            assert!(parsed.two_paged);
+            assert_eq!(parsed.files, ["file.pdf"]);
+            assert_eq!(parsed.options, [("layout".into(), "single".into())]);
+        }
+        let parsed = parse(&["--two-paged", "--default-layout", "two-up", "file.pdf"]);
+        assert_eq!(parsed.options, [("default-layout".into(), "two-up".into())]);
+    }
+
+    #[test]
+    fn newer_options_and_version_are_preserved() {
+        let parsed = parse(&["--two-paged", "--new-window", "--grid-zoom", "150", "--default-mode", "read", "file:///tmp/a%20b.pdf"]);
+        assert!(parsed.two_paged && parsed.new_window);
+        assert_eq!(parsed.files, ["/tmp/a b.pdf"]);
+        assert_eq!(parsed.options, [("grid-zoom".into(), "150".into()), ("default-mode".into(), "read".into())]);
+        assert!(!parsed.may_hand_off());
+        let version = parse(&["--two-paged", "--version", "ignored.pdf"]);
+        assert!(version.version && version.files.is_empty());
+    }
+
+    #[test]
+    fn help_keeps_the_headless_early_exit() {
+        for flag in ["-h", "--help"] {
+            let args = parse(&["--two-paged", flag, "ignored.pdf"]);
+            assert!(args.help && args.files.is_empty());
+        }
+    }
+
+    #[test]
+    fn malformed_boolean_does_not_eat_a_file_or_option() {
+        let args = parse(&["--two-paged=false", "first.pdf", "--layout", "single", "second.pdf"]);
+        assert!(!args.two_paged);
+        assert_eq!(args.files, ["first.pdf", "second.pdf"]);
+        assert_eq!(args.options, [("layout".into(), "single".into())]);
+    }
+
+    #[test]
+    fn startup_override_is_per_file_and_does_not_persist() {
+        use std::io::Write as _;
+        let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+        let path = std::env::temp_dir().join(format!("pdfcraft-two-paged-{}-{nonce}.pdf", std::process::id()));
+        let mut file = std::fs::OpenOptions::new().create_new(true).write(true).open(&path).unwrap();
+        file.write_all(include_bytes!("../../../crates/ui-egui/tests/data/form.pdf")).unwrap();
+        drop(file);
+        let second_path = path.with_extension("second.pdf");
+        std::fs::copy(&path, &second_path).unwrap();
+        let text = path.to_str().unwrap();
+        let second = second_path.to_str().unwrap();
+        for enabled in [false, true] {
+            let mut app = PdfCraftApp::new();
+            app.set_option("default-layout", "single").unwrap();
+            app.open_bytes("restored.pdf", None, include_bytes!("../../../crates/ui-egui/tests/data/form.pdf").to_vec()).unwrap();
+            let restored = app.views[0].id;
+            open_files(&mut app, &[text.into(), second.into()], enabled);
+            assert_eq!(app.views.len(), 3);
+            assert_eq!(app.views[0].id, restored);
+            assert_eq!(app.views[0].layout, pdfcraft_ui_egui::canvas::PageLayout::Single);
+            for view in app.views.iter().skip(1) {
+                assert_eq!(
+                    view.layout,
+                    if enabled { pdfcraft_ui_egui::canvas::PageLayout::TwoUp } else { pdfcraft_ui_egui::canvas::PageLayout::Single }
+                );
+                assert!(!view.continuous());
+            }
+            let persisted: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+            assert_eq!(persisted["default_layout"], "single");
+            assert!(persisted.get("two_paged").is_none());
+            // Existing --layout applies after the flag to the active document only.
+            if enabled {
+                app.set_launch_layout("continuous").unwrap();
+            } else {
+                app.set_option("layout", "continuous").unwrap();
+            }
+            assert_eq!(app.views[2].layout, pdfcraft_ui_egui::canvas::PageLayout::Single);
+            assert!(app.views[2].continuous());
+            app.set_option("default-layout", "two-up").unwrap();
+            assert_eq!(app.view_defaults.layout, pdfcraft_ui_egui::canvas::PageLayout::TwoUp);
+            assert!(app.view_defaults.continuous);
+            open_files(&mut app, &[], enabled);
+            assert_eq!(app.views.len(), 3);
+        }
+        std::fs::remove_file(path).unwrap();
+        std::fs::remove_file(second_path).unwrap();
+    }
+
+    #[test]
+    fn explicit_launch_layout_preserves_argument_order_and_active_file() {
+        use pdfcraft_ui_egui::canvas::PageLayout;
+        let path = std::env::temp_dir().join(format!("pdfcraft-explicit-layout-{}.pdf", std::process::id()));
+        std::fs::write(&path, include_bytes!("../../../crates/ui-egui/tests/data/form.pdf")).unwrap();
+        let second_path = path.with_extension("second.pdf");
+        std::fs::copy(&path, &second_path).unwrap();
+        let names = [path.to_str().unwrap(), second_path.to_str().unwrap()];
+        for prefix in [["--two-paged", "--layout", "single"], ["--layout", "single", "--two-paged"]] {
+            for count in [1, 2] {
+                let args = Arguments::parse(prefix.into_iter().chain(names.iter().take(count).copied()).map(str::to_owned));
+                let mut app = PdfCraftApp::new();
+                app.set_option("default-layout", "continuous").unwrap();
+                app.open_bytes("restored.pdf", None, include_bytes!("../../../crates/ui-egui/tests/data/form.pdf").to_vec()).unwrap();
+                open_files(&mut app, &args.files, args.two_paged);
+                for (key, value) in args.options {
+                    assert_eq!(key, "layout");
+                    app.set_launch_layout(&value).unwrap();
+                }
+                assert_eq!(app.active, Some(count));
+                assert!(app.views[0].continuous());
+                for view in app.views.iter().skip(1).take(count - 1) {
+                    assert_eq!(view.layout, PageLayout::TwoUp);
+                }
+                assert_eq!(app.views[count].layout, PageLayout::Single);
+                assert!(!app.views[count].continuous());
+                assert!(app.view_defaults.continuous);
+            }
+        }
+        std::fs::remove_file(path).unwrap();
+        std::fs::remove_file(second_path).unwrap();
+    }
+}
+
+#[cfg(test)]
+mod repeated_file_tests {
+    use super::*;
+
+    #[test]
+    fn a_repeated_file_reuses_its_tab_and_receives_the_launch_override() {
+        use pdfcraft_ui_egui::canvas::PageLayout;
+        let path = std::env::temp_dir().join(format!("pdfcraft-repeated-startup-{}.pdf", std::process::id()));
+        std::fs::write(&path, include_bytes!("../../../crates/ui-egui/tests/data/form.pdf")).unwrap();
+        let name = path.to_str().unwrap().to_string();
+        let mut app = PdfCraftApp::new();
+        app.set_option("default-layout", "continuous").unwrap();
+        app.open_path(&name);
+        let original = app.views[0].id;
+        open_files(&mut app, &[name.clone(), name], true);
+        assert_eq!(app.views.len(), 1);
+        assert_eq!(app.views[0].id, original);
+        assert_eq!(app.views[0].layout, PageLayout::TwoUp);
+        assert!(!app.views[0].continuous());
+        app.set_launch_layout("single").unwrap();
+        assert_eq!(app.views[0].layout, PageLayout::Single);
+        assert!(app.view_defaults.continuous);
+        std::fs::remove_file(path).unwrap();
+    }
+}
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 176946c175..92fd2775c9 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -21,6 +21,9 @@ them with the image's current orientation. Full turns retain its appearance, rec
 and flips. Angles that are not multiples of 90 are refused without changing the document or
 its undo/redo history.
 
+`page_add_text`, `content_update` and `text_edit` take per-line `aligns`. An `"inherit"` entry
+follows the box-level `align`; legacy `null` entries remain accepted with the same meaning.
+
 `Content` is `Json(Value)` or `Png { data, width, height }`. Errors are `UnknownTool`, `InvalidArgs` (the call didn't match the schema) or `Failed` (a readable message for the agent).
 
 ## Conventions
@@ -199,6 +202,19 @@ undoable and survive saving/reopening. `image_hit` shares the UI's curve and hol
 The bounds, limits and font requirements are in [existing-text editing](../../docs/editing-existing-text.md)
 and [image editing](../../docs/editing-images.md).
 
+### Superscript and subscript normalization
+
+`text_script` changes characters to their Unicode superscript or subscript forms; it does not
+change the font size or baseline. For characters that have such forms, uniformly plain text
+toggles to the requested script, and uniformly scripted text toggles back to plain text.
+Characters without a matching form stay unchanged and do not determine the selection's state.
+
+A selection mixing plain and target-script characters normalizes to the requested script.
+For example, subscript changes `H₂2` to `H₂₂`, then to `H22` on the next call; superscript
+changes `Q²2` to `Q²²`, then to `Q22`. A second toggle does not reconstruct the original
+mixture. Each call is one undoable text edit: `edit_undo` restores the exact prior text,
+including its original mixture. Save/reopen preserves the resulting normalized characters.
+
 ## Opening local GoToR links
 
 `link_open {doc, page, index, password?}` follows a local PDF link using `link_list`
diff --git a/crates/automation/src/content.rs b/crates/automation/src/content.rs
index 7518072d1c..6b25c31f61 100644
--- a/crates/automation/src/content.rs
+++ b/crates/automation/src/content.rs
@@ -83,10 +83,10 @@ pub(crate) fn parse_align(al: &str) -> Result<TextAlign> {
 /// Most entries `aligns` takes: one per paragraph, and no text has this many.
 const MAX_ALIGNS: usize = 4096;
 
-/// `aligns`: each paragraph's (line's) own alignment, or null where it follows `align`.
+/// `aligns`: each paragraph's (line's) own alignment, or inherit/null where it follows `align`.
 pub(crate) fn opt_aligns(a: &Args) -> Result<Option<Vec<Option<TextAlign>>>> {
     let Some(v) = a.get("aligns") else { return Ok(None) };
-    let items = v.as_array().ok_or_else(|| bad("aligns must be an array of left, center, right, justify or null"))?;
+    let items = v.as_array().ok_or_else(|| bad("aligns must be an array of left, center, right, justify, inherit or null"))?;
     if items.len() > MAX_ALIGNS {
         return Err(bad(format!("aligns takes at most {MAX_ALIGNS} entries")));
     }
@@ -94,8 +94,9 @@ pub(crate) fn opt_aligns(a: &Args) -> Result<Option<Vec<Option<TextAlign>>>> {
         .iter()
         .map(|v| match v {
             Value::Null => Ok(None),
+            Value::String(s) if s == "inherit" => Ok(None),
             Value::String(s) => parse_align(s).map(Some),
-            _ => Err(bad("each entry of aligns is left, center, right, justify or null")),
+            _ => Err(bad("each entry of aligns is left, center, right, justify, inherit or null")),
         })
         .collect::<Result<Vec<_>>>()
         .map(Some)
diff --git a/crates/automation/src/dispatch.rs b/crates/automation/src/dispatch.rs
index 0057704e72..49d4e6fd4d 100644
--- a/crates/automation/src/dispatch.rs
+++ b/crates/automation/src/dispatch.rs
@@ -12,6 +12,35 @@ pub enum Content {
     Png { data: Vec<u8>, width: u32, height: u32 },
 }
 
+/// `image_edit` `transform`: a matrix `[a b c d e f]` acting on top-left-origin points (a point
+/// moves to `(a·x + c·y + e, b·x + d·y + f)`) → the same motion in PDF user space, which is
+/// what `ImageEdit::Transform` applies after the image's placement. Both spaces are related by
+/// an affine map, so three corners of the crop box pin the result down.
+fn view_transform_to_user(info: &pdfcraft_render::PageInfo, m: [f64; 6]) -> Result<[f64; 6]> {
+    let [a, b, c, d, e, f] = m;
+    let det = a * d - b * c;
+    if !m.iter().all(|v| v.is_finite()) || !det.is_finite() || det.abs() < 1e-9 {
+        return Err(ToolError::InvalidArgs("transform needs a finite matrix that keeps an area (a·d − b·c must not be 0)".into()));
+    }
+    let moved = |x: f32, y: f32| {
+        let [vx, vy] = info.user_to_view(x, y).map(f64::from);
+        info.view_to_user((a * vx + c * vy + e) as f32, (b * vx + d * vy + f) as f32).map(f64::from)
+    };
+    let [x0, y0, x1, y1] = info.crop;
+    let (w, h) = (f64::from(x1 - x0), f64::from(y1 - y0));
+    if w.abs() < 1e-3 || h.abs() < 1e-3 {
+        return Err(ToolError::InvalidArgs("the page has no area to transform in".into()));
+    }
+    let (o, px, py) = (moved(x0, y0), moved(x1, y0), moved(x0, y1));
+    let (ua, ub, uc, ud) = ((px[0] - o[0]) / w, (px[1] - o[1]) / w, (py[0] - o[0]) / h, (py[1] - o[1]) / h);
+    let (x0, y0) = (f64::from(x0), f64::from(y0));
+    let user = [ua, ub, uc, ud, o[0] - ua * x0 - uc * y0, o[1] - ub * x0 - ud * y0];
+    if !user.iter().all(|v| v.is_finite()) {
+        return Err(ToolError::InvalidArgs("the transform moves the image too far".into()));
+    }
+    Ok(user)
+}
+
 impl Automation {
     /// Run the tool `name` with JSON `args` (an object; `null` means no arguments).
     pub fn call(&mut self, name: &str, args: &Value) -> Result<Vec<Content>> {
@@ -357,7 +386,7 @@ impl Automation {
                             let (u, v) = (info.user_to_view(rect[0] as f32, rect[1] as f32), info.user_to_view(rect[2] as f32, rect[3] as f32));
                             [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))]
                         });
-                        json!({ "visible_rect": visible, "image": i + 1, "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))], "pixels": [im.width, im.height], "name": im.name, "kind": if im.is_form { "form" } else { "image" } })
+                        json!({ "visible_rect": visible, "has_editor_crop": im.has_editor_crop(), "image": i + 1, "rect": [r(u[0].min(v[0])), r(u[1].min(v[1])), r(u[0].max(v[0])), r(u[1].max(v[1]))], "pixels": [im.width, im.height], "name": im.name, "kind": if im.is_form { "form" } else { "image" } })
                     })
                     .collect();
                 json!({ "page": page + 1, "count": list.len(), "images": list })
@@ -395,6 +424,16 @@ impl Automation {
                             let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
                             ImageEdit::Move([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
                         }
+                        "transform" => {
+                            let m: Vec<f64> = a
+                                .get("matrix")
+                                .and_then(Value::as_array)
+                                .and_then(|x| x.iter().map(Value::as_f64).collect())
+                                .ok_or_else(|| ToolError::InvalidArgs("transform needs matrix: 6 numbers [a, b, c, d, e, f]".into()))?;
+                            let m = <[f64; 6]>::try_from(m)
+                                .map_err(|_| ToolError::InvalidArgs("transform needs matrix: 6 numbers [a, b, c, d, e, f]".into()))?;
+                            ImageEdit::Transform(view_transform_to_user(&self.doc(&a)?.info.pages[page], m)?)
+                        }
                         "rotate_by" => ImageEdit::RotateBy(
                             a.get("degrees")
                                 .and_then(Value::as_f64)
@@ -410,9 +449,18 @@ impl Automation {
                             let (u0, u1) = (info.view_to_user(r[0] as f32, r[1] as f32), info.view_to_user(r[2] as f32, r[3] as f32));
                             ImageEdit::Crop([u0[0].min(u1[0]) as f64, u0[1].min(u1[1]) as f64, u0[0].max(u1[0]) as f64, u0[1].max(u1[1]) as f64])
                         }
-                        "flip_horizontal" => ImageEdit::Flip { horizontal: true },
-                        "flip_vertical" => ImageEdit::Flip { horizontal: false },
+                        action @ ("flip_horizontal" | "flip_vertical") => {
+                            let horizontal = action == "flip_horizontal";
+                            let info = self.doc(&a)?.info.pages.get(page).ok_or_else(|| ToolError::InvalidArgs("the page does not exist".into()))?;
+                            // The tool names displayed axes; the engine names PDF user-space axes.
+                            ImageEdit::Flip { horizontal: horizontal ^ (info.rotation % 180 == 90) }
+                        }
                         "delete" => ImageEdit::Delete,
+                        "bring_to_front" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringToFront),
+                        "send_to_back" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::SendToBack),
+                        "bring_forward" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringForward),
+                        "send_backward" => ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::SendBackward),
+                        "remove_crop" => ImageEdit::RemoveCrop,
                         "replace" => {
                             let path = self.resolve(a.str("path")?, false)?;
                             let bytes = read_input(&path)?;
@@ -624,6 +672,7 @@ impl Automation {
                 }
                 out
             }
+            "text_script" => self.text_script(&a)?,
             "doc_audit_space" => {
                 let rows: Vec<Value> = self
                     .doc(&a)?
@@ -815,4 +864,52 @@ impl Automation {
         };
         Ok(vec![Content::Json(out)])
     }
+
+    /// `text_script`: Format text ▸ Superscript or Subscript on a paragraph, or on a byte range
+    /// of its editor text, written as `text_edit` writes the paragraph.
+    fn text_script(&mut self, a: &Args) -> Result<Value> {
+        use pdfcraft_engine::text_script::{Script, toggle};
+        let name = a.str("script")?;
+        let script = match name {
+            "superscript" => Script::Super,
+            "subscript" => Script::Sub,
+            other => return Err(ToolError::InvalidArgs(format!("unknown script {other:?} (superscript, subscript)"))),
+        };
+        let page = self.page(a)?;
+        let k = a.int("paragraph")?;
+        let text = {
+            let doc = self.doc(a)?;
+            let blocks = doc.text_blocks(page);
+            let index = self.paragraph_index(doc.id, page, k, &blocks)?;
+            blocks.get(index).map(|b| b.editor_text.clone()).ok_or_else(|| ToolError::InvalidArgs(format!("paragraph {k} is out of range")))?
+        };
+        let range = match a.opt_ints("range")? {
+            None => None,
+            Some(r) => {
+                let bounds = match r.as_slice() {
+                    [start, end] => usize::try_from(*start).ok().zip(usize::try_from(*end).ok()),
+                    _ => None,
+                };
+                let range = bounds
+                    .map(|(start, end)| start..end)
+                    .filter(|r| r.start < r.end && r.end <= text.len() && text.is_char_boundary(r.start) && text.is_char_boundary(r.end));
+                let Some(range) = range else {
+                    return Err(ToolError::InvalidArgs(format!(
+                        "range must be [start, end]: UTF-8 byte offsets of the paragraph's editor_text (from text_paragraphs) with start < end <= {}, on character boundaries",
+                        text.len()
+                    )));
+                };
+                Some(range)
+            }
+        };
+        let (toggled, _) = toggle(&text, range.as_ref(), script)
+            .ok_or_else(|| ToolError::InvalidArgs(format!("nothing to change: no character of the text has a {name} form")))?;
+        let args = json!({ "doc": a.get("doc"), "page": a.get("page"), "paragraph": k, "text": toggled });
+        let mut out = match self.call("text_edit", &args)?.into_iter().next() {
+            Some(Content::Json(out)) => out,
+            _ => json!({}),
+        };
+        out["script"] = json!(name);
+        Ok(out)
+    }
 }
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index f25e268258..f23cb6a7ec 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -175,7 +175,7 @@ pub fn tools() -> Vec<ToolDef> {
             }), &["doc", "page"])),
         t("object_list", "List editable objects", "List existing paragraphs, Image/Form artwork and added content once, with source kind/index references, displayed rectangles and document generation. Indexes change when content changes; use generation in object_move to reject stale references.")
             .ro().with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1}}), &["doc","page"])),
-        t("object_move", "Move objects together", "Atomically translate 1–1000 mixed references from object_list by [dx, dy] in displayed points (right/down). Preserves glyph codes, fonts, image data and relative spacing; success is one undo step. Clipping and vertical text are refused. A bad/stale reference refuses the entire move.")
+        t("object_move", "Move objects together", "Atomically translate 1–1000 mixed references from object_list by [dx, dy] in displayed points (right/down). Preserves glyph codes, fonts, image data and relative spacing; success is one undo step. Text used as a clipping path and vertical text are refused. A bad/stale reference refuses the entire move.")
             .with(schema(json!({"doc":doc(),"page":{"type":"integer","minimum":1},
                 "objects":{"type":"array","minItems":1,"maxItems":1000,"uniqueItems":true,"items":{
                     "type":"object","properties":{"kind":{"type":"string","enum":["added","text","image"]},"index":{"type":"integer","minimum":1}},"required":["kind","index"],"additionalProperties":false}},
@@ -637,7 +637,7 @@ pub fn tools() -> Vec<ToolDef> {
                 "font": { "type": "string", "enum": ["helvetica", "times", "courier"] }, "size": { "type": "number", "minimum": 1, "maximum": 500 },
                 "bold": { "type": "boolean" }, "italic": { "type": "boolean" }, "color": { "type": "string" },
                 "align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
-                "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
+                "aligns": { "type": "array", "maxItems": 4096, "items": { "type": "string", "enum": ["left", "center", "right", "justify", "inherit"] }, "description": "Each paragraph's (line's) own alignment, by index; inherit (or legacy null) follows align." },
                 "char_spacing": { "type": "number", "minimum": -500, "maximum": 500, "description": "Points after each character." },
             }),
             &["doc", "page", "text"],
@@ -660,7 +660,7 @@ pub fn tools() -> Vec<ToolDef> {
                     "font": { "type": "string", "enum": ["helvetica", "times", "courier"] }, "size": { "type": "number", "minimum": 1, "maximum": 500 },
                     "bold": { "type": "boolean" }, "italic": { "type": "boolean" }, "color": { "type": "string" },
                     "align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
-                    "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
+                    "aligns": { "type": "array", "maxItems": 4096, "items": { "type": "string", "enum": ["left", "center", "right", "justify", "inherit"] }, "description": "Each paragraph's (line's) own alignment, by index; inherit (or legacy null) follows align." },
                     "char_spacing": { "type": "number", "minimum": -500, "maximum": 500, "description": "Points after each character." },
                     "rotate": { "type": "integer" }, "flip_h": { "type": "boolean" }, "flip_v": { "type": "boolean" },
                     "crop": { "type": "array", "items": { "type": "number", "minimum": 0, "maximum": 0.95 }, "minItems": 4, "maxItems": 4, "description": "Fractions trimmed: left, bottom, right, top. Left and right together, and bottom and top together, trim at most 0.95." },
@@ -1378,17 +1378,18 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("edit.edit_text")
             .with(schema(json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 } }), &["doc", "page"])),
-        t("image_edit", "Edit an image", "Change one of a page's images (number from page_images): action move (rect: new full placement box in top-left-origin points, based on page_images.rect), crop (rect: the part to keep, top-left-origin points; the pixels stay in place and page_images.visible_rect shows the result; a later move carries the crop along), rotate (quarters clockwise, default 1), rotate_by (degrees: any angle clockwise about the visible centre; the box in page_images then becomes the turned image's bounding box), flip_horizontal, flip_vertical, replace (path: an image file, drawn in the same place) or delete. Undoable. The selected image crop transforms with its pixels, isolating shared path scopes while retaining neighboring painting. Text-outline clips return a clear error. Rotation/flip use the visible centre. Form artwork supports move/resize/rotate/flip/delete as a group; replace and image_save only support raster images.")
+        t("image_edit", "Edit an image", "Change one of a page's images (number from page_images): action move (rect: new full placement box in top-left-origin points, based on page_images.rect), crop (rect: the part to keep, top-left-origin points; the pixels stay in place and page_images.visible_rect shows the result; a later move carries the crop along), remove_crop (remove a crop created by PdfCraft while preserving clipping paths from the original document), rotate (quarters clockwise, default 1), rotate_by (degrees: any angle clockwise about the visible centre; the box in page_images then becomes the turned image's bounding box), transform (matrix: 6 numbers [a, b, c, d, e, f] in top-left-origin points, applied after the current placement so a point (x, y) of the image moves to (a·x + c·y + e, b·x + d·y + f); finite, with a·d − b·c not 0; the box in page_images becomes the transformed image's bounding box), flip_horizontal (reflect left/right on the displayed page), flip_vertical (reflect top/bottom on the displayed page; both flip actions follow the page rotation), replace (path: an image file, drawn in the same place), delete, or arrange: bring_to_front, send_to_back, bring_forward, send_backward (reorder stacking order among content on the page; errors when the image is already at the requested limit; arranging an added image converts it into an ordinary page image). Undoable. The selected image crop transforms with its pixels, isolating shared path scopes while retaining neighboring painting. Text-outline clips return a clear error. Rotation/flip use the visible centre. Form artwork supports move/resize/rotate/flip/delete as a group; replace and image_save only support raster images.")
             .cmd("edit.edit_text")
             .with(schema(
                 json!({
                     "doc": doc(),
                     "page": { "type": "integer", "minimum": 1 },
                     "image": { "type": "integer", "minimum": 1 },
-                    "action": { "type": "string", "enum": ["move", "crop", "rotate", "rotate_by", "flip_horizontal", "flip_vertical", "replace", "delete"] },
+                    "action": { "type": "string", "enum": ["move", "crop", "rotate", "rotate_by", "transform", "flip_horizontal", "flip_vertical", "replace", "delete", "bring_to_front", "send_to_back", "bring_forward", "send_backward", "remove_crop"] },
                     "rect": { "type": "array", "items": { "type": "number" }, "minItems": 4, "maxItems": 4 },
                     "quarters": { "type": "integer" },
                     "degrees": { "type": "number" },
+                    "matrix": { "type": "array", "items": { "type": "number" }, "minItems": 6, "maxItems": 6 },
                     "path": { "type": "string" },
                 }),
                 &["doc", "page", "image", "action"],
@@ -1428,7 +1429,7 @@ pub fn tools() -> Vec<ToolDef> {
                     "size": { "type": "number", "exclusiveMinimum": 0 },
                     "color": { "type": "string", "description": "#rrggbb" },
                     "align": { "type": "string", "enum": ["left", "center", "right", "justify"] },
-                    "aligns": { "type": "array", "maxItems": 4096, "items": { "enum": ["left", "center", "right", "justify", null] }, "description": "Each paragraph's (line's) own alignment, by index; null follows align." },
+                    "aligns": { "type": "array", "maxItems": 4096, "items": { "type": "string", "enum": ["left", "center", "right", "justify", "inherit"] }, "description": "Each paragraph's (line's) own alignment, by index; inherit (or legacy null) follows align." },
                     "underline": { "type": "boolean" },
                     "line_spacing": { "type": "number", "description": "Multiple of the font size (1.2 is ordinary)." },
                     "dx": { "type": "number", "description": "Paragraph only: move right by this many points (negative: left)." },
@@ -1438,6 +1439,14 @@ pub fn tools() -> Vec<ToolDef> {
                     "scale": { "type": "number", "description": "Horizontal scale in percent." } }),
                 &["doc", "page"],
             )),
+        t("text_script", "Superscript or subscript", "Format text ▸ Superscript or Subscript on one paragraph (paragraph, from text_paragraphs), or on range [start, end): UTF-8 byte offsets of its editor_text. The characters take the Unicode superscript or subscript forms (2 → ², 2 → ₂; the font must have those glyphs, and extracted text contains them); text already in that script goes back to plain characters. Characters Unicode has no such form for (q, a space) stay unchanged and do not determine the selection's script state. Mixed plain and target-script characters normalize to that script, then to plain text on the next call (H₂2 → H₂₂ → H22); a second toggle does not reconstruct the original mixture. Use Undo to restore the exact prior text. The paragraph is then rewritten as text_edit rewrites it, with the same result fields. Refused when no character would change. Undoable. Mathematical minus U+2212 has its own script mapping; ASCII hyphen-minus stays unchanged.")
+            .cmd("edit.edit_text")
+            .with(schema(
+                json!({ "doc": doc(), "page": { "type": "integer", "minimum": 1 }, "paragraph": { "type": "integer", "minimum": 1 },
+                    "script": { "type": "string", "enum": ["superscript", "subscript"] },
+                    "range": { "type": "array", "items": { "type": "integer", "minimum": 0 }, "minItems": 2, "maxItems": 2, "description": "UTF-8 byte offsets [start, end) of the paragraph's editor_text; the whole paragraph when omitted." } }),
+                &["doc", "page", "paragraph", "script"],
+            )),
         t("doc_revisions", "List revisions", "List the document's saved revisions (oldest first): each incremental update is one. Returns revision number, where it ends in the file and its size, and which signatures sign exactly that revision.")
             .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("doc_open_revision", "Open a revision", "Open saved revision `revision` (1 = the oldest) of a document as a new, unsaved document, to see the file as it was then.")
diff --git a/crates/automation/tests/it/automation.rs b/crates/automation/tests/it/automation.rs
index d31f19b045..98a1887730 100644
--- a/crates/automation/tests/it/automation.rs
+++ b/crates/automation/tests/it/automation.rs
@@ -664,6 +664,44 @@ fn tool_table_is_well_formed() {
     }
 }
 
+fn assert_homogeneous_enums(schema: &Value, path: &str) {
+    fn json_kind(value: &Value) -> &'static str {
+        match value {
+            Value::Null => "null",
+            Value::Bool(_) => "boolean",
+            Value::Number(_) => "number",
+            Value::String(_) => "string",
+            Value::Array(_) => "array",
+            Value::Object(_) => "object",
+        }
+    }
+
+    if let Some(values) = schema.get("enum").and_then(Value::as_array) {
+        let first = values.first().map(json_kind);
+        assert!(values.iter().map(json_kind).all(|kind| Some(kind) == first), "mixed enum types at {path}: {values:?}");
+    }
+    match schema {
+        Value::Object(object) => {
+            for (key, child) in object {
+                assert_homogeneous_enums(child, &format!("{path}.{key}"));
+            }
+        }
+        Value::Array(array) => {
+            for (index, child) in array.iter().enumerate() {
+                assert_homogeneous_enums(child, &format!("{path}[{index}]"));
+            }
+        }
+        _ => {}
+    }
+}
+
+#[test]
+fn tool_schema_enums_have_one_json_type() {
+    for tool in tools() {
+        assert_homogeneous_enums(&tool.input_schema, tool.name);
+    }
+}
+
 #[test]
 fn explicit_font_and_disjoint_ranges_save_reopen_through_tools() {
     let dir = workdir("font-ranges");
@@ -3286,6 +3324,39 @@ fn editing_existing_text_through_tools() {
     assert_eq!(p["lines"].as_array().map(Vec::len), Some(2), "{p}");
 }
 
+/// Format text ▸ Superscript and Subscript without the GUI: a range, then back again over a space
+/// (which has no superscript form), each one undo step; refusals change nothing.
+#[test]
+fn superscript_and_subscript_through_tools() {
+    let dir = workdir("text-script");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let paragraph =
+        |a: &mut Automation| ok(a, "text_paragraphs", json!({ "doc": doc, "page": 2 }))["paragraphs"][0]["text"].as_str().unwrap().to_string();
+    let script = |script: &str, range: Value| json!({ "doc": doc, "page": 2, "paragraph": 1, "script": script, "range": range });
+    // "Page 2": the 2 is byte 5.
+    let r = ok(&mut a, "text_script", script("superscript", json!([5, 6])));
+    assert_eq!((r["script"].as_str(), r["paragraph"]["text"].as_str()), (Some("superscript"), Some("Page ²")), "{r}");
+    assert_eq!(page_text(&mut a, doc)[1], "Page ²");
+    // " ²": the space has no superscript form, and the range still toggles back.
+    ok(&mut a, "text_script", script("superscript", json!([4, 7])));
+    assert_eq!(paragraph(&mut a), "Page 2");
+    assert_eq!(ok(&mut a, "edit_undo", json!({ "doc": doc }))["undone"], "Edit text");
+    assert_eq!(paragraph(&mut a), "Page ²");
+    // Refused, changing nothing: a range that splits ², one past the end, an empty one, a range
+    // with nothing that has a subscript form, an unknown script.
+    for (name, range) in [
+        ("superscript", json!([5, 6])),
+        ("superscript", json!([0, 99])),
+        ("superscript", json!([3, 3])),
+        ("subscript", json!([4, 5])),
+        ("italic", json!([0, 1])),
+    ] {
+        assert!(matches!(a.call("text_script", &script(name, range.clone())), Err(ToolError::InvalidArgs(_))), "{name} {range}");
+    }
+    assert_eq!(paragraph(&mut a), "Page ²");
+}
+
 #[test]
 fn styled_cyrillic_fallback_is_batched_through_tools_and_reopen() {
     if pdfcraft_fonts::document_japanese_font().is_none() {
@@ -3453,6 +3524,13 @@ fn editing_page_images_through_tools() {
     assert_eq!(cropped["visible_rect"], json!([10.0, 10.0, 25.0, 30.0]));
     ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "rotate" }));
     ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "flip_horizontal" }));
+    // A single image is already in front and at the back; no-op arrange is refused without dirtying undo.
+    assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "bring_to_front" })).is_err());
+    assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "send_to_back" })).is_err());
+    assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "bring_forward" })).is_err());
+    assert!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "send_backward" })).is_err());
+    let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "remove_crop" }));
+    assert_eq!(r["undo"], "Remove crop");
     // Any angle: the box grows to the turned picture's bounds, and it undoes like a quarter turn.
     let before = ok(&mut a, "page_images", json!({ "doc": made, "page": 1 }))["images"][0]["rect"].clone();
     let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "rotate_by", "degrees": 30.5 }));
@@ -3472,6 +3550,80 @@ fn editing_page_images_through_tools() {
     assert!(matches!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "delete" })), Err(ToolError::InvalidArgs(_))));
 }
 
+#[test]
+fn arranging_page_images_through_tools() {
+    let dir = workdir("arrange-page-images");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_export_images", json!({ "doc": doc, "folder": "src", "dpi": 18, "pages": [1, 2] }));
+    let made = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["src/a_page_1.png"] }))["doc"].as_u64().unwrap();
+    ok(&mut a, "page_add_image", json!({ "doc": made, "page": 1, "path": "src/a_page_2.png", "rect": [50, 50, 100, 100] }));
+    assert_eq!(ok(&mut a, "page_images", json!({ "doc": made, "page": 1 }))["count"], 2);
+    let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "bring_to_front" }));
+    assert_eq!(r["undo"], "Bring to front");
+    let r = ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 2, "action": "send_to_back" }));
+    assert_eq!(r["undo"], "Send to back");
+    ok(&mut a, "doc_save", json!({ "doc": made, "path": "arranged.pdf" }));
+    let reopened = ok(&mut a, "doc_open", json!({ "path": "arranged.pdf" }))["doc"].as_u64().unwrap();
+    let after_reopen = ok(&mut a, "page_images", json!({ "doc": reopened, "page": 1 }));
+    assert_eq!(after_reopen["count"], 2);
+    assert_eq!(after_reopen["images"][0]["rect"], json!([0.0, 0.0, 50.0, 75.0]));
+    assert_eq!(after_reopen["images"][1]["rect"], json!([50.0, 50.0, 100.0, 100.0]));
+}
+
+/// The transform a rotated-image resize sends (`ImageEdit::Transform`) is reachable headlessly,
+/// in the same top-left-origin points as the other image tools, also on a turned page.
+#[test]
+fn transforming_page_images_through_tools() {
+    let dir = workdir("transform-page-images");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_export_images", json!({ "doc": doc, "folder": "src", "dpi": 18, "pages": [1] }));
+    let made = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["src/a_page_1.png"] }))["doc"].as_u64().unwrap();
+    let rect = |a: &mut Automation| ok(a, "page_images", json!({ "doc": made, "page": 1 }))["images"][0]["rect"].clone();
+    let transform =
+        |a: &mut Automation, m: Value| ok(a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "transform", "matrix": m }));
+    ok(&mut a, "image_edit", json!({ "doc": made, "page": 1, "image": 1, "action": "move", "rect": [5, 5, 25, 35] }));
+
+    // Right 10, down 20.
+    assert_eq!(transform(&mut a, json!([1, 0, 0, 1, 10, 20]))["undo"], "Transform image");
+    assert_eq!(rect(&mut a), json!([15.0, 25.0, 35.0, 55.0]));
+    // Twice the size about the top-left corner of the page.
+    transform(&mut a, json!([2, 0, 0, 2, 0, 0]));
+    assert_eq!(rect(&mut a), json!([30.0, 50.0, 70.0, 110.0]));
+    // A quarter turn, (x, y) → (200 − y, x): the box turns with it, and it undoes in one step.
+    transform(&mut a, json!([0, 1, -1, 0, 200, 0]));
+    assert_eq!(rect(&mut a), json!([90.0, 30.0, 150.0, 70.0]));
+    ok(&mut a, "edit_undo", json!({ "doc": made }));
+    assert_eq!(rect(&mut a), json!([30.0, 50.0, 70.0, 110.0]));
+
+    // On a turned page "right" is still right on screen.
+    ok(&mut a, "page_rotate", json!({ "doc": made, "pages": [1], "degrees": 90 }));
+    let numbers = |v: Value| [0, 1, 2, 3].map(|i| v[i].as_f64().unwrap());
+    let [x0, y0, x1, y1] = numbers(rect(&mut a));
+    transform(&mut a, json!([1, 0, 0, 1, 10, 0]));
+    let after = numbers(rect(&mut a));
+    for (got, want) in after.into_iter().zip([x0 + 10.0, y0, x1 + 10.0, y1]) {
+        assert!((got - want).abs() < 0.015, "{after:?} is not ({x0}, {y0}, {x1}, {y1}) moved right by 10");
+    }
+
+    // Flat, non-finite, short and missing matrices are refused before anything changes.
+    let before = rect(&mut a);
+    for bad in [
+        json!([1, 2, 2, 4, 0, 0]),
+        json!([0, 0, 0, 0, 0, 0]),
+        json!([1e300, 0, 0, 1e300, 0, 0]),
+        json!([1, 0, 0, 1]),
+        json!([1, 0, "invalid", 0, 1, 10, 0]),
+        json!([1, 0, null, 0, 1, 10, 0]),
+    ] {
+        let r = a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "transform", "matrix": bad }));
+        assert!(matches!(r, Err(ToolError::InvalidArgs(_))), "{bad}: {r:?}");
+    }
+    assert!(matches!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "transform" })), Err(ToolError::InvalidArgs(_))));
+    assert_eq!(rect(&mut a), before);
+}
+
 #[test]
 fn enhance_camera_image_through_tools() {
     let dir = workdir("enhance-camera");
@@ -9766,7 +9918,11 @@ fn added_text_lines_take_their_own_alignments() {
     let dir = workdir("paragraph-aligns");
     let mut a = auto(&dir);
     let id = ok(&mut a, "doc_create", json!({"from":"blank","width":600,"height":400}))["doc"].as_u64().unwrap();
-    ok(&mut a, "page_add_text", json!({"doc":id,"page":1,"text":"Left line\nRight line","at":[40,50],"width":500,"size":12,"aligns":[null,"right"]}));
+    ok(
+        &mut a,
+        "page_add_text",
+        json!({"doc":id,"page":1,"text":"Left line\nRight line\nInherited line","at":[40,50],"width":500,"size":12,"aligns":[null,"right","inherit"]}),
+    );
     let rect = |a: &mut Automation, text: &str| -> Vec<f64> {
         let lines = ok(a, "text_lines", json!({"doc":id,"page":1}));
         let line = lines["lines"].as_array().unwrap().iter().find(|l| l["text"] == text).cloned().unwrap();
@@ -9774,10 +9930,13 @@ fn added_text_lines_take_their_own_alignments() {
     };
     assert!((rect(&mut a, "Left line")[0] - 40.0).abs() < 1.0);
     assert!((rect(&mut a, "Right line")[2] - 540.0).abs() < 1.0, "{:?}", rect(&mut a, "Right line"));
+    assert!((rect(&mut a, "Inherited line")[0] - 40.0).abs() < 1.0);
     // The whole box centred: the right-aligned line goes with it.
     ok(&mut a, "content_update", json!({"doc":id,"page":1,"index":1,"align":"center"}));
     let right = rect(&mut a, "Right line");
     assert!(((right[0] + right[2]) / 2.0 - 290.0).abs() < 1.0, "{right:?}");
+    let inherited = rect(&mut a, "Inherited line");
+    assert!(((inherited[0] + inherited[2]) / 2.0 - 290.0).abs() < 1.0, "{inherited:?}");
     assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":["sideways"]})).is_err());
     assert!(a.call("content_update", &json!({"doc":id,"page":1,"index":1,"aligns":"right"})).is_err());
 }
@@ -10192,3 +10351,154 @@ fn simple_rule_scan_drawn(content: &[u8]) -> Vec<u8> {
     }
     write_full(&doc, &SaveOptions::default()).unwrap()
 }
+
+#[test]
+fn editor_crop_group_move_and_arrange_survive_added_item_deletion_through_tools() {
+    let dir = workdir("editor-crop-group-arrange");
+    let mut a = auto(&dir);
+    let source = ok(&mut a, "doc_open", json!({"path":"a.pdf"}))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_export_images", json!({"doc":source,"folder":"src","dpi":18,"pages":[1]}));
+    let doc = ok(&mut a, "doc_create", json!({"from":"images","paths":["src/a_page_1.png"]}))["doc"].as_u64().unwrap();
+    ok(&mut a, "image_edit", json!({"doc":doc,"page":1,"image":1,"action":"move","rect":[5,5,25,35]}));
+    ok(&mut a, "image_edit", json!({"doc":doc,"page":1,"image":1,"action":"crop","rect":[10,10,20,30]}));
+    ok(&mut a, "page_add_text", json!({"doc":doc,"page":1,"text":"Movable label","rect":[2,40,45,55],"size":6}));
+    let inventory = ok(&mut a, "object_list", json!({"doc":doc,"page":1}));
+    let objects: Vec<_> = inventory["objects"].as_array().unwrap().iter().map(|o| json!({"kind":o["kind"],"index":o["index"]})).collect();
+    assert_eq!(objects.len(), 2);
+    let moved = ok(&mut a, "object_move", json!({"doc":doc,"page":1,"objects":objects,"offset":[3,4]}));
+    assert_eq!(moved["moved"], 2);
+    let picture = ok(&mut a, "page_images", json!({"doc":doc,"page":1}))["images"][0].clone();
+    assert_eq!(picture["rect"], json!([8.0, 9.0, 28.0, 39.0]));
+    assert_eq!(picture["visible_rect"], json!([13.0, 14.0, 23.0, 34.0]));
+    assert!(page_text(&mut a, doc)[0].contains("Movable label"));
+    ok(&mut a, "edit_undo", json!({"doc":doc}));
+    assert_eq!(ok(&mut a, "page_images", json!({"doc":doc,"page":1}))["images"][0]["visible_rect"], json!([10.0, 10.0, 20.0, 30.0]));
+    ok(&mut a, "edit_redo", json!({"doc":doc}));
+    ok(&mut a, "doc_save", json!({"doc":doc,"path":"grouped.pdf"}));
+    let reopened = ok(&mut a, "doc_open", json!({"path":"grouped.pdf"}))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "page_images", json!({"doc":reopened,"page":1}))["images"][0]["visible_rect"], picture["visible_rect"]);
+    ok(&mut a, "image_edit", json!({"doc":reopened,"page":1,"image":1,"action":"bring_to_front"}));
+    assert_eq!(ok(&mut a, "content_list", json!({"doc":reopened}))["count"], 1);
+    ok(&mut a, "content_delete", json!({"doc":reopened,"page":1,"index":1}));
+    ok(&mut a, "doc_save", json!({"doc":reopened,"path":"independent.pdf"}));
+    let saved = ok(&mut a, "doc_open", json!({"path":"independent.pdf"}))["doc"].as_u64().unwrap();
+    let after = ok(&mut a, "page_images", json!({"doc":saved,"page":1}));
+    assert_eq!(after["count"], 1);
+    assert_eq!(after["images"][0]["rect"], picture["rect"]);
+    assert_eq!(after["images"][0]["visible_rect"], picture["visible_rect"]);
+    let rendered = a.call("page_render", &json!({"doc":saved,"page":1,"dpi":72})).unwrap();
+    assert!(rendered.iter().any(|c| matches!(c, Content::Png {data,width,height} if !data.is_empty() && *width > 0 && *height > 0)));
+}
+
+#[test]
+fn image_flip_tools_follow_displayed_axes_on_every_page_rotation() {
+    fn corners(a: &Automation, id: u64) -> [[f64; 2]; 4] {
+        let doc = a.session().get(pdfcraft_engine::DocId(id)).unwrap();
+        let [aa, b, c, d, e, f] = doc.page_images(0)[0].matrix;
+        [(0.0, 0.0), (1.0, 0.0), (0.0, 1.0), (1.0, 1.0)]
+            .map(|(x, y)| doc.info.pages[0].user_to_view((aa * x + c * y + e) as f32, (b * x + d * y + f) as f32).map(f64::from))
+    }
+    fn raster(a: &mut Automation, id: u64) -> (usize, usize, Vec<u8>) {
+        let rendered = a.call("page_render", &json!({"doc":id,"page":1,"dpi":72})).unwrap();
+        let Content::Png { data, .. } = &rendered[0] else { panic!("expected PNG") };
+        let mut reader = png::Decoder::new(std::io::Cursor::new(data)).read_info().unwrap();
+        let mut bytes = vec![0; reader.output_buffer_size().unwrap()];
+        let frame = reader.next_frame(&mut bytes).unwrap();
+        bytes.truncate(frame.buffer_size());
+        if frame.color_type == png::ColorType::Rgb {
+            bytes = bytes.as_chunks::<3>().0.iter().flat_map(|&[r, g, b]| [r, g, b, 255]).collect();
+        } else {
+            assert_eq!(frame.color_type, png::ColorType::Rgba);
+        }
+        (frame.width as usize, frame.height as usize, bytes)
+    }
+    let dir = workdir("displayed-image-flip");
+    let mut png_bytes = Vec::new();
+    {
+        let mut encoder = png::Encoder::new(&mut png_bytes, 8, 4);
+        encoder.set_color(png::ColorType::Rgb);
+        let colors = [[240, 20, 30], [20, 230, 40], [30, 40, 220], [220, 210, 20]];
+        let pixels: Vec<u8> = (0..4).flat_map(|y| (0..8).flat_map(move |x| colors[usize::from(x >= 4) + 2 * usize::from(y >= 2)])).collect();
+        encoder.write_header().unwrap().write_image_data(&pixels).unwrap();
+    }
+    std::fs::write(dir.join("quadrants.png"), png_bytes).unwrap();
+    let mut a = auto(&dir);
+    let mut failures = Vec::new();
+    for rotation in [0, 90, 180, 270] {
+        let doc = ok(&mut a, "doc_create", json!({"from":"images","paths":["quadrants.png"]}))["doc"].as_u64().unwrap();
+        if rotation != 0 {
+            ok(&mut a, "page_rotate", json!({"doc":doc,"pages":[1],"degrees":rotation}));
+        }
+        let before = corners(&a, doc);
+        let (width, height, pixels) = raster(&mut a, doc);
+        let xmin = before.iter().map(|p| p[0]).fold(f64::INFINITY, f64::min);
+        let xmax = before.iter().map(|p| p[0]).fold(f64::NEG_INFINITY, f64::max);
+        let ymin = before.iter().map(|p| p[1]).fold(f64::INFINITY, f64::min);
+        let ymax = before.iter().map(|p| p[1]).fold(f64::NEG_INFINITY, f64::max);
+        for (action, horizontal) in [("flip_horizontal", true), ("flip_vertical", false)] {
+            ok(&mut a, "image_edit", json!({"doc":doc,"page":1,"image":1,"action":action}));
+            let after = corners(&a, doc);
+            for (old, new) in before.into_iter().zip(after) {
+                let expected = if horizontal { [xmin + xmax - old[0], old[1]] } else { [old[0], ymin + ymax - old[1]] };
+                if new.into_iter().zip(expected).any(|(actual, want)| (actual - want).abs() > 0.001) {
+                    failures.push(format!("rotation {rotation} {action}: corner {old:?} became {new:?}, expected {expected:?}"));
+                    break;
+                }
+            }
+            let (new_width, new_height, actual_pixels) = raster(&mut a, doc);
+            assert_eq!((new_width, new_height), (width, height));
+            let mut expected_pixels = Vec::new();
+            for y in 0..height {
+                for x in 0..width {
+                    let source = if horizontal { (y * width + width - 1 - x) * 4 } else { ((height - 1 - y) * width + x) * 4 };
+                    expected_pixels.extend_from_slice(&pixels[source..source + 4]);
+                }
+            }
+            if actual_pixels.iter().zip(&expected_pixels).any(|(actual, want)| actual.abs_diff(*want) > 1) {
+                failures.push(format!("rotation {rotation} {action}: raster flipped the wrong displayed axis"));
+            }
+            assert_ne!(actual_pixels, pixels, "the asymmetric image makes both flip axes observable");
+            ok(&mut a, "edit_undo", json!({"doc":doc}));
+            assert_eq!(corners(&a, doc), before, "one undo restores the original placement");
+        }
+    }
+    assert!(failures.is_empty(), "{}", failures.join("\n"));
+}
+
+#[test]
+fn mixed_script_tools_normalize_but_undo_restores_the_exact_mixture() {
+    let dir = workdir("mixed-script-policy");
+    let mut a = auto(&dir);
+    for (script, mixed, uniform, plain) in [("superscript", "Q²2", "Q²²", "Q22"), ("subscript", "H₂2", "H₂₂", "H22")] {
+        let doc = ok(&mut a, "doc_open", json!({"path":"a.pdf"}))["doc"].as_u64().unwrap();
+        ok(&mut a, "text_edit", json!({"doc":doc,"page":1,"paragraph":1,"text":mixed,"size":14,"width":160}));
+        let paragraph =
+            |a: &mut Automation| ok(a, "text_paragraphs", json!({"doc":doc,"page":1}))["paragraphs"][0]["editor_text"].as_str().unwrap().to_owned();
+        assert_eq!(paragraph(&mut a), mixed);
+        let before = a.session().get(pdfcraft_engine::DocId(doc)).unwrap().bytes.clone();
+        let args = json!({"doc":doc,"page":1,"paragraph":1,"script":script});
+        let once = ok(&mut a, "text_script", args.clone());
+        assert_eq!(once["paragraph"]["text"], uniform);
+        assert_eq!(paragraph(&mut a), uniform);
+        ok(&mut a, "text_script", args);
+        assert_eq!(paragraph(&mut a), plain);
+        assert_ne!(plain, mixed, "normalization does not promise to recreate the original mixture");
+        ok(&mut a, "edit_undo", json!({"doc":doc}));
+        assert_eq!(paragraph(&mut a), uniform, "one Undo restores the preceding scripted text");
+        ok(&mut a, "edit_undo", json!({"doc":doc}));
+        assert_eq!(paragraph(&mut a), mixed, "Undo restores the exact initial Unicode mixture");
+        assert_eq!(
+            a.session().get(pdfcraft_engine::DocId(doc)).unwrap().bytes.as_ref(),
+            before.as_ref(),
+            "Undo also restores the exact prior document bytes"
+        );
+        ok(&mut a, "edit_redo", json!({"doc":doc}));
+        assert_eq!(paragraph(&mut a), uniform);
+        ok(&mut a, "edit_redo", json!({"doc":doc}));
+        assert_eq!(paragraph(&mut a), plain);
+        let path = format!("mixed-{script}.pdf");
+        ok(&mut a, "doc_save", json!({"doc":doc,"path":path}));
+        let reopened = ok(&mut a, "doc_open", json!({"path":path}))["doc"].as_u64().unwrap();
+        assert_eq!(page_text(&mut a, reopened)[0], plain);
+    }
+}
diff --git a/crates/cos/src/writer.rs b/crates/cos/src/writer.rs
index 627f716495..cd0137f452 100644
--- a/crates/cos/src/writer.rs
+++ b/crates/cos/src/writer.rs
@@ -245,7 +245,7 @@ pub fn write_incremental(doc: &Document, opts: &SaveOptions) -> Result<Vec<u8>,
     if let Some(p) = prev {
         trailer.set(b"Prev".to_vec(), Object::Int(p as i64));
     }
-    let size = doc.next_num().max(trailer.int(b"Size").unwrap_or(0) as u32);
+    let size = doc.next_num().max(trailer.int(b"Size").map_or(0, |n| n.clamp(0, i64::from(u32::MAX)) as u32));
     if as_stream {
         let rows = offsets.iter().map(|(n, (o, g, used))| (*n, if *used { Row::InFile(*o, *g) } else { Row::Free(*g) })).collect();
         write_xref_stream(&mut out, base, &mut trailer, rows, size);
diff --git a/crates/cos/tests/it/writer.rs b/crates/cos/tests/it/writer.rs
index 1b98664255..eb03523189 100644
--- a/crates/cos/tests/it/writer.rs
+++ b/crates/cos/tests/it/writer.rs
@@ -228,6 +228,16 @@ fn incremental_save_keeps_a_trailer_only_edit() {
     assert_qpdf_clean(&saved);
 }
 
+#[test]
+fn incremental_save_ignores_a_negative_trailer_size() {
+    let mut doc = Document::open(Arc::new(classic_table())).unwrap();
+    doc.trailer_mut().set(b"Size".to_vec(), Object::Int(-1));
+    let next = doc.add(Object::Int(5)).num + 1;
+    let saved = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let back = Document::open(Arc::new(saved)).unwrap();
+    assert_eq!(back.trailer().int(b"Size"), Some(i64::from(next)));
+}
+
 /// What one edit added and a later one unlinked (a deleted comment, a cleared redaction mark) is
 /// not written: the file never held it, and writing it would keep what was removed. Additions the
 /// update still refers to, from the trailer or a changed object and through other additions, are.
diff --git a/crates/create/src/extract.rs b/crates/create/src/extract.rs
index 264af5444b..d5103071e6 100644
--- a/crates/create/src/extract.rs
+++ b/crates/create/src/extract.rs
@@ -170,11 +170,16 @@ fn image(doc: &Document, s: &Stream, budget: &mut ImageBudget) -> Result<(&'stat
     }
     let key = if mask { None } else { colour_key(doc, s) };
     // Keep the existing JPEG and stencil-mask Decode handling separate from lossless colour images.
+    let endpoint = |value: Option<&Object>| value.map(|v| doc.resolve(v)).and_then(|v| v.as_f64()).filter(|v| v.is_finite());
     let inverted = (jpeg || mask)
         && s.dict
             .get(b"Decode")
             .map(|d| doc.resolve(d))
-            .and_then(|d| d.as_array().map(|a| a.first().and_then(Object::as_f64) > a.get(1).and_then(Object::as_f64)))
+            // Both ends have to be finite numbers, as for lossless images, or the default mapping stands.
+            .and_then(|d| {
+                let a = d.as_array()?;
+                Some(endpoint(a.first())? > endpoint(a.get(1))?)
+            })
             .unwrap_or(false);
     // In a PDF a CMYK JPEG's samples are ink amounts unless /Decode inverts them, while image
     // viewers read a CMYK JPEG file as inverted (Adobe's convention): as is, it would show as
@@ -575,7 +580,23 @@ fn gray_plane(doc: &Document, m: &Stream, w: usize, h: usize, budget: &mut Image
         return Some(px);
     }
     let img = image::GrayImage::from_raw(mw as u32, mh as u32, px)?;
-    Some(image::imageops::resize(&img, w as u32, h as u32, image::imageops::FilterType::Triangle).into_raw())
+    Some(scaled(&img, w as u32, h as u32).into_raw())
+}
+
+/// `img` scaled to `w` × `h`. Scaling goes down first, through a buffer of `img`'s width by `h` at
+/// 16 bytes a pixel, which a mask of other proportions than its image can make larger than any
+/// machine: 100,000 × 1 on an image of 1 × 100,000 asks for 160 GB, and that aborts the process.
+/// Such a mask is scaled across first, which holds no more pixels than one of the two has. Past a
+/// quarter over the larger of them, so that rounding leaves a mask of its image's shape as it was.
+pub(crate) fn scaled(img: &image::GrayImage, w: u32, h: u32) -> image::GrayImage {
+    use image::imageops::{FilterType, resize};
+    let (mw, mh) = (u64::from(img.width()), u64::from(img.height()));
+    let largest = (mw * mh).max(u64::from(w) * u64::from(h));
+    if (mw * u64::from(h)).saturating_mul(4) > largest.saturating_mul(5) {
+        resize(&resize(img, w, img.height(), FilterType::Triangle), w, h, FilterType::Triangle)
+    } else {
+        resize(img, w, h, FilterType::Triangle)
+    }
 }
 
 fn png(w: u32, h: u32, rgb: &[u8], alpha: Option<&[u8]>) -> Result<Vec<u8>, String> {
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index 7b4e8649fa..a7a5611ffc 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -2487,3 +2487,115 @@ fn an_export_may_hold_twice_a_large_file() {
     assert_eq!(crate::extract::export_bytes(fixed / 2 + 1), fixed + 2);
     assert_eq!(crate::extract::export_bytes(usize::MAX), usize::MAX);
 }
+
+/// `/Decode` says which way round a stencil mask is, and its numbers can be given by reference. Read
+/// as absent, they gave the wrong answer, so the file came out a negative of what the page draws.
+#[test]
+fn a_stencil_masks_decode_array_can_hold_references() {
+    use pdfcraft_cos::Document;
+    let export = |decode: &str| {
+        let pdf = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Resources << /XObject << /Im 4 0 R >> >> >> endobj\n\
+             4 0 obj << /Subtype /Image /ImageMask true /Width 8 /Height 1 /BitsPerComponent 1 /Decode {decode} /Filter /ASCIIHexDecode /Length 3 >> stream\nF0>\nendstream endobj\n\
+             5 0 obj 1 endobj\n6 0 obj 0 endobj\n7 0 obj 7 0 R endobj\n8 0 obj 9 0 R endobj\n9 0 obj 8 0 R endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF"
+        );
+        let doc = Document::open(std::sync::Arc::new(pdf.into_bytes())).unwrap();
+        let mut export = crate::extract::extract_images(&doc, &[0], 1);
+        assert_eq!(export.images.len(), 1, "{decode}: {:?}", export.skipped);
+        export.images.remove(0).data
+    };
+    let (inverted, identity) = (export("[1 0]"), export("[0 1]"));
+    assert_ne!(inverted, identity, "the two ways round differ");
+    for decode in ["[5 0 R 0]", "[1 6 0 R]", "[5 0 R 6 0 R]"] {
+        assert_eq!(export(decode), inverted, "{decode}");
+    }
+    for decode in ["[0 5 0 R]", "[6 0 R 1]", "[6 0 R 5 0 R]"] {
+        assert_eq!(export(decode), identity, "{decode}");
+    }
+    // A reference that only leads back to itself holds no number, and an end that is missing or isn't
+    // a number leaves the default mapping, whichever end it is.
+    for decode in ["[7 0 R 0]", "[1 7 0 R]", "[8 0 R 0]", "[1 8 0 R]", "[7 0 R 8 0 R]", "[1]", "[1 /Name]", "[/Name 0]"] {
+        assert_eq!(export(decode), identity, "{decode}");
+    }
+    // Equal ends aren't the two ways round either, and a number too long to hold reads as infinite.
+    assert_eq!(export("[1 1]"), identity);
+    assert_eq!(export(&format!("[{} 0]", "9".repeat(400))), identity);
+}
+
+/// A mask of other proportions than its image is scaled to it, however far apart they are: the
+/// first two shapes asked for 160 GB on the way, in a file of a kilobyte, and that aborted the
+/// process. The third would ask for 10 GB if it went across first, which is why the way round
+/// depends on the shapes. The value comes through, and masks of ordinary proportions, of the
+/// image's size and larger than it, are scaled as they always were.
+#[test]
+fn a_mask_of_other_proportions_than_its_image_is_scaled_without_the_memory_of_both() {
+    use pdfcraft_cos::{Dict, Document, Object, Stream};
+    let gray = |w: i64, h: i64, data: &[u8]| {
+        let mut d = Dict::new();
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(w));
+        d.set(b"Height".to_vec(), Object::Int(h));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d.set(b"ColorSpace".to_vec(), Object::name("DeviceGray"));
+        d.set(b"Filter".to_vec(), Object::name("FlateDecode"));
+        Stream::from_raw(d, pdfcraft_filters::encode_flate(data))
+    };
+    let shapes = [
+        (100_000usize, 1usize, 1usize, 100_000usize),
+        (100_000, 64, 64, 100_000),
+        (1, 100_000, 100_000, 1),
+        (64, 1, 1, 64),
+        (3, 2, 6, 4),
+        (3, 2, 3, 2),
+        (6, 4, 3, 2),
+    ];
+    for (mask_w, mask_h, w, h) in shapes {
+        let mut doc = Document::new_empty();
+        let mask = doc.add(Object::Stream(gray(mask_w as i64, mask_h as i64, &vec![0x80; mask_w * mask_h])));
+        let mut image = gray(w as i64, h as i64, &vec![0x40; w * h]);
+        image.dict.set(b"SMask".to_vec(), Object::Ref(mask));
+        let image = doc.add(Object::Stream(image));
+        let (name, png) = crate::image_file(&doc, image).unwrap_or_else(|e| panic!("{mask_w} × {mask_h} on {w} × {h}: {e}"));
+        assert_eq!(name, "png");
+        let mut reader = ::png::Decoder::new(std::io::Cursor::new(&png)).read_info().unwrap();
+        let mut rgba = vec![0; reader.output_buffer_size().unwrap()];
+        let info = reader.next_frame(&mut rgba).unwrap();
+        assert_eq!((info.width as usize, info.height as usize, info.color_type), (w, h, ::png::ColorType::Rgba));
+        assert!(rgba.as_chunks::<4>().0.iter().all(|p| p[3].abs_diff(0x80) <= 1), "{mask_w} × {mask_h} on {w} × {h}");
+    }
+}
+
+/// The long way round is for proportions far apart: up to a quarter over the larger image the
+/// buffer is no danger, and such a mask scales as it always did, to the byte. Noise, as a flat mask comes
+/// out the same either way.
+#[test]
+fn proportions_up_to_the_limit_scale_as_they_did() {
+    let noise = |w: u32, h: u32| {
+        let mut seed = 0x2545_F491_4F6C_DD1Du64;
+        let px = (0..w * h)
+            .map(|_| {
+                seed ^= seed << 13;
+                seed ^= seed >> 7;
+                seed ^= seed << 17;
+                seed as u8
+            })
+            .collect();
+        image::GrayImage::from_raw(w, h, px).unwrap()
+    };
+    // Each exactly a quarter over the larger: the source's size, then the target's.
+    for (mw, mh, w, h) in [(25, 16, 10, 20), (20, 5, 16, 25)] {
+        let mask = noise(mw, mh);
+        let direct = image::imageops::resize(&mask, w, h, image::imageops::FilterType::Triangle);
+        assert_eq!(crate::extract::scaled(&mask, w, h), direct, "{mw} × {mh} to {w} × {h}");
+    }
+    // A step past it goes the long way, which is how to tell.
+    let mask = noise(25, 15);
+    let direct = image::imageops::resize(&mask, 10, 20, image::imageops::FilterType::Triangle);
+    assert_ne!(crate::extract::scaled(&mask, 10, 20), direct);
+    // A mask of its image's size comes through as it is.
+    let mask = noise(20, 10);
+    assert_eq!(crate::extract::scaled(&mask, 20, 10), mask);
+}
diff --git a/crates/edit/Cargo.toml b/crates/edit/Cargo.toml
index 89d9387989..2cd33a275d 100644
--- a/crates/edit/Cargo.toml
+++ b/crates/edit/Cargo.toml
@@ -24,3 +24,5 @@ unicode-bidi = "0.3"
 
 [dev-dependencies]
 hayro-syntax = { workspace = true }
+pdfcraft-render = { workspace = true }
+proptest = { workspace = true }
diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index 71ae49941d..73aa116ff3 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -4,13 +4,28 @@
 //! or delete. Only the stream that draws it is rewritten, as a new object.
 
 use kurbo::{BezPath, Point, Shape};
-use pdfcraft_content::{Matrix, Op, Pieces, parse};
+use pdfcraft_content::{Matrix, Op, Pieces, parse, serialize_ops};
 use pdfcraft_cos::{Dict, Document, ObjRef, Object};
 use std::sync::Arc;
 
 use crate::EditError;
 use crate::text::content_streams;
 
+/// The identity of a soft mask (`/SMask`) in the PDF graphics state.
+#[derive(Clone, Debug)]
+pub(crate) struct MaskIdentity {
+    // Share the owning ExtGState instead of copying an arbitrarily large inline mask on q/Q.
+    // Its complete SMask value retains S, TR, BC and every other mask parameter, not just G.
+    definition: Arc<Object>,
+    ctm: Matrix,
+}
+
+impl PartialEq for MaskIdentity {
+    fn eq(&self, other: &Self) -> bool {
+        self.ctm == other.ctm && self.definition.as_dict().and_then(|d| d.get(b"SMask")) == other.definition.as_dict().and_then(|d| d.get(b"SMask"))
+    }
+}
+
 /// An image drawn on a page.
 #[derive(Clone, Debug, PartialEq)]
 pub struct PageImage {
@@ -33,7 +48,7 @@ pub struct PageImage {
     pub height: u32,
     /// The content stream its `Do` (its first token) is in, and the `Do`'s index among the
     /// operators of the page's streams joined ([`Pieces`]).
-    stream: usize,
+    pub stream: usize,
     op: usize,
     /// CTM before `Do`, excluding a Form's own Matrix.
     draw_matrix: [f64; 6],
@@ -41,6 +56,11 @@ pub struct PageImage {
 }
 
 impl PageImage {
+    /// Whether an active clip was written by PdfCraft's image crop tool.
+    pub fn has_editor_crop(&self) -> bool {
+        self.clips.iter().any(|clip| clip.app_crop)
+    }
+
     /// Whether a user-space point belongs to the placed artwork and every active clip.
     pub fn contains(&self, point: [f64; 2]) -> bool {
         if !point.iter().all(|v| v.is_finite()) {
@@ -72,6 +92,7 @@ impl PageImage {
 struct ClipPath {
     path: Arc<BezPath>,
     even_odd: bool,
+    app_crop: bool,
 }
 
 /// Image draws one page's inventory lists at most: a form drawn many times from other forms
@@ -115,17 +136,39 @@ struct ImageState {
     placement: Placement,
     stack: Vec<Placement>,
     path: BezPath,
+    subpath_start: Option<Point>,
     pending_clip: Option<bool>,
+    app_crop: bool,
 }
 
 impl ImageState {
     fn new(matrix: Matrix, clip: [f64; 4], clips: Vec<ClipPath>) -> Self {
-        Self { placement: Placement { matrix, clip, clips }, stack: Vec::new(), path: BezPath::new(), pending_clip: None }
+        Self {
+            placement: Placement { matrix, clip, clips },
+            stack: Vec::new(),
+            path: BezPath::new(),
+            subpath_start: None,
+            pending_clip: None,
+            app_crop: false,
+        }
     }
 
-    fn point(&self, x: f64, y: f64) -> Point {
+    fn current_point(&self) -> Option<Point> {
+        match self.path.elements().last() {
+            Some(kurbo::PathEl::MoveTo(p) | kurbo::PathEl::LineTo(p)) => Some(*p),
+            Some(kurbo::PathEl::QuadTo(_, p2) | kurbo::PathEl::CurveTo(_, _, p2)) => Some(*p2),
+            Some(kurbo::PathEl::ClosePath) => self.subpath_start,
+            None => None,
+        }
+    }
+
+    fn has_current_point(&self) -> bool {
+        self.current_point().is_some()
+    }
+
+    fn point(&self, x: f64, y: f64) -> Option<Point> {
         let (x, y) = self.placement.matrix.apply(x, y);
-        Point::new(x, y)
+        if x.is_finite() && y.is_finite() { Some(Point::new(x, y)) } else { None }
     }
 
     fn apply(&mut self, op: &Op) -> Result<(), EditError> {
@@ -146,12 +189,18 @@ impl ImageState {
             }
             b"cm" => {
                 if let Some(m) = op.nums::<6>() {
-                    self.placement.matrix = Matrix(m).then(&self.placement.matrix);
+                    let next_mat = Matrix(m).then(&self.placement.matrix);
+                    if next_mat.0.iter().all(|v| v.is_finite()) {
+                        self.placement.matrix = next_mat;
+                    }
                 }
             }
             b"m" => {
-                if let Some([x, y]) = op.nums::<2>() {
-                    self.path.move_to(self.point(x, y));
+                if let Some([x, y]) = op.nums::<2>()
+                    && let Some(p) = self.point(x, y)
+                {
+                    self.subpath_start = Some(p);
+                    self.path.move_to(p);
                 }
             }
             b"l" => {
@@ -159,46 +208,57 @@ impl ImageState {
                 // friends panic on an empty path by contract, so the segment is skipped, as the
                 // renderer, MuPDF and pdftotext do (#3581).
                 if let Some([x, y]) = op.nums::<2>()
-                    && self.path.elements().last().is_some()
+                    && self.has_current_point()
+                    && let Some(p) = self.point(x, y)
                 {
-                    self.path.line_to(self.point(x, y));
+                    self.path.line_to(p);
                 }
             }
             b"c" => {
                 if let Some([x1, y1, x2, y2, x3, y3]) = op.nums::<6>()
-                    && self.path.elements().last().is_some()
+                    && self.has_current_point()
+                    && let (Some(p1), Some(p2), Some(p3)) = (self.point(x1, y1), self.point(x2, y2), self.point(x3, y3))
                 {
-                    self.path.curve_to(self.point(x1, y1), self.point(x2, y2), self.point(x3, y3));
+                    self.path.curve_to(p1, p2, p3);
                 }
             }
             b"v" => {
                 if let Some([x1, y1, x2, y2]) = op.nums::<4>()
-                    && let Some(current) = self.path.elements().last().and_then(|e| e.end_point())
+                    && self.has_current_point()
+                    && let (Some(p1), Some(p2)) = (self.point(x1, y1), self.point(x2, y2))
+                    && let Some(current) = self.current_point()
                 {
-                    self.path.curve_to(current, self.point(x1, y1), self.point(x2, y2));
+                    self.path.curve_to(current, p1, p2);
                 }
             }
             b"y" => {
                 if let Some([x1, y1, x2, y2]) = op.nums::<4>()
-                    && self.path.elements().last().is_some()
+                    && self.has_current_point()
+                    && let (Some(p1), Some(end)) = (self.point(x1, y1), self.point(x2, y2))
                 {
-                    let end = self.point(x2, y2);
-                    self.path.curve_to(self.point(x1, y1), end, end);
+                    self.path.curve_to(p1, end, end);
                 }
             }
-            // ClosePath with no subpath panics by the same contract (#3581).
-            b"h" if self.path.elements().last().is_some() => {
-                self.path.close_path();
-            }
-            b"re" => {
-                if let Some([x, y, w, h]) = op.nums::<4>() {
-                    self.path.move_to(self.point(x, y));
-                    self.path.line_to(self.point(x + w, y));
-                    self.path.line_to(self.point(x + w, y + h));
-                    self.path.line_to(self.point(x, y + h));
+            b"h" => {
+                // ClosePath with no subpath panics by the same contract (#3581).
+                if self.has_current_point() {
                     self.path.close_path();
                 }
             }
+            b"re" => {
+                if let Some([x, y, w, h]) = op.nums::<4>()
+                    && let (Some(p0), Some(p1), Some(p2), Some(p3)) =
+                        (self.point(x, y), self.point(x + w, y), self.point(x + w, y + h), self.point(x, y + h))
+                {
+                    self.subpath_start = Some(p0);
+                    self.path.move_to(p0);
+                    self.path.line_to(p1);
+                    self.path.line_to(p2);
+                    self.path.line_to(p3);
+                    self.path.close_path();
+                }
+            }
+            b"MP" if op.name(0) == Some(b"PdfCraftImageCrop") => self.app_crop = true,
             b"W" => self.pending_clip = Some(false),
             b"W*" => self.pending_clip = Some(true),
             b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" => {
@@ -207,9 +267,11 @@ impl ImageState {
                     // follows the same rule, and its bounds use cubic extrema, not controls.
                     let bounds = self.path.bounding_box();
                     self.placement.clip = intersection(self.placement.clip, [bounds.x0, bounds.y0, bounds.x1, bounds.y1]).unwrap_or([0.0; 4]);
-                    self.placement.clips.push(ClipPath { path: Arc::new(std::mem::take(&mut self.path)), even_odd });
+                    self.placement.clips.push(ClipPath { path: Arc::new(std::mem::take(&mut self.path)), even_odd, app_crop: self.app_crop });
                 }
                 self.path = BezPath::new();
+                self.subpath_start = None;
+                self.app_crop = false;
             }
             _ => {}
         }
@@ -264,6 +326,7 @@ pub fn page_images(doc: &Document, page: usize) -> Result<Vec<PageImage>, EditEr
             } else {
                 continue;
             };
+
             let rect = matrix.bbox(bounds);
             if !bounds.iter().chain(matrix.0.iter()).chain(rect.iter()).all(|v| v.is_finite())
                 || bounds[2] <= bounds[0]
@@ -382,6 +445,15 @@ pub fn reading_images(doc: &Document, page: usize) -> Result<Vec<PageImage>, Edi
     Ok(out)
 }
 
+/// The four stacking order arrangements.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ArrangeOrder {
+    BringToFront,
+    SendToBack,
+    BringForward,
+    SendBackward,
+}
+
 /// What to do with an image.
 #[derive(Clone, Debug, PartialEq)]
 pub enum ImageChange {
@@ -394,6 +466,10 @@ pub enum ImageChange {
     /// Draw this image XObject instead, in the same place.
     Replace(ObjRef),
     Delete,
+    /// Change the stacking order.
+    Arrange(ArrangeOrder),
+    /// Remove any private crop on the image.
+    RemoveCrop,
 }
 
 /// The user-space transform that maps box `from` onto box `to` (move and resize).
@@ -473,6 +549,1077 @@ fn clip_matrix(draw: Matrix, cm: Matrix, t: Matrix) -> Option<Matrix> {
     Some(outer.then(&t).then(&outer.invert()?))
 }
 
+pub(crate) fn is_entire_page_wrapped(ops: &[Op]) -> bool {
+    if ops.len() < 2 || !ops.first().is_some_and(|o| o.is("q")) || !ops.last().is_some_and(|o| o.is("Q")) {
+        return false;
+    }
+    let mut depth: usize = 0;
+    for (i, op) in ops.iter().enumerate() {
+        if op.is("q") {
+            depth = depth.saturating_add(1);
+        } else if op.is("Q") {
+            if depth == 1 && i < ops.len().saturating_sub(1) {
+                return false;
+            }
+            depth = depth.saturating_sub(1);
+        }
+    }
+    depth == 0
+}
+
+/// The end (exclusive) of the sequence opened at `i`: just past the `close` that matches it,
+/// counting the nested `opens`, or `end` when it never closes.
+fn sequence_end(ops: &[Op], i: usize, end: usize, opens: &[&str], close: &str) -> usize {
+    let mut depth: usize = 1;
+    for (j, op) in ops.iter().enumerate().take(end).skip(i.saturating_add(1)) {
+        if opens.iter().any(|o| op.is(o)) {
+            depth = depth.saturating_add(1);
+        } else if op.is(close) {
+            depth = depth.saturating_sub(1);
+            if depth == 0 {
+                return j.saturating_add(1);
+            }
+        }
+    }
+    end
+}
+
+pub(crate) fn content_units(ops: &[Op], scan_start: usize, scan_end: usize) -> Vec<std::ops::Range<usize>> {
+    let mut units = Vec::new();
+    let mut i = scan_start;
+    while i < scan_end {
+        let Some(op) = ops.get(i) else { break };
+        let j = if op.is("BDC") || op.is("BMC") {
+            // A marked-content sequence is one unit up to its matching EMC (#3145), so Arrange moves
+            // it whole and never inserts into another one: its content belongs to its tag (ISO 32000-2
+            // § 14.6). An unbalanced sequence runs to the end of the scan.
+            sequence_end(ops, i, scan_end, &["BDC", "BMC"], "EMC")
+        } else if op.is("q") {
+            sequence_end(ops, i, scan_end, &["q"], "Q")
+        } else if op.is("BT") {
+            sequence_end(ops, i, scan_end, &[], "ET")
+        } else if op.is("BI") {
+            sequence_end(ops, i, scan_end, &[], "EI")
+        } else if op.is("Do") || op.is("sh") {
+            i.saturating_add(1)
+        } else {
+            let mut j = i;
+            let mut found_end = false;
+            while j < scan_end {
+                let Some(next) = ops.get(j) else { break };
+                if matches!(next.op.as_slice(), b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" | b"n") {
+                    j = j.saturating_add(1);
+                    found_end = true;
+                    break;
+                } else if j > i
+                    && matches!(
+                        next.op.as_slice(),
+                        b"q" | b"Q" | b"BT" | b"BI" | b"Do" | b"sh" | b"BDC" | b"BMC" | b"EMC" | b"Tj" | b"TJ" | b"'" | b"\""
+                    )
+                {
+                    found_end = true;
+                    break;
+                }
+                j = j.saturating_add(1);
+            }
+            if found_end { j } else { scan_end.max(i.saturating_add(1)) }
+        };
+        units.push(i..j);
+        i = j;
+    }
+    units.retain(|u| {
+        ops.get(u.clone()).is_some_and(|slice| {
+            slice.iter().any(|op| {
+                matches!(
+                    op.op.as_slice(),
+                    b"Do" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" | b"Tj" | b"TJ" | b"'" | b"\""
+                )
+            })
+        })
+    });
+    units
+}
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct ExtractedScopeState {
+    pub clip_ops: Vec<Op>,
+    pub state_ops: Vec<Op>,
+    pub do_op: Op,
+}
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub(crate) struct EffectiveGState {
+    pub(crate) ca: Option<f64>,
+    pub(crate) ca_stroke: Option<f64>,
+    pub(crate) bm: Option<Vec<u8>>,
+    pub(crate) smask: Option<MaskIdentity>,
+    // Printing parameters cannot generally be reset by a content-stream operator. Retain their
+    // exact values so Arrange refuses a destination whose state it cannot reconstruct.
+    print_params: std::collections::BTreeMap<Vec<u8>, std::rc::Rc<Object>>,
+    rendering_intent: Option<Vec<u8>>,
+}
+
+impl EffectiveGState {
+    pub(crate) fn visually_differs(&self, other: &EffectiveGState) -> bool {
+        (self.ca.unwrap_or(1.0) - other.ca.unwrap_or(1.0)).abs() > 1e-4
+            || (self.ca_stroke.unwrap_or(1.0) - other.ca_stroke.unwrap_or(1.0)).abs() > 1e-4
+            || self.bm.as_deref().unwrap_or(b"Normal") != other.bm.as_deref().unwrap_or(b"Normal")
+            || self.smask != other.smask
+            || self.print_params != other.print_params
+    }
+
+    #[cfg(test)]
+    pub(crate) fn merge_dict(&mut self, dict: &Dict, doc: &Document, ctm: Matrix) {
+        self.merge_shared(&Arc::new(Object::Dict(dict.clone())), doc, ctm);
+    }
+
+    fn merge_shared(&mut self, definition: &Arc<Object>, doc: &Document, ctm: Matrix) {
+        let Some(dict) = definition.as_dict() else { return };
+        for key in [b"TR".as_slice(), b"TR2", b"OP", b"op", b"OPM", b"BG", b"BG2", b"UCR", b"UCR2", b"HT"] {
+            if let Some(value) = dict.get(key) {
+                self.print_params.insert(key.to_vec(), std::rc::Rc::new(value.clone()));
+            }
+        }
+        if let Some(intent) = dict.get(b"RI").map(|v| doc.resolve(v)).and_then(|v| v.as_name().map(<[u8]>::to_vec)) {
+            self.rendering_intent = Some(intent);
+        }
+        if let Some(val) = dict.get(b"ca").map(|v| doc.resolve(v)).and_then(|v| v.as_f64()) {
+            self.ca = Some(val);
+        }
+        if let Some(val) = dict.get(b"CA").map(|v| doc.resolve(v)).and_then(|v| v.as_f64()) {
+            self.ca_stroke = Some(val);
+        }
+        if let Some(bm_obj) = dict.get(b"BM").map(|v| doc.resolve(v)) {
+            if let Some(name) = bm_obj.as_name() {
+                self.bm = Some(name.to_vec());
+            } else if let Some(arr) = bm_obj.as_array()
+                && let Some(first_name) = arr.first().map(|v| doc.resolve(v)).and_then(|v| v.as_name().map(|n| n.to_vec()))
+            {
+                self.bm = Some(first_name);
+            }
+        }
+        if let Some(raw_smask) = dict.get(b"SMask") {
+            let disabled = raw_smask.as_name() == Some(b"None") || raw_smask.as_ref().is_some_and(|r| doc.get(r).as_name() == Some(b"None"));
+            self.smask = (!disabled).then(|| MaskIdentity { definition: Arc::clone(definition), ctm });
+        }
+    }
+}
+
+const MAX_ACTIVE_GS_OPS: usize = 128;
+
+type ActiveGsOp = (Vec<u8>, Op, Matrix);
+type ActiveGsOps = std::rc::Rc<Vec<ActiveGsOp>>;
+
+#[derive(Clone, Default)]
+struct ExtendedGStateTracker {
+    stack: Vec<(EffectiveGState, ActiveGsOps)>,
+    current_state: EffectiveGState,
+    active_gs_ops: ActiveGsOps,
+    definitions: std::collections::HashMap<Vec<u8>, Arc<Object>>,
+}
+
+impl ExtendedGStateTracker {
+    fn step(&mut self, op: &Op, ext_gstates: &Dict, doc: &Document, ctm: Matrix) -> Result<(), EditError> {
+        match op.op.as_slice() {
+            b"ri" => self.current_state.rendering_intent = op.name(0).map(<[u8]>::to_vec),
+            b"q" => {
+                if self.stack.len() >= 4096 {
+                    return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+                }
+                self.stack.push((self.current_state.clone(), std::rc::Rc::clone(&self.active_gs_ops)));
+            }
+            b"Q" => {
+                if let Some((prev_state, prev_ops)) = self.stack.pop() {
+                    self.current_state = prev_state;
+                    self.active_gs_ops = prev_ops;
+                }
+            }
+            b"gs" => {
+                let valid_gs = op.name(0).and_then(|name| {
+                    let definition = self.definitions.get(name).cloned().or_else(|| {
+                        let definition = doc.resolve(ext_gstates.get(name)?);
+                        definition.as_dict()?;
+                        self.definitions.insert(name.to_vec(), Arc::clone(&definition));
+                        Some(definition)
+                    })?;
+                    Some((name, definition))
+                });
+                if let Some((name, definition)) = valid_gs {
+                    self.current_state.merge_shared(&definition, doc, ctm);
+                    let mut next = (*self.active_gs_ops).clone();
+                    if let Some(pos) = next.iter().position(|(k, _, _)| k.as_slice() == name) {
+                        next.remove(pos);
+                    }
+                    if next.len() < MAX_ACTIVE_GS_OPS {
+                        next.push((name.to_vec(), op.clone(), ctm));
+                    }
+                    self.active_gs_ops = std::rc::Rc::new(next);
+                }
+            }
+            _ => {}
+        }
+        Ok(())
+    }
+}
+
+/// The drawing-state operators besides colour that a moved unit restores, in the order it writes them.
+const DRAWING_PARAMS: [&str; 14] = ["w", "J", "j", "M", "d", "ri", "i", "Tc", "Tw", "Tz", "TL", "Tr", "Ts", "Tf"];
+
+#[derive(Clone, Default, Debug, PartialEq)]
+struct DrawingState {
+    non_stroking_color: Option<SharedColorOps>,
+    stroking_color: Option<SharedColorOps>,
+    /// The last operator of each of [`DRAWING_PARAMS`].
+    params: [Option<std::rc::Rc<Op>>; DRAWING_PARAMS.len()],
+}
+
+// Save/restore shares operand storage, including when only the current colour changes under q.
+type SharedColorOps = std::rc::Rc<Vec<std::rc::Rc<Op>>>;
+
+/// Keep the explicit or implicit colour-space selector before `sc`/`scn` (or `SC`/`SCN`).
+fn set_color(slot: &mut Option<SharedColorOps>, op: &Op, space: &str) {
+    match slot {
+        Some(ops) if ops.first().is_some_and(|o| o.is(space) || matches!(o.op.as_slice(), b"g" | b"rg" | b"k" | b"G" | b"RG" | b"K")) => {
+            let ops = std::rc::Rc::make_mut(ops);
+            ops.truncate(1);
+            ops.push(std::rc::Rc::new(op.clone()));
+        }
+        _ => *slot = Some(std::rc::Rc::new(vec![std::rc::Rc::new(op.clone())])),
+    }
+}
+
+#[derive(Clone, Default, Debug)]
+struct DrawingStateTracker {
+    stack: Vec<DrawingState>,
+    current: DrawingState,
+}
+
+impl DrawingStateTracker {
+    fn step(&mut self, op: &Op) -> Result<(), EditError> {
+        match op.op.as_slice() {
+            b"q" => {
+                if self.stack.len() >= 4096 {
+                    return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+                }
+                self.stack.push(self.current.clone());
+            }
+            b"Q" => {
+                if let Some(prev) = self.stack.pop() {
+                    self.current = prev;
+                }
+            }
+            b"g" | b"rg" | b"k" | b"cs" => self.current.non_stroking_color = Some(std::rc::Rc::new(vec![std::rc::Rc::new(op.clone())])),
+            b"sc" | b"scn" => set_color(&mut self.current.non_stroking_color, op, "cs"),
+            b"G" | b"RG" | b"K" | b"CS" => self.current.stroking_color = Some(std::rc::Rc::new(vec![std::rc::Rc::new(op.clone())])),
+            b"SC" | b"SCN" => set_color(&mut self.current.stroking_color, op, "CS"),
+            _ => {
+                if let Some(slot) = DRAWING_PARAMS.iter().position(|p| op.is(p)).and_then(|k| self.current.params.get_mut(k)) {
+                    *slot = Some(std::rc::Rc::new(op.clone()));
+                }
+            }
+        }
+        Ok(())
+    }
+}
+
+/// Initial line style, rendering intent and text-state parameters.
+fn initial_param(name: &str) -> Option<Op> {
+    use pdfcraft_content::num;
+    let operands = match name {
+        "w" => vec![num(1.0)],
+        "J" | "j" => vec![num(0.0)],
+        "M" => vec![num(10.0)],
+        "d" => vec![Object::Array(vec![]), num(0.0)],
+        "ri" => vec![Object::name("RelativeColorimetric")],
+        "Tc" | "Tw" | "TL" | "Tr" | "Ts" => vec![num(0.0)],
+        "Tz" => vec![num(100.0)],
+        _ => return None,
+    };
+    Some(Op::new(name, operands))
+}
+
+/// The drawing state the image had at `source` that differs at `dest`, unless the moved unit's own
+/// state operators (`extracted_state_ops`) set it.
+fn compute_inherited_drawing_ops(source: &DrawingState, dest: &DrawingState, extracted_state_ops: &[Op]) -> Vec<Op> {
+    let sets = |names: &[&str]| extracted_state_ops.iter().any(|o| names.iter().any(|n| o.is(n)));
+    let mut ops = Vec::new();
+    for (own, source, dest, black) in [
+        (sets(&["g", "rg", "k", "cs"]), &source.non_stroking_color, &dest.non_stroking_color, "g"),
+        (sets(&["G", "RG", "K", "CS"]), &source.stroking_color, &dest.stroking_color, "G"),
+    ] {
+        match (own, source, dest) {
+            (true, _, _) | (false, None, None) => {}
+            (false, Some(color), _) => ops.extend(color.iter().map(|op| (**op).clone())),
+            (false, None, Some(_)) => ops.push(Op::new(black, vec![pdfcraft_content::num(0.0)])),
+        }
+    }
+    let mut text_ops = Vec::new();
+    for ((name, source), dest) in DRAWING_PARAMS.iter().zip(&source.params).zip(&dest.params) {
+        let output = if matches!(*name, "Tc" | "Tw" | "Tz" | "TL" | "Tr" | "Ts" | "Tf") { &mut text_ops } else { &mut ops };
+        match (sets(&[name]), source, dest) {
+            (true, _, _) | (false, None, None) => {}
+            (false, Some(op), _) => output.push((**op).clone()),
+            (false, None, Some(_)) => output.extend(initial_param(name)),
+        }
+    }
+    if !text_ops.is_empty() {
+        // Forms inherit text state, even though each BT resets its text matrices.
+        ops.push(Op::new("BT", vec![]));
+        ops.extend(text_ops);
+        ops.push(Op::new("ET", vec![]));
+    }
+    ops
+}
+
+/// The operators that set `clip` again, in user space. [`ImageState`] builds clips only from
+/// finite points with `m`, `l`, `c` and `h`, so `None` (a quadratic segment) does not happen.
+fn clip_path_to_ops(clip: &ClipPath) -> Option<Vec<Op>> {
+    let mut ops = Vec::new();
+    if clip.app_crop {
+        ops.push(crop_marker());
+    }
+    for el in clip.path.elements() {
+        let (name, points) = match el {
+            kurbo::PathEl::MoveTo(p) => ("m", vec![*p]),
+            kurbo::PathEl::LineTo(p) => ("l", vec![*p]),
+            kurbo::PathEl::CurveTo(p1, p2, p3) => ("c", vec![*p1, *p2, *p3]),
+            kurbo::PathEl::ClosePath => ("h", Vec::new()),
+            kurbo::PathEl::QuadTo(..) => return None,
+        };
+        ops.push(Op::new(name, points.iter().flat_map(|p| [pdfcraft_content::num(p.x), pdfcraft_content::num(p.y)]).collect()));
+    }
+    if !ops.is_empty() {
+        ops.push(Op::new(if clip.even_odd { "W*" } else { "W" }, vec![]));
+        ops.push(Op::new("n", vec![]));
+    }
+    Some(ops)
+}
+
+pub(crate) fn extract_scope_state(ops: &[Op], start: usize, target: usize, initial_ctm: Matrix) -> Result<Option<ExtractedScopeState>, EditError> {
+    if target >= ops.len() || start > target {
+        return Ok(None);
+    }
+    let target_op = ops.get(target).cloned().ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
+    if start == target {
+        return Ok(Some(ExtractedScopeState { clip_ops: Vec::new(), state_ops: Vec::new(), do_op: target_op }));
+    }
+    let mut clip_ops = Vec::new();
+    let mut state_ops = Vec::new();
+    let mut pending_path: Vec<Op> = Vec::new();
+    let mut pending_clip = false;
+    let mut active_path = false;
+    let mut depth: usize = 0;
+    let mut matrix = initial_ctm;
+    let mut matrix_at_clip = None;
+
+    let scan_start = if ops.get(start).is_some_and(|o| o.is("q")) { start.saturating_add(1) } else { start };
+
+    for i in scan_start..target {
+        let Some(op) = ops.get(i) else {
+            return Ok(None);
+        };
+        match op.op.as_slice() {
+            b"q" => {
+                if depth >= 4096 {
+                    return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+                }
+                depth = depth.saturating_add(1);
+            }
+            b"Q" => {
+                if depth == 0 {
+                    return Ok(None);
+                }
+                depth = depth.saturating_sub(1);
+            }
+            _ if depth > 0 => {}
+            b"cm" => {
+                if active_path {
+                    return Ok(None);
+                }
+                if let Some(m) = op.nums::<6>() {
+                    matrix = Matrix(m).then(&matrix);
+                }
+            }
+            b"m" | b"l" | b"c" | b"v" | b"y" | b"re" | b"h" => {
+                active_path = true;
+                pending_path.push(op.clone());
+            }
+            b"W" | b"W*" => {
+                if !active_path {
+                    return Ok(None);
+                }
+                pending_clip = true;
+                pending_path.push(op.clone());
+            }
+            b"n" => {
+                if pending_clip {
+                    if matrix_at_clip.is_none() {
+                        matrix_at_clip = Some(matrix);
+                    } else if matrix_at_clip != Some(matrix) {
+                        return Ok(None);
+                    }
+                    clip_ops.extend(std::mem::take(&mut pending_path));
+                    clip_ops.push(op.clone());
+                    pending_clip = false;
+                    active_path = false;
+                } else {
+                    pending_path.clear();
+                    active_path = false;
+                }
+            }
+            b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*" => {
+                if pending_clip {
+                    return Ok(None);
+                }
+                pending_path.clear();
+                active_path = false;
+            }
+            b"gs" | b"CS" | b"cs" | b"SC" | b"sc" | b"SCN" | b"scn" | b"G" | b"g" | b"RG" | b"rg" | b"K" | b"k" | b"ri" | b"i" => {
+                state_ops.push(op.clone());
+            }
+            b"BT" => {
+                return Ok(None);
+            }
+            _ => {}
+        }
+    }
+
+    if depth != 0 || active_path || pending_clip {
+        return Ok(None);
+    }
+
+    if !clip_ops.is_empty() && matrix_at_clip != Some(Matrix::IDENTITY) {
+        return Ok(None);
+    }
+
+    Ok(Some(ExtractedScopeState { clip_ops, state_ops, do_op: target_op }))
+}
+
+/// The unit `order` puts the image's unit `target_idx` next to, and whether after it. An image that
+/// shares its unit with other paint at the limit moves within that unit, past or behind the paint.
+fn target_destination_unit<'a>(
+    units: &'a [std::ops::Range<usize>],
+    target_idx: usize,
+    target_unit: &'a std::ops::Range<usize>,
+    order: ArrangeOrder,
+    has_other_paint: bool,
+) -> Result<(&'a std::ops::Range<usize>, bool), EditError> {
+    let forward = matches!(order, ArrangeOrder::BringToFront | ArrangeOrder::BringForward);
+    let refused = || EditError::Invalid(if forward { "the image is already in front" } else { "the image is already at the back" }.into());
+    let at_limit = if forward { target_idx.saturating_add(1) >= units.len() } else { target_idx == 0 };
+    if at_limit {
+        return if has_other_paint { Ok((target_unit, forward)) } else { Err(refused()) };
+    }
+    let dest = match order {
+        ArrangeOrder::BringToFront => units.last(),
+        ArrangeOrder::SendToBack => units.first(),
+        ArrangeOrder::BringForward => units.get(target_idx.saturating_add(1)),
+        ArrangeOrder::SendBackward => target_idx.checked_sub(1).and_then(|i| units.get(i)),
+    };
+    dest.map(|u| (u, forward)).ok_or_else(refused)
+}
+
+/// A moved unit must not borrow a graphics or marked-content boundary from its neighbours.
+fn balanced_arrange_span(ops: &[Op], range: std::ops::Range<usize>) -> bool {
+    let Some(slice) = ops.get(range) else { return false };
+    let (mut graphics, mut marked) = (0usize, 0usize);
+    for op in slice {
+        let depth = match op.op.as_slice() {
+            b"q" => {
+                graphics = graphics.saturating_add(1);
+                continue;
+            }
+            b"BDC" | b"BMC" => {
+                marked = marked.saturating_add(1);
+                continue;
+            }
+            b"Q" => &mut graphics,
+            b"EMC" => &mut marked,
+            _ => continue,
+        };
+        let Some(next) = depth.checked_sub(1) else { return false };
+        *depth = next;
+    }
+    graphics == 0 && marked == 0
+}
+
+/// What Arrange takes out: the byte span, the op where the image's own scope state starts, and the
+/// ops `start..end` removed. That is the image's own `q … Q` scope inside its unit, else the `Do`
+/// alone when the unit paints something else too, else the whole unit.
+fn determine_arrange_spans(
+    ops: &[Op],
+    target: usize,
+    target_unit: &std::ops::Range<usize>,
+    has_other_paint: bool,
+    marked_unit: bool,
+) -> Result<(std::ops::Range<usize>, usize, usize, usize), EditError> {
+    let scope = image_scopes(ops, target, "arranged")
+        .ok()
+        .and_then(|s| s.isolated)
+        .filter(|&(start, end, _)| start >= target_unit.start && end < target_unit.end);
+    let unit_last = target_unit.end.saturating_sub(1);
+    let (first, scope_start, last) = match scope {
+        Some((start, end, _)) if has_other_paint || !marked_unit => (start, start, end),
+        _ if has_other_paint => (target, target, target),
+        // A marked-content unit holding only this image moves whole, with its BDC…EMC.
+        // The whole sequence is removed; the image's state is rebuilt from the ops inside it.
+        _ if marked_unit => (target_unit.start, target_unit.start.saturating_add(1).min(target), unit_last),
+        _ => (target_unit.start, target_unit.start, unit_last),
+    };
+    if !balanced_arrange_span(ops, first..last.saturating_add(1)) {
+        return Err(EditError::Invalid("cannot arrange an image across graphics or marked-content boundaries".into()));
+    }
+    let missing = || EditError::Invalid("the image content unit could not be located".into());
+    let start = ops.get(first).ok_or_else(missing)?.span.start;
+    let end = ops.get(last).ok_or_else(missing)?.span.end;
+    Ok((start..end, scope_start, first, last.saturating_add(1)))
+}
+
+fn scan_leaking_ops(ops: &[Op], rem_start: usize, rem_end: usize) -> (Vec<Op>, bool) {
+    let mut q_depth = 0usize;
+    let mut leaking_ops = Vec::new();
+    let mut pending_clip_path: Vec<Op> = Vec::new();
+    let mut pending_clip = false;
+    let mut has_leaking_clip = false;
+    for op in ops.get(rem_start..rem_end).unwrap_or_default() {
+        match op.op.as_slice() {
+            b"q" => q_depth = q_depth.saturating_add(1),
+            b"Q" => q_depth = q_depth.saturating_sub(1),
+            b"m" | b"l" | b"c" | b"v" | b"y" | b"re" | b"h" if q_depth == 0 => {
+                pending_clip_path.push(op.clone());
+            }
+            b"W" | b"W*" if q_depth == 0 => {
+                if !pending_clip_path.is_empty() {
+                    pending_clip = true;
+                    pending_clip_path.push(op.clone());
+                }
+            }
+            b"n" if q_depth == 0 => {
+                if pending_clip {
+                    pending_clip_path.push(op.clone());
+                    leaking_ops.extend(std::mem::take(&mut pending_clip_path));
+                    has_leaking_clip = true;
+                    pending_clip = false;
+                } else {
+                    pending_clip_path.clear();
+                }
+            }
+            b"rg" | b"RG" | b"g" | b"G" | b"k" | b"K" | b"cs" | b"CS" | b"sc" | b"scn" | b"SC" | b"SCN" | b"w" | b"J" | b"j" | b"M" | b"d"
+            | b"ri" | b"i" | b"gs" | b"Tf" | b"Tc" | b"Tw" | b"Tz" | b"TL" | b"Tr" | b"Ts"
+                if q_depth == 0 =>
+            {
+                leaking_ops.push(op.clone());
+            }
+            b"cm" if q_depth == 0 => {
+                leaking_ops.push(op.clone());
+            }
+            _ => {
+                if q_depth == 0 && !op.is("BDC") && !op.is("BMC") && !op.is("EMC") && !pending_clip {
+                    pending_clip_path.clear();
+                }
+            }
+        }
+    }
+    (leaking_ops, has_leaking_clip)
+}
+
+fn build_relocated_unit_ops(
+    marked_open: Option<&Op>,
+    source_gs_ops: &[(Op, Matrix)],
+    inherited_drawing_ops: &[Op],
+    extracted: ExtractedScopeState,
+    dest_ctm: Matrix,
+    draw_matrix: [f64; 6],
+    has_closing_emc: bool,
+) -> Result<Vec<Op>, EditError> {
+    let mut unit_ops = Vec::new();
+    if let Some(open) = marked_open {
+        unit_ops.push(open.clone());
+    }
+    unit_ops.push(Op::new("q", vec![]));
+    let mut current_ctm = dest_ctm;
+
+    for (gs_op, target_ctm) in source_gs_ops {
+        if *target_ctm != current_ctm {
+            let current_inv = current_ctm.invert().ok_or_else(|| EditError::Invalid("unsupported graphics state: non-invertible CTM".into()))?;
+            let delta = target_ctm.then(&current_inv);
+            if !delta.0.iter().all(|v| v.is_finite()) {
+                return Err(EditError::Invalid("unsupported graphics state: invalid transform coordinates".into()));
+            }
+            if delta != Matrix::IDENTITY {
+                unit_ops.push(Op::new("cm", delta.0.map(pdfcraft_content::num).to_vec()));
+                current_ctm = *target_ctm;
+            }
+        }
+        unit_ops.push(gs_op.clone());
+    }
+
+    unit_ops.extend(inherited_drawing_ops.iter().cloned());
+
+    let non_gs_ops = extracted.state_ops.into_iter().filter(|o| !o.is("gs"));
+    unit_ops.extend(non_gs_ops);
+
+    if !extracted.clip_ops.is_empty() {
+        if current_ctm != Matrix::IDENTITY {
+            let current_inv = current_ctm.invert().ok_or_else(|| EditError::Invalid("unsupported graphics state: non-invertible CTM".into()))?;
+            unit_ops.push(Op::new("cm", current_inv.0.map(pdfcraft_content::num).to_vec()));
+        }
+        unit_ops.extend(extracted.clip_ops);
+        if Matrix(draw_matrix) != Matrix::IDENTITY {
+            unit_ops.push(Op::new("cm", draw_matrix.map(pdfcraft_content::num).to_vec()));
+        }
+    } else if Matrix(draw_matrix) != current_ctm {
+        let current_inv = current_ctm.invert().ok_or_else(|| EditError::Invalid("unsupported graphics state: non-invertible CTM".into()))?;
+        let delta = Matrix(draw_matrix).then(&current_inv);
+        if !delta.0.iter().all(|v| v.is_finite()) {
+            return Err(EditError::Invalid("unsupported graphics state: invalid transform coordinates".into()));
+        }
+        if delta != Matrix::IDENTITY {
+            unit_ops.push(Op::new("cm", delta.0.map(pdfcraft_content::num).to_vec()));
+        }
+    }
+    unit_ops.push(extracted.do_op);
+    unit_ops.push(Op::new("Q", vec![]));
+    if has_closing_emc {
+        unit_ops.push(Op::new("EMC", vec![]));
+    }
+    Ok(unit_ops)
+}
+
+/// Change the stacking order of `img`, drawn on page `p` by its content streams `all`.
+fn arrange_image(
+    doc: &mut Document,
+    p: &pdfcraft_model::Page,
+    all: &[(Object, Vec<u8>)],
+    img: &PageImage,
+    order: ArrangeOrder,
+) -> Result<(), EditError> {
+    let pieces = joined(all);
+    let ops = pieces.parse().ops;
+    let target = img.op;
+    let target_op = ops.get(target).filter(|op| op.is("Do")).ok_or_else(|| EditError::Invalid("the image operation could not be located".into()))?;
+
+    let is_wrapped = is_entire_page_wrapped(&ops);
+    let (scan_start, scan_end) = if is_wrapped { (1, ops.len().saturating_sub(1)) } else { (0, ops.len()) };
+    let units = content_units(&ops, scan_start, scan_end);
+    let Some((target_idx, target_unit)) = units.iter().enumerate().find(|(_, u)| u.contains(&target)) else {
+        return Err(EditError::Invalid("the image content unit could not be located".into()));
+    };
+    let has_other_paint = ops.iter().enumerate().any(|(i, op)| {
+        i >= target_unit.start
+            && i < target_unit.end
+            && i != target
+            && matches!(
+                op.op.as_slice(),
+                b"Do" | b"Tj" | b"TJ" | b"'" | b"\"" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*"
+            )
+    });
+    if units.len() <= 1 && !has_other_paint {
+        return Err(EditError::Invalid("the page has only one content unit to arrange".into()));
+    }
+
+    let (dest_unit, insert_after) = target_destination_unit(&units, target_idx, target_unit, order, has_other_paint)?;
+    if !balanced_arrange_span(&ops, target_unit.clone()) || !balanced_arrange_span(&ops, dest_unit.clone()) {
+        return Err(EditError::Invalid("cannot arrange an image across graphics or marked-content boundaries".into()));
+    }
+
+    // A marked-content sequence that holds other content cannot be split without generating
+    // a new structure element and MCID, so we refuse to rearrange it to avoid leaving the image untagged.
+    // If the sequence holds only this image, the whole marked unit is moved intact.
+    let marked_unit = ops.get(target_unit.start).is_some_and(|o| o.is("BDC") || o.is("BMC"));
+    let marked_depth = ops.iter().take(target).fold(0usize, |depth, op| {
+        if op.is("BDC") || op.is("BMC") {
+            depth.saturating_add(1)
+        } else if op.is("EMC") {
+            depth.saturating_sub(1)
+        } else {
+            depth
+        }
+    });
+    if marked_depth > usize::from(marked_unit) {
+        return Err(EditError::Invalid("cannot rearrange an image out of a nested marked-content sequence".into()));
+    }
+    if marked_unit && has_other_paint {
+        return Err(EditError::Invalid("cannot rearrange an image that shares a marked-content sequence with other content".into()));
+    }
+
+    let (mut target_span, scope_start, rem_start, rem_end) = determine_arrange_spans(&ops, target, target_unit, has_other_paint, marked_unit)?;
+
+    let missing = || EditError::Invalid("the destination content unit could not be located".into());
+    let (dest_pos, scan_target) = if insert_after {
+        (dest_unit.end.checked_sub(1).and_then(|i| ops.get(i)).ok_or_else(missing)?.span.end, dest_unit.end)
+    } else {
+        (ops.get(dest_unit.start).ok_or_else(missing)?.span.start, dest_unit.start)
+    };
+
+    // An added item owns its entire stream: editing or deleting it replaces that stream.
+    // Insert ordinary artwork next to the complete owned unit in a separate stream instead.
+    let destination_piece = if insert_after {
+        dest_unit.end.checked_sub(1).and_then(|i| ops.get(i)).map(|op| pieces.piece_of(op.span.end.saturating_sub(1)))
+    } else {
+        ops.get(dest_unit.start).map(|op| pieces.piece_of(op.span.start))
+    };
+    let owned_destination = destination_piece
+        .filter(|piece| all.get(*piece).is_some_and(|(obj, _)| doc.resolve(obj).as_dict().is_some_and(|d| d.get(b"PCAdded").is_some())));
+    if let Some(piece) = owned_destination {
+        let whole_unit = ops.iter().enumerate().all(|(index, op)| {
+            let (first, last) = pieces.pieces_of(op);
+            if dest_unit.contains(&index) { first == piece && last == piece } else { piece < first || piece > last }
+        });
+        if !whole_unit || img.stream == piece {
+            return Err(EditError::Invalid("cannot arrange an image inside an added item's content stream".into()));
+        }
+    }
+
+    let (leaking_ops, has_leaking_clip) = scan_leaking_ops(&ops, rem_start, rem_end);
+
+    let res = p.dict.get(b"Resources").map(|r| doc.resolve(r)).and_then(|r| r.as_dict().cloned()).unwrap_or_default();
+    let ext_gstates = res.get(b"ExtGState").map(|g| doc.resolve(g)).and_then(|g| g.as_dict().cloned()).unwrap_or_default();
+
+    let mut state = ImageState::new(Matrix::IDENTITY, p.crop(doc), Vec::new());
+    let mut tracker = ExtendedGStateTracker::default();
+    let mut drawing_tracker = DrawingStateTracker::default();
+    let mut source_effective_state = EffectiveGState::default();
+    let mut source_gs_ops = Vec::new();
+    let mut source_drawing_state = DrawingState::default();
+    let mut dest_effective_state = EffectiveGState::default();
+    let mut dest_drawing_state = DrawingState::default();
+    let mut dest_ctm = Matrix::IDENTITY;
+    let mut scope_start_ctm = Matrix::IDENTITY;
+    let mut outer_clips = Vec::new();
+    let mut dest_clips = Vec::new();
+    let mut ctm_before_removal = Matrix::IDENTITY;
+    let mut ctm_after_removal = Matrix::IDENTITY;
+
+    let max_scan = scan_target.max(target.saturating_add(1)).max(scope_start.saturating_add(1)).max(rem_end);
+    for (i, op) in ops.iter().enumerate() {
+        if i == rem_start {
+            ctm_before_removal = state.placement.matrix;
+        }
+        if i == scope_start {
+            scope_start_ctm = state.placement.matrix;
+            outer_clips = state.placement.clips.clone();
+        }
+        if i == target {
+            source_effective_state = tracker.current_state.clone();
+            source_gs_ops = tracker.active_gs_ops.iter().map(|(_, op, ctm)| (op.clone(), *ctm)).collect();
+            source_drawing_state = drawing_tracker.current.clone();
+        }
+        if i == scan_target {
+            dest_effective_state = tracker.current_state.clone();
+            dest_drawing_state = drawing_tracker.current.clone();
+            dest_ctm = state.placement.matrix;
+            dest_clips = state.placement.clips.clone();
+        }
+        if i >= max_scan {
+            break;
+        }
+        state.apply(op)?;
+        tracker.step(op, &ext_gstates, doc, state.placement.matrix)?;
+        drawing_tracker.step(op)?;
+        if op.is("gs")
+            && op.name(0).and_then(|name| tracker.definitions.get(name)).and_then(|gs| gs.as_dict()).is_some_and(|gs| gs.get(b"Font").is_some())
+            && let Some(font) = DRAWING_PARAMS.iter().position(|name| *name == "Tf").and_then(|index| drawing_tracker.current.params.get_mut(index))
+        {
+            // The replayed gs selects its font; do not overwrite it with an older direct Tf.
+            *font = None;
+        }
+        if op.is("gs")
+            && let Some(intent) = &tracker.current_state.rendering_intent
+        {
+            drawing_tracker.step(&Op::new("ri", vec![Object::Name(intent.clone())]))?;
+        }
+        if i == rem_end.saturating_sub(1) {
+            ctm_after_removal = state.placement.matrix;
+        }
+    }
+    if scan_target >= ops.len() {
+        dest_effective_state = tracker.current_state.clone();
+        dest_drawing_state = drawing_tracker.current.clone();
+        dest_ctm = state.placement.matrix;
+        dest_clips = state.placement.clips.clone();
+    }
+    if dest_ctm.invert().is_none() {
+        return Err(EditError::Invalid("unsupported graphics state: non-invertible CTM".into()));
+    }
+
+    let owned_crop = ops.get(scope_start..target).unwrap_or_default().iter().any(|op| op.is("MP") && op.name(0) == Some(b"PdfCraftImageCrop"));
+    let extracted_scope = if owned_crop { None } else { extract_scope_state(&ops, scope_start, target, scope_start_ctm)? };
+    let mut extracted = match extracted_scope {
+        Some(ext) => ext,
+        None if scope_start != target => {
+            if !marked_unit || has_other_paint {
+                target_span = target_op.span.clone();
+            }
+            extract_scope_state(&ops, target, target, Matrix(img.draw_matrix))?
+                .ok_or_else(|| EditError::Invalid("unsupported graphics state: unable to cleanly extract image scope state".into()))?
+        }
+        None => {
+            return Err(EditError::Invalid("unsupported graphics state: unable to cleanly extract image scope state".into()));
+        }
+    };
+
+    // The clips the moved unit draws itself: all of the image's when they are rebuilt from
+    // `img.clips`, else those its own scope set after the clips around it.
+    let all_clips = extracted.clip_ops.is_empty();
+    let reemitted = if all_clips {
+        img.clips.as_slice()
+    } else if img.clips.starts_with(&outer_clips) {
+        img.clips.get(outer_clips.len()..).unwrap_or_default()
+    } else {
+        return Err(EditError::Invalid("unsupported graphics state: the image clipping path cannot be cleanly preserved".into()));
+    };
+    // At the destination it is clipped by the clips there and the ones it draws. Moving past a
+    // clip the image isn't under (or out from under one it is) would change what part shows.
+    if !dest_clips.iter().all(|c| img.clips.contains(c)) || !img.clips.iter().all(|c| dest_clips.contains(c) || reemitted.contains(c)) {
+        return Err(EditError::Invalid(
+            "unsupported graphics state: moving the image past a clipping path would change what part of it shows".into(),
+        ));
+    }
+
+    if all_clips {
+        for clip in &img.clips {
+            let ops = clip_path_to_ops(clip)
+                .ok_or_else(|| EditError::Invalid("unsupported graphics state: the image clipping path cannot be cleanly preserved".into()))?;
+            extracted.clip_ops.extend(ops);
+        }
+    }
+
+    let has_inherited_clip = !img.clips.is_empty() && extracted.clip_ops.is_empty();
+    if has_inherited_clip {
+        return Err(EditError::Invalid("unsupported graphics state: inherited clipping path cannot be cleanly preserved".into()));
+    }
+
+    let mut reconstructed_state = dest_effective_state.clone();
+    for (op, ctm) in &source_gs_ops {
+        if let Some(name) = op.name(0)
+            && let Some(definition) = tracker.definitions.get(name)
+        {
+            reconstructed_state.merge_shared(definition, doc, *ctm);
+        }
+    }
+
+    if reconstructed_state.visually_differs(&source_effective_state) {
+        return Err(EditError::Invalid(
+            "unsupported graphics state: moving the image would alter opacity, blend mode, soft mask, or printing parameters".into(),
+        ));
+    }
+
+    let marked_open = if marked_unit && !has_other_paint { ops.get(target_unit.start) } else { None };
+    let has_closing_emc = marked_open.is_some() && target_unit.end.checked_sub(1).and_then(|i| ops.get(i)).is_some_and(|o| o.is("EMC"));
+    let inherited_drawing_ops = compute_inherited_drawing_ops(&source_drawing_state, &dest_drawing_state, &extracted.state_ops);
+    let unit_ops =
+        build_relocated_unit_ops(marked_open, &source_gs_ops, &inherited_drawing_ops, extracted, dest_ctm, img.draw_matrix, has_closing_emc)?;
+
+    let mut serialized = Vec::new();
+    serialized.push(b'\n');
+    serialized.extend_from_slice(&serialize_ops(&unit_ops));
+    serialized.push(b'\n');
+
+    let leaking = if let Some(inv) = ctm_before_removal.invert() { ctm_after_removal.then(&inv) } else { Matrix::IDENTITY };
+    if leaking != Matrix::IDENTITY && has_leaking_clip {
+        return Err(EditError::Invalid("unsupported graphics state: moving the image would alter clipping path transform".into()));
+    }
+    let mut leak_ops = leaking_ops;
+    if leaking != Matrix::IDENTITY && leak_ops.iter().all(|o| !o.is("cm")) {
+        leak_ops.insert(0, Op::new("cm", leaking.0.map(pdfcraft_content::num).to_vec()));
+    }
+    let removal_replacement = if !leak_ops.is_empty() {
+        let mut s = Vec::new();
+        s.push(b'\n');
+        s.extend_from_slice(&serialize_ops(&leak_ops));
+        s.push(b'\n');
+        s
+    } else {
+        Vec::new()
+    };
+
+    if let Some(piece) = owned_destination {
+        let changed = pieces.splice([(target_span, removal_replacement)]);
+        let contents = crate::text::rewritten_contents(doc, all, changed);
+        let mut list = match contents {
+            Object::Array(list) => list,
+            one => vec![one],
+        };
+        let insertion = piece.saturating_add(usize::from(insert_after));
+        if insertion > list.len() {
+            return Err(EditError::Invalid("the destination content stream is missing".into()));
+        }
+        let relocated = doc.add(Object::Stream(pdfcraft_cos::Stream::flate(Dict::new(), &serialized)));
+        list.insert(insertion, Object::Ref(relocated));
+        doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), Object::Array(list)))?;
+        return Ok(());
+    }
+
+    let mut edits = Vec::new();
+    if dest_pos >= target_span.end {
+        edits.push((target_span, removal_replacement));
+        edits.push((dest_pos..dest_pos, serialized));
+    } else if dest_pos <= target_span.start {
+        edits.push((dest_pos..dest_pos, serialized));
+        edits.push((target_span, removal_replacement));
+    } else {
+        return Err(EditError::Invalid("cannot arrange image into overlapping content range".into()));
+    }
+
+    let changed = pieces.splice(edits);
+    let contents = crate::text::rewritten_contents(doc, all, changed);
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+    Ok(())
+}
+
+/// The saved graphics-state scopes (`q … Q`) around the `Do` at `target` that paint nothing else,
+/// each as `(q, Q, CTM before the q)`.
+struct ImageScopes {
+    /// The innermost one inside which every clip on the image is set.
+    isolated: Option<(usize, usize, Matrix)>,
+    /// The outermost one. It holds all of the image's private clips, but not a clip set outside it.
+    outermost: Option<(usize, usize, Matrix)>,
+    /// The CTM at the `Do`, and whether a clip applies there.
+    placement: Matrix,
+    clipped: bool,
+}
+
+impl ImageScopes {
+    /// The saved graphics-state scope containing just this image and its crop, or the `Do` alone
+    /// when nothing clips it. Applying a transform before that scope moves the actual clipping path
+    /// as well as the pixels. A shared clip must never be moved along with unrelated artwork or text.
+    ///
+    /// Under a clip set outside every scope that holds only this image (a report or table drawing
+    /// each picture as `q re W n cm Do Q` inside a section's clip), no scope contains every active
+    /// clip. The outermost scope holding only the image is used then: it contains all of the
+    /// image's private clips, which move with it, while the outer clip is shared and stays.
+    fn transform_scope(&self, target: usize) -> Option<(usize, usize, Matrix)> {
+        if !self.clipped {
+            return Some((target, target, self.placement));
+        }
+        self.isolated.or(self.outermost)
+    }
+}
+
+/// [`ImageScopes`] of the `Do` at `target`. An image inside a text object cannot be `done`.
+fn image_scopes(ops: &[Op], target: usize, done: &str) -> Result<ImageScopes, EditError> {
+    struct Scope {
+        start: usize,
+        matrix: Matrix,
+        inherited_clip: bool,
+        inherited_path: bool,
+        selected: bool,
+        other_paint: bool,
+    }
+    let mut stack: Vec<Scope> = Vec::new();
+    let mut matrix = Matrix::IDENTITY;
+    let mut clipped = false;
+    let mut path = false;
+    let mut pending_clip = false;
+    let mut text = false;
+    let mut at_image = None;
+    let mut isolated = None;
+    let mut outermost = None;
+    for (index, op) in ops.iter().enumerate() {
+        match op.op.as_slice() {
+            b"q" => {
+                if stack.len() >= 256 {
+                    return Err(EditError::Invalid("the image graphics state is too deeply nested".into()));
+                }
+                stack.push(Scope { start: index, matrix, inherited_clip: clipped, inherited_path: path, selected: false, other_paint: false });
+            }
+            b"Q" => {
+                if let Some(scope) = stack.pop() {
+                    if scope.selected && !scope.other_paint && !scope.inherited_path {
+                        let found = (scope.start, index, scope.matrix);
+                        if !scope.inherited_clip {
+                            isolated.get_or_insert(found);
+                        }
+                        // Scopes close inner first, so the last one recorded is the outermost.
+                        outermost = Some(found);
+                    }
+                    matrix = scope.matrix;
+                    clipped = scope.inherited_clip;
+                    path = scope.inherited_path;
+                    pending_clip = false;
+                }
+            }
+            b"cm" => {
+                if let Some(m) = op.nums::<6>() {
+                    matrix = Matrix(m).then(&matrix);
+                }
+            }
+            b"BT" => text = true,
+            b"ET" => text = false,
+            b"m" | b"l" | b"c" | b"v" | b"y" | b"re" | b"h" => path = true,
+            b"W" | b"W*" => pending_clip = true,
+            _ => {}
+        }
+        if index == target {
+            if text {
+                return Err(EditError::Invalid(format!("an image inside a text object cannot be {done}")));
+            }
+            at_image = Some((matrix, clipped));
+            for scope in &mut stack {
+                scope.selected = true;
+            }
+        } else if matches!(
+            op.op.as_slice(),
+            b"Do" | b"Tj" | b"TJ" | b"'" | b"\"" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*"
+        ) {
+            for scope in &mut stack {
+                scope.other_paint = true;
+            }
+        }
+        if matches!(op.op.as_slice(), b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*") {
+            clipped |= pending_clip;
+            pending_clip = false;
+            path = false;
+        }
+    }
+    let (placement, clipped) = at_image.ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
+    Ok(ImageScopes { isolated, outermost, placement, clipped })
+}
+
+/// A marked-content point identifies only the clipping path written by this editor.
+/// It does not open a marked-content sequence or change the document's structure tags.
+fn crop_marker() -> Op {
+    Op::new("MP", vec![Object::Name(b"PdfCraftImageCrop".to_vec())])
+}
+
+fn app_crop_ranges(ops: &[Op], start: usize, target: usize) -> Vec<std::ops::Range<usize>> {
+    let mut ranges = Vec::new();
+    for (index, op) in ops.iter().enumerate().take(target).skip(start) {
+        if !op.is("MP") || op.name(0) != Some(b"PdfCraftImageCrop") {
+            continue;
+        }
+        let path_start = index.saturating_add(1);
+        let mut end = path_start;
+        while end < target && ops.get(end).is_some_and(|o| matches!(o.op.as_slice(), b"m" | b"l" | b"c" | b"v" | b"y" | b"h" | b"re")) {
+            end = end.saturating_add(1);
+        }
+        if end > path_start && ops.get(end).is_some_and(|o| o.is("W") || o.is("W*")) && ops.get(end.saturating_add(1)).is_some_and(|o| o.is("n")) {
+            ranges.push(index..end.saturating_add(2));
+        }
+    }
+    ranges
+}
+
+/// Remove only crops written by PdfCraft, preserving the document author's clipping paths.
+fn remove_image_crop(doc: &mut Document, p: &pdfcraft_model::Page, all: &[(Object, Vec<u8>)], img: &PageImage) -> Result<(), EditError> {
+    let pieces = joined(all);
+    let ops = pieces.parse().ops;
+    let target = img.op;
+    let scope = image_scopes(&ops, target, "cropped")?;
+    let Some((start, _, _)) = scope.transform_scope(target) else {
+        return Err(EditError::Invalid("the image has no PdfCraft crop to remove".into()));
+    };
+    let crops = app_crop_ranges(&ops, start, target);
+    if crops.is_empty() {
+        return Err(EditError::Invalid("the image has no PdfCraft crop to remove".into()));
+    }
+    let changed = crate::text::splice(&pieces, &ops, |index| (Vec::new(), !crops.iter().any(|r| r.contains(&index))));
+    let contents = crate::text::rewritten_contents(doc, all, changed);
+    doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
+    Ok(())
+}
+
 /// Change image `index` (from [`page_images`]) on `page`.
 pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &ImageChange) -> Result<(), EditError> {
     let images = page_images(doc, page)?;
@@ -490,8 +1637,14 @@ pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &Imag
         ImageChange::Transform(t) => {
             return transform_image(doc, &p, &all, &img, *t);
         }
+        ImageChange::Arrange(order) => {
+            return arrange_image(doc, &p, &all, &img, *order);
+        }
+        ImageChange::RemoveCrop => {
+            return remove_image_crop(doc, &p, &all, &img);
+        }
         ImageChange::Crop(keep) => {
-            return crop_image(doc, &p, &all, &img, *keep);
+            return crop_image_impl(doc, &p, &all, &img, *keep);
         }
         ImageChange::Replace(r) => {
             if img.is_form {
@@ -534,94 +1687,6 @@ pub(crate) fn selectable_images(
         .collect())
 }
 
-/// Find the saved graphics-state scope containing just this image and its crop. Applying
-/// the transform before that scope moves the actual clipping path as well as the pixels.
-/// A shared clip must never be moved along with unrelated artwork or text.
-///
-/// Under a clip set outside every scope that holds only this image (a report or table drawing
-/// each picture as `q re W n cm Do Q` inside a section's clip), no scope contains every active
-/// clip. The outermost scope holding only the image is used then: it contains all of the
-/// image's private clips, which move with it, while the outer clip is shared and stays.
-fn image_transform_scope(ops: &[Op], target: usize) -> Result<Option<(usize, usize, Matrix)>, EditError> {
-    struct Scope {
-        start: usize,
-        matrix: Matrix,
-        inherited_clip: bool,
-        inherited_path: bool,
-        selected: bool,
-        other_paint: bool,
-    }
-    let mut stack: Vec<Scope> = Vec::new();
-    let mut matrix = Matrix::IDENTITY;
-    let mut clipped = false;
-    let mut path = false;
-    let mut pending_clip = false;
-    let mut text = false;
-    let mut at_image = None;
-    let mut isolated = None;
-    let mut outermost = None;
-    for (index, op) in ops.iter().enumerate() {
-        match op.op.as_slice() {
-            b"q" => {
-                if stack.len() >= 256 {
-                    return Err(EditError::Invalid("the image graphics state is too deeply nested to transform".into()));
-                }
-                stack.push(Scope { start: index, matrix, inherited_clip: clipped, inherited_path: path, selected: false, other_paint: false });
-            }
-            b"Q" => {
-                if let Some(scope) = stack.pop() {
-                    if scope.selected && !scope.other_paint && !scope.inherited_path {
-                        if !scope.inherited_clip {
-                            // Prefer the innermost scope that contains every active clipping path.
-                            isolated.get_or_insert((scope.start, index, scope.matrix));
-                        }
-                        // Scopes close inner first, so the last one recorded is the outermost.
-                        outermost = Some((scope.start, index, scope.matrix));
-                    }
-                    matrix = scope.matrix;
-                    clipped = scope.inherited_clip;
-                }
-            }
-            b"cm" => {
-                if let Some(m) = op.nums::<6>() {
-                    matrix = Matrix(m).then(&matrix);
-                }
-            }
-            b"BT" => text = true,
-            b"ET" => text = false,
-            b"m" | b"l" | b"c" | b"v" | b"y" | b"re" => path = true,
-            b"W" | b"W*" => pending_clip = true,
-            _ => {}
-        }
-        if index == target {
-            if text {
-                return Err(EditError::Invalid("an image inside a text object cannot be transformed".into()));
-            }
-            at_image = Some((matrix, clipped));
-            for scope in &mut stack {
-                scope.selected = true;
-            }
-        } else if matches!(
-            op.op.as_slice(),
-            b"Do" | b"Tj" | b"TJ" | b"'" | b"\"" | b"sh" | b"BI" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*"
-        ) {
-            for scope in &mut stack {
-                scope.other_paint = true;
-            }
-        }
-        if matches!(op.op.as_slice(), b"n" | b"S" | b"s" | b"f" | b"F" | b"f*" | b"B" | b"B*" | b"b" | b"b*") {
-            clipped |= pending_clip;
-            pending_clip = false;
-            path = false;
-        }
-    }
-    let (placement, clipped) = at_image.ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
-    if !clipped {
-        return Ok(Some((target, target, placement)));
-    }
-    Ok(isolated.or(outermost))
-}
-
 fn transform_image(
     doc: &mut Document,
     page: &pdfcraft_model::Page,
@@ -640,12 +1705,14 @@ fn transform_image(
     }
     // A private path crop moves with its image regardless of intervening state operators.
     // Shared crops retain the existing fixed-clip behavior, preserving neighbouring paint.
-    let (start, end, placement) = image_transform_scope(&ops, target)?.unwrap_or((target, target, Matrix(image.draw_matrix)));
+    let (start, end, placement) =
+        image_scopes(&ops, target, "transformed")?.transform_scope(target).unwrap_or((target, target, Matrix(image.draw_matrix)));
     let inverse = placement.invert().ok_or_else(|| EditError::Invalid("the image has no area".into()))?;
     let local = placement.then(&Matrix(transform)).then(&inverse);
     if !local.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
         return Err(EditError::Invalid("the image transform is too large".into()));
     }
+
     // Already alone in a `q cm … Q` (its own placement, or the wrapper an earlier edit added):
     // change that `cm` in place. The CTM inside is `local · cm · outer` either way.
     if let Some((at, cm)) = enclosing_transform(&ops, start, end) {
@@ -686,13 +1753,16 @@ fn transform_image(
 /// that holds the image and its private crop (or a new `q … Q` around the `Do`), written in
 /// that scope's coordinates as the box's four corners, so a turned image crops to an upright
 /// box too and a later transform of the scope moves the crop with the pixels.
-fn crop_image(
+fn crop_image_impl(
     doc: &mut Document,
     page: &pdfcraft_model::Page,
     streams: &[(Object, Vec<u8>)],
     image: &PageImage,
     keep: [f64; 4],
 ) -> Result<(), EditError> {
+    if image.is_form {
+        return Err(EditError::Invalid("cropping grouped Form artwork is not supported".into()));
+    }
     if !keep.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
         return Err(EditError::Invalid("the crop box must be finite and no larger than 1e12".into()));
     }
@@ -700,36 +1770,53 @@ fn crop_image(
     if x1 - x0 < 1e-6 || y1 - y0 < 1e-6 {
         return Err(EditError::Invalid("the crop box has no area".into()));
     }
+    if intersection(image.rect, [x0, y0, x1, y1]).is_none() {
+        return Err(EditError::Invalid("the crop box does not intersect the image".into()));
+    }
+
     let pieces = joined(streams);
     let ops = pieces.parse().ops;
     let target = image.op;
     if !ops.get(target).is_some_and(|op| op.is("Do")) {
         return Err(EditError::Invalid("the image operation could not be located".into()));
     }
-    let (start, end, placement) = image_transform_scope(&ops, target)?.unwrap_or((target, target, Matrix(image.draw_matrix)));
+    let (start, end, placement) =
+        image_scopes(&ops, target, "cropped")?.transform_scope(target).unwrap_or((target, target, Matrix(image.draw_matrix)));
     let inverse = placement.invert().ok_or_else(|| EditError::Invalid("the image has no area".into()))?;
     let corners = [(x0, y0), (x1, y0), (x1, y1), (x0, y1)].map(|(x, y)| inverse.apply(x, y));
     if !corners.iter().all(|(x, y)| x.is_finite() && y.is_finite() && x.abs() <= 1e12 && y.abs() <= 1e12) {
         return Err(EditError::Invalid("the crop box is too large for the image's placement".into()));
     }
-    let clip: Vec<Op> = corners
-        .iter()
-        .enumerate()
-        .map(|(i, (x, y))| Op::new(if i == 0 { "m" } else { "l" }, vec![Object::Real(*x), Object::Real(*y)]))
-        .chain([Op::new("h", vec![]), Op::new("W", vec![]), Op::new("n", vec![])])
-        .collect();
-    // The image's own earlier crop (a clipping path right after the scope's `q`) gives way to
-    // the new one, so a crop can grow again as well as shrink.
-    let old_clip: Option<std::ops::Range<usize>> = (start != end)
-        .then(|| {
-            let mut k = start + 1;
-            while ops.get(k).is_some_and(|o| matches!(o.op.as_slice(), b"m" | b"l" | b"c" | b"v" | b"y" | b"h" | b"re")) {
-                k += 1;
-            }
-            (k > start + 1 && ops.get(k).is_some_and(|o| matches!(o.op.as_slice(), b"W" | b"W*")) && ops.get(k + 1).is_some_and(|o| o.is("n")))
-                .then_some(start + 1..k + 2)
-        })
-        .flatten();
+    let is_axis_aligned = ((corners[0].1 - corners[1].1).abs() < 1e-4
+        && (corners[1].0 - corners[2].0).abs() < 1e-4
+        && (corners[2].1 - corners[3].1).abs() < 1e-4
+        && (corners[3].0 - corners[0].0).abs() < 1e-4)
+        || ((corners[0].0 - corners[1].0).abs() < 1e-4
+            && (corners[1].1 - corners[2].1).abs() < 1e-4
+            && (corners[2].0 - corners[3].0).abs() < 1e-4
+            && (corners[3].1 - corners[0].1).abs() < 1e-4);
+    let mut clip: Vec<Op> = if is_axis_aligned {
+        let min_x = corners.iter().map(|(x, _)| *x).fold(f64::INFINITY, f64::min);
+        let max_x = corners.iter().map(|(x, _)| *x).fold(f64::NEG_INFINITY, f64::max);
+        let min_y = corners.iter().map(|(_, y)| *y).fold(f64::INFINITY, f64::min);
+        let max_y = corners.iter().map(|(_, y)| *y).fold(f64::NEG_INFINITY, f64::max);
+        vec![
+            Op::new("re", vec![Object::Real(min_x), Object::Real(min_y), Object::Real(max_x - min_x), Object::Real(max_y - min_y)]),
+            Op::new("W", vec![]),
+            Op::new("n", vec![]),
+        ]
+    } else {
+        corners
+            .iter()
+            .enumerate()
+            .map(|(i, (x, y))| Op::new(if i == 0 { "m" } else { "l" }, vec![Object::Real(*x), Object::Real(*y)]))
+            .chain([Op::new("h", vec![]), Op::new("W", vec![]), Op::new("n", vec![])])
+            .collect()
+    };
+    clip.insert(0, crop_marker());
+    // Replace only our identified crop; an author's path must remain intact.
+    let old_crops = app_crop_ranges(&ops, start, target);
+    let insert_at = start.saturating_add(1);
     let changed = crate::text::splice(&pieces, &ops, |index| {
         if start == end && index == target {
             // No scope of its own yet: one around the drawing, with the crop inside.
@@ -738,10 +1825,10 @@ fn crop_image(
             out.extend(ops.get(index).cloned());
             out.push(Op::new("Q", vec![]));
             (out, false)
-        } else if start != end && index == start + 1 {
+        } else if start != end && index == insert_at {
             // Inside the scope's `q`, before whatever it draws (in place of its old crop).
-            (clip.clone(), old_clip.is_none())
-        } else if old_clip.as_ref().is_some_and(|r| r.contains(&index)) {
+            (clip.clone(), !old_crops.iter().any(|r| r.contains(&index)))
+        } else if old_crops.iter().any(|r| r.contains(&index)) {
             (Vec::new(), false)
         } else {
             (Vec::new(), true)
@@ -787,6 +1874,42 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
     }
     // Images alone in their own `q re W n cm Do Q` take the clip with them.
     let mut clips = std::collections::BTreeMap::new();
+    let mut crop_starts = std::collections::BTreeMap::new();
+    let mut crop_ends = std::collections::BTreeSet::new();
+    let mut folds = std::collections::BTreeMap::new();
+    for image in images.iter().filter(|image| image.has_editor_crop()) {
+        let Some(&(_, _, offset)) = plans.get(&image.op) else { continue };
+        let Some((start, end, placement)) = image_scopes(&ops, image.op, "moved")?.transform_scope(image.op) else {
+            return Err(EditError::Invalid("the image crop cannot be moved independently".into()));
+        };
+        let inverse = placement.invert().ok_or_else(|| EditError::Invalid("a selected image has no area".into()))?;
+        let local = placement.then(&Matrix::translate(offset[0], offset[1])).then(&inverse);
+        if !local.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+            return Err(EditError::Invalid("the image move is too large".into()));
+        }
+        let leading_transform = || {
+            let at = start.checked_add(1)?;
+            if start >= end || !ops.get(start)?.is("q") || !ops.get(at)?.is("cm") {
+                return None;
+            }
+            ops.get(at)?.nums::<6>().map(|m| (at, Matrix(m)))
+        };
+        // An enclosing cm is before the captured placement; an inside-scope cm is after it.
+        // Their multiplication orders differ when that cm scales or shears a translation.
+        let folded = enclosing_transform(&ops, start, end)
+            .map(|(at, cm)| (at, local.then(&cm)))
+            .or_else(|| leading_transform().map(|(at, cm)| (at, cm.then(&local))));
+        if let Some((at, folded)) = folded {
+            if !folded.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
+                return Err(EditError::Invalid("the image move is too large".into()));
+            }
+            folds.insert(at, folded);
+        } else {
+            crop_starts.insert(start, local);
+            crop_ends.insert(end);
+        }
+        plans.remove(&image.op);
+    }
     for index in 0..ops.len() {
         let Some(&(_, placement, offset)) = plans.get(&index) else { continue };
         let Some((at, cm)) = exclusive_clip(&ops, index) else { continue };
@@ -807,7 +1930,6 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
         };
     }
     // An image already alone in `q cm Do Q` moves by changing that `cm`, not by nesting another.
-    let mut folds = std::collections::BTreeMap::new();
     for index in 0..ops.len() {
         let Some(&(movement, _, _)) = plans.get(&index) else { continue };
         let Some((at, cm)) = enclosing_transform(&ops, index, index) else { continue };
@@ -822,6 +1944,14 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
         return Err(EditError::Invalid("a selected image operation is missing".into()));
     }
     let data = crate::text::splice(&pieces, &ops, |index| {
+        if let Some(matrix) = crop_starts.remove(&index) {
+            return (vec![Op::new("q", vec![]), Op::new("cm", matrix.0.map(Object::Real).to_vec())], true);
+        }
+        if crop_ends.remove(&index) {
+            let mut out: Vec<_> = ops.get(index).cloned().into_iter().collect();
+            out.push(Op::new("Q", vec![]));
+            return (out, false);
+        }
         if let Some((c, keep)) = clips.remove(&index) {
             return (vec![Op::new("cm", c.0.map(Object::Real).to_vec())], keep);
         }
@@ -841,3 +1971,44 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
     doc.update_dict(p.obj, |d| d.set(b"Contents".to_vec(), contents))?;
     Ok(())
 }
+
+#[cfg(test)]
+mod allocation_tests {
+    use super::*;
+
+    #[test]
+    fn saved_drawing_states_share_large_operand_storage() {
+        let mut tracker = DrawingStateTracker::default();
+        let parsed = parse(b"[1 2 3 4 5 6 7 8] 0 d /Pattern cs 1 2 3 4 5 6 /P scn q q q");
+        for op in &parsed.ops {
+            tracker.step(op).unwrap();
+        }
+        for state in &tracker.stack {
+            let dash = state.params[4].as_ref().unwrap();
+            let current_dash = tracker.current.params[4].as_ref().unwrap();
+            assert!(std::ptr::eq(dash.operands.as_ptr(), current_dash.operands.as_ptr()), "q must share the dash operands instead of cloning them");
+            let color = state.non_stroking_color.as_ref().unwrap().last().unwrap();
+            let current_color = tracker.current.non_stroking_color.as_ref().unwrap().last().unwrap();
+            assert!(std::ptr::eq(color.operands.as_ptr(), current_color.operands.as_ptr()), "q must share scn operands instead of cloning them");
+        }
+        let saved = tracker.current.clone();
+        for op in &parse(b"[9 10] 0 d 4 5 6 /Other scn Q").ops {
+            tracker.step(op).unwrap();
+        }
+        assert_eq!(tracker.current, saved, "changing shared operands must preserve the saved state");
+    }
+
+    #[test]
+    fn review_soft_mask_identity_includes_establishment_matrix() {
+        let doc = Document::new_empty();
+        let mask = Dict::from_iter([(b"S".to_vec(), Object::name("Alpha")), (b"G".to_vec(), Object::Ref(ObjRef::new(8, 0)))]);
+        let definition = Dict::from_iter([(b"SMask".to_vec(), Object::Dict(mask))]);
+        let states = Dict::from_iter([(b"A".to_vec(), Object::Dict(definition))]);
+        let mut tracker = ExtendedGStateTracker::default();
+        let op = Op::new("gs", vec![Object::name("A")]);
+        tracker.step(&op, &states, &doc, Matrix::IDENTITY).unwrap();
+        let before = tracker.current_state.clone();
+        tracker.step(&op, &states, &doc, Matrix::translate(50.0, 0.0)).unwrap();
+        assert!(before.visually_differs(&tracker.current_state), "the same mask established under a different CTM is a different effective mask");
+    }
+}
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 193f7d8424..aa11617c14 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -35,6 +35,7 @@ pub type Rgb = [f64; 3];
 
 pub mod backdrop;
 pub use backdrop::{Backdrop, backdrops_left_off, page_backdrop, page_backdrops};
+pub use text::strip_subset_tag;
 mod background;
 pub use background::page_background;
 pub mod objects;
@@ -43,7 +44,7 @@ pub use objects::{EditableObject, MAX_MOVE_OBJECTS, ObjectKind, ObjectTarget, ed
 mod flatten;
 pub use flatten::{flatten, flatten_fill_sign};
 pub mod images;
-pub use images::{ImageChange, PageImage, change_image, page_images, reading_images, rect_to_rect, turn_about_centre, turn_by_degrees};
+pub use images::{ArrangeOrder, ImageChange, PageImage, change_image, page_images, reading_images, rect_to_rect, turn_about_centre, turn_by_degrees};
 pub mod bidi;
 pub mod indic;
 mod linebreak;
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index 6df9ab19dd..094757ef3d 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -3516,11 +3516,24 @@ fn image_page() -> Document {
     image_page_with("q 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Caption) Tj ET")
 }
 
+/// Arrange, Crop and Remove crop as the engine asks for them, through [`images::change_image`].
+fn arrange(doc: &mut Document, page: usize, index: usize, order: images::ArrangeOrder) -> Result<(), EditError> {
+    images::change_image(doc, page, index, &images::ImageChange::Arrange(order))
+}
+
+fn crop(doc: &mut Document, page: usize, index: usize, keep: [f64; 4]) -> Result<(), EditError> {
+    images::change_image(doc, page, index, &images::ImageChange::Crop(keep))
+}
+
+fn remove_crop(doc: &mut Document, page: usize, index: usize) -> Result<(), EditError> {
+    images::change_image(doc, page, index, &images::ImageChange::RemoveCrop)
+}
+
 fn image_page_with(content: &str) -> Document {
     let objs: Vec<String> = vec![
         "<< /Type /Catalog /Pages 2 0 R >>".into(),
         "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
-        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> >> >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> /ExtGState << /GS0 << /Type /ExtGState /ca 0.5 /CA 0.5 >> /GSalpha << /Type /ExtGState /ca 0.6 >> /GSblend << /Type /ExtGState /BM /Multiply >> /GS_translucent << /Type /ExtGState /ca 0.5 >> >> >> >>".into(),
         format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
         "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
         "<< /Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 8 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
@@ -3540,6 +3553,57 @@ fn image_page_with(content: &str) -> Document {
     Document::open(Arc::new(out)).unwrap()
 }
 
+fn stencil_page_with(content: &str) -> Document {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R >> >> >>"
+            .into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ImageMask true /Filter /ASCIIHexDecode /Length 5 >>\nstream\n0000>\nendstream".into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+fn form_page_with(content: &str) -> Document {
+    let form_content = "0 0 100 100 re f";
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Fm0 6 0 R >> >> >>"
+            .into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        format!("<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Length {} >>\nstream\n{form_content}\nendstream", form_content.len()),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
 /// A path segment operator before any `m` (or `re`) has no subpath to extend: the image scan used
 /// to call `BezPath`'s `line_to`/`curve_to`/`close_path` on an empty path, which panics by contract,
 /// taking `object_list`, `page_images` and the Office export's image walk down with it (#3581).
@@ -3728,6 +3792,880 @@ fn page_images_move_turn_replace_and_delete() {
     assert!(images::change_image(&mut doc, 0, 0, &images::ImageChange::Delete).is_err());
 }
 
+#[test]
+fn image_arrange_stacking_order_and_remove_crop() {
+    let content = "q 100 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Middle Text) Tj ET q 150 0 0 150 200 200 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    let initial_images = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial_images.len(), 2);
+    assert!(close(initial_images[0].rect, [100.0, 100.0, 200.0, 200.0]));
+    assert!(close(initial_images[1].rect, [200.0, 200.0, 350.0, 350.0]));
+
+    // Boundary case: image 0 is already at the back; SendToBack and SendBackward report an error.
+    assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendToBack).is_err());
+    assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendBackward).is_err());
+    let imgs = images::page_images(&doc, 0).unwrap();
+    assert_eq!(imgs.len(), 2);
+    assert!(close(imgs[0].rect, initial_images[0].rect));
+
+    // Bring forward image 0: moves it past the middle text, but it is still behind image 1.
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringForward).unwrap();
+    let doc = reopen(&doc);
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    // Middle text should now precede image 0's Do in the content stream!
+    let text_pos = str_content.find("Middle Text").unwrap();
+    let first_do = str_content.find("/Im0 Do").unwrap();
+    assert!(text_pos < first_do, "text should now precede image 0");
+
+    // Bring to front on image 0: moves it past image 1 to the front!
+    let mut doc = doc;
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let imgs_after_front = images::page_images(&doc, 0).unwrap();
+    assert_eq!(imgs_after_front.len(), 2);
+    // In drawing order, the image that was at [100, 100, 200, 200] is now drawn LAST (index 1)!
+    assert!(close(imgs_after_front[0].rect, [200.0, 200.0, 350.0, 350.0]));
+    assert!(close(imgs_after_front[1].rect, [100.0, 100.0, 200.0, 200.0]));
+
+    // Send to back on the front image (index 1) restores it to the back.
+    let mut doc = doc;
+    arrange(&mut doc, 0, 1, images::ArrangeOrder::SendToBack).unwrap();
+    let imgs_after_back = images::page_images(&doc, 0).unwrap();
+    assert!(close(imgs_after_back[0].rect, [100.0, 100.0, 200.0, 200.0]));
+    assert!(close(imgs_after_back[1].rect, [200.0, 200.0, 350.0, 350.0]));
+
+    // Test remove crop
+    let cropped_content = "q 200 0 0 100 100 100 cm /Im0 Do Q";
+    let mut doc = image_page_with(cropped_content);
+    crop(&mut doc, 0, 0, [100.0, 100.0, 150.0, 150.0]).unwrap();
+    let img_before = &images::page_images(&doc, 0).unwrap()[0];
+    assert_ne!(img_before.visible_rect, Some(img_before.rect));
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let img_after = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_after.visible_rect, Some(img_after.rect));
+    // Removing crop again when there is no crop is refused.
+    let mut doc = doc;
+    assert!(remove_crop(&mut doc, 0, 0).is_err());
+
+    // Test crop
+    let uncropped_content = "q 200 0 0 100 100 100 cm /Im0 Do Q";
+    let mut doc = image_page_with(uncropped_content);
+    let img_before = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_before.visible_rect, Some(img_before.rect));
+    crop(&mut doc, 0, 0, [120.0, 110.0, 250.0, 180.0]).unwrap();
+    let doc = reopen(&doc);
+    let img_cropped = &images::page_images(&doc, 0).unwrap()[0];
+    assert!(close(img_cropped.visible_rect.unwrap(), [120.0, 110.0, 250.0, 180.0]));
+    // And remove_crop works on it:
+    let mut doc = doc;
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let img_restored = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_restored.visible_rect, Some(img_restored.rect));
+
+    // Test cropping an image that was moved (has an outer transform)
+    let mut doc = image_page_with("q 200 0 0 100 100 100 cm /Im0 Do Q");
+    let move_transform = [1.0, 0.0, 0.0, 1.0, 50.0, 40.0];
+    images::change_image(&mut doc, 0, 0, &images::ImageChange::Transform(move_transform)).unwrap();
+    let doc = reopen(&doc);
+    let img_moved = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_moved.rect, [150.0, 140.0, 350.0, 240.0]);
+    let mut doc = doc;
+    crop(&mut doc, 0, 0, [170.0, 150.0, 300.0, 220.0]).unwrap();
+    let doc = reopen(&doc);
+    let img_crop_moved = &images::page_images(&doc, 0).unwrap()[0];
+    assert!(img_crop_moved.visible_rect.is_some(), "cropped image must not be deleted");
+    assert!(close(img_crop_moved.visible_rect.unwrap(), [170.0, 150.0, 300.0, 220.0]));
+    // Adjust crop (re-crop)
+    let mut doc = doc;
+    crop(&mut doc, 0, 0, [180.0, 160.0, 280.0, 210.0]).unwrap();
+    let doc = reopen(&doc);
+    let img_recropped = &images::page_images(&doc, 0).unwrap()[0];
+    assert!(close(img_recropped.visible_rect.unwrap(), [180.0, 160.0, 280.0, 210.0]));
+    // Remove crop from moved image
+    let mut doc = doc;
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let img_restored_moved = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_restored_moved.visible_rect, Some(img_restored_moved.rect));
+}
+
+#[test]
+fn crop_rotated_image_preserves_angle_and_in_place_geometry() {
+    let content = "q 173.20508 100 -50 86.60254 100 100 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    let img_before = &images::page_images(&doc, 0).unwrap()[0];
+    let m_before = img_before.matrix;
+    assert!((m_before[1] - 100.0).abs() < 1e-3);
+    assert!((m_before[2] - (-50.0)).abs() < 1e-3);
+
+    crop(&mut doc, 0, 0, [140.0, 170.0, 180.0, 210.0]).unwrap();
+    let doc = reopen(&doc);
+    let img_cropped = &images::page_images(&doc, 0).unwrap()[0];
+
+    let m_after = img_cropped.matrix;
+    assert!((m_after[0] - m_before[0]).abs() < 1e-3);
+    assert!((m_after[1] - m_before[1]).abs() < 1e-3);
+    assert!((m_after[2] - m_before[2]).abs() < 1e-3);
+    assert!((m_after[3] - m_before[3]).abs() < 1e-3);
+    assert!((m_after[4] - m_before[4]).abs() < 1e-3);
+    assert!((m_after[5] - m_before[5]).abs() < 1e-3);
+
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    assert!(
+        (str_content.contains("re") || (str_content.contains("m\n") && str_content.contains("l\n"))) && str_content.contains("W\nn"),
+        "{str_content}"
+    );
+    assert!(str_content.contains("/Im0 Do"), "{str_content}");
+
+    let mut doc = doc;
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let img_restored = &images::page_images(&doc, 0).unwrap()[0];
+    assert_eq!(img_restored.matrix, m_before);
+}
+
+#[test]
+fn image_arrange_preserves_shared_group_drawings() {
+    let content = "q 100 0 0 100 100 100 cm /Im0 Do /Im0 Do Q BT /F1 12 Tf 72 700 Td (End Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2, "both images initially present in shared group");
+
+    // Bring image 0 to front: it must not delete image 1 that shares the same q...Q group!
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2, "both images must be preserved after BringToFront");
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    assert!(str_content.contains("End Text"), "text in page must be preserved");
+}
+
+/// The marked-content sequence that `mcid` opens (`/MCID n >> BDC` … its `EMC`), as content text.
+fn marked_sequence(content: &str, mcid: u32) -> &str {
+    let tag = format!("/MCID {mcid}");
+    let start = content.find(&tag).unwrap_or_else(|| panic!("no {tag} in {content}"));
+    let end = content[start..].find("EMC").map(|e| start + e).unwrap_or_else(|| panic!("{tag} has no EMC in {content}"));
+    &content[start..end]
+}
+
+/// #3145: Arrange treated marked-content boundaries as if they weren't there, so Bring to Front put
+/// the image inside the text's `BDC`…`EMC` (tagged as the text) and left its own sequence empty.
+#[test]
+fn image_arrange_keeps_marked_content_sequences_whole() {
+    let content = "/P <</MCID 0>> BDC q 100 0 0 100 50 50 cm /Im0 Do Q EMC /P <</MCID 1>> BDC BT /F1 12 Tf 72 700 Td (Text) Tj ET EMC";
+    let mut doc = image_page_with(content);
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let bytes = page_content_bytes(&doc, 0);
+    let s = String::from_utf8_lossy(&bytes);
+    assert!(marked_sequence(&s, 0).contains("/Im0 Do"), "the image stays in its own sequence: {s}");
+    assert!(!marked_sequence(&s, 1).contains("/Im0 Do"), "the text's sequence holds no image: {s}");
+    assert!(marked_sequence(&s, 1).contains("(Text)"), "{s}");
+    assert!(s.find("/MCID 1").unwrap() < s.find("/MCID 0").unwrap(), "the image's sequence now comes after the text's: {s}");
+    assert_eq!(images::page_images(&doc, 0).unwrap().len(), 1);
+}
+
+/// A `BMC` sequence (here an artifact) moves as a whole too.
+#[test]
+fn image_arrange_moves_a_bmc_sequence_as_a_whole() {
+    let content = "/Artifact BMC q 100 0 0 100 50 50 cm /Im0 Do Q EMC BT /F1 12 Tf 72 700 Td (Body) Tj ET";
+    let mut doc = image_page_with(content);
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let s = String::from_utf8_lossy(&page_content_bytes(&doc, 0)).into_owned();
+    let (art, emc, body, img) = (s.find("/Artifact BMC").unwrap(), s.rfind("EMC").unwrap(), s.find("(Body)").unwrap(), s.find("/Im0 Do").unwrap());
+    assert!(body < art && art < img && img < emc, "text first, then the whole artifact sequence: {s}");
+}
+
+/// An image sharing a marked-content sequence with other content must not end up untagged.
+/// Either the arrange call is refused with Err, or every image paint remains inside a marked-content sequence.
+#[test]
+fn arrange_image_in_shared_tagged_block_refuses_or_keeps_tagged() {
+    let content =
+        "/Figure <</MCID 0>> BDC q 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 9 Tf 50 40 Td (Caption) Tj ET EMC BT /F1 12 Tf 72 700 Td (Body) Tj ET";
+    let mut doc = image_page_with(content);
+    let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    match res {
+        Err(_) => {
+            // Refusing is the expected safe behavior when moving out of a shared tagged unit.
+        }
+        Ok(()) => {
+            let doc = reopen(&doc);
+            let bytes = page_content_bytes(&doc, 0);
+            let ops = pdfcraft_content::parse(&bytes).ops;
+            let mut mc_depth = 0usize;
+            for op in ops {
+                if op.is("BDC") || op.is("BMC") {
+                    mc_depth += 1;
+                } else if op.is("EMC") {
+                    mc_depth = mc_depth.saturating_sub(1);
+                } else if op.is("Do") {
+                    assert!(mc_depth > 0, "every image paint must be inside a marked-content sequence: {}", String::from_utf8_lossy(&bytes));
+                }
+            }
+        }
+    }
+}
+
+/// An image that shares its marked-content sequence with other content cannot be rearranged
+/// without leaving the image untagged or duplicating MCIDs, so it is refused.
+#[test]
+fn image_arrange_splits_a_shared_marked_sequence_into_own_tag() {
+    let content =
+        "/Figure <</MCID 0>> BDC q 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 9 Tf 50 40 Td (Caption) Tj ET EMC BT /F1 12 Tf 72 700 Td (Body) Tj ET";
+    let mut doc = image_page_with(content);
+    assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).is_err());
+}
+
+/// Send backward also refuses to rearrange an image when it shares its sequence with other content.
+#[test]
+fn image_arrange_send_backward_splits_shared_marked_sequence() {
+    let content =
+        "BT /F1 12 Tf 72 700 Td (Header) Tj ET /Table <</MCID 0>> BDC q 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 9 Tf 50 40 Td (Cell) Tj ET EMC";
+    let mut doc = image_page_with(content);
+    assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendBackward).is_err());
+}
+
+#[test]
+fn arrange_preserves_color_leaking_out_of_marked_content() {
+    let content = "/Figure <</MCID 0>> BDC 1 0 0 rg q 100 0 0 100 0 0 cm /Im0 Do Q EMC BT /F1 12 Tf 72 700 Td (Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    if res.is_ok() {
+        let bytes = page_content_bytes(&doc, 0);
+        let s = String::from_utf8_lossy(&bytes);
+        let text_pos = s.find("(Text) Tj").unwrap();
+        assert!(s[..text_pos].contains("1 0 0 rg") || s[..text_pos].contains("1 0 0 RG"));
+    }
+}
+
+#[test]
+fn arrange_shared_tagged_does_not_duplicate_mcid() {
+    let content = "/Figure <</MCID 0>> BDC q 100 0 0 100 0 0 cm /Im0 Do Q 0 0 m 10 10 l S EMC";
+    let mut doc = image_page_with(content);
+    assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::SendToBack).is_err());
+}
+
+#[test]
+fn image_crop_preserves_outer_cm_for_subsequent_drawings() {
+    let content = "100 0 0 100 50 50 cm /Im0 Do /Im0 Do";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+    assert_eq!(initial[1].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    // Crop image 0
+    crop(&mut doc, 0, 0, [60.0, 60.0, 120.0, 120.0]).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2, "both images must remain");
+    // Image 0 is cropped:
+    assert!(close(after[0].visible_rect.unwrap(), [60.0, 60.0, 120.0, 120.0]));
+    // Crucial: Image 1 must still have its rect at [50, 50, 150, 150], proving outer cm was not destroyed!
+    assert_eq!(after[1].rect, [50.0, 50.0, 150.0, 150.0], "subsequent image must retain global cm");
+}
+
+#[test]
+fn image_arrange_preserves_position_under_active_ctm() {
+    let content = "100 0 0 100 50 50 cm /Im0 Do /Im0 Do";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+    assert_eq!(initial[1].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    // Move first image to front: must not apply destination CTM twice!
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: check order of operators in the content stream
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let first_do = str_content.find("/Im0 Do").unwrap();
+    let last_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(first_do < last_do, "Position: multiple image Do calls exist and order was updated");
+
+    // 2. Appearance: both images' positions and sizes are preserved
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: first image position preserved");
+    assert_eq!(after[1].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: second image position preserved");
+
+    // 3. Preservation: outer CTM is preserved
+    assert!(str_content.contains("100 0 0 100 50 50 cm"), "Preservation: initial CTM preserved");
+}
+
+#[test]
+fn image_arrange_preserves_shared_group_clipping_bounds() {
+    let content = "q 120 120 40 40 re W n 100 0 0 100 100 100 cm /Im0 Do /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2);
+    assert_eq!(initial[0].rect, [100.0, 100.0, 200.0, 200.0]);
+    assert_eq!(initial[0].visible_rect, Some([120.0, 120.0, 160.0, 160.0]));
+    assert_eq!(initial[1].rect, [100.0, 100.0, 200.0, 200.0]);
+    assert_eq!(initial[1].visible_rect, Some([120.0, 120.0, 160.0, 160.0]));
+
+    // Bring image 0 to front: moves it past the external text while preserving clipping bounds
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: moved image Do now follows External Text in AST
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let text_pos = str_content.find("External Text").unwrap();
+    let moved_do_pos = str_content.rfind("/Im0 Do").unwrap();
+    assert!(text_pos < moved_do_pos, "Position: moved image Do follows External Text");
+
+    // 2. Appearance: both images retain exact clipping bounds and geometry
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2, "both images preserved");
+    assert_eq!(after[0].visible_rect, Some([120.0, 120.0, 160.0, 160.0]), "Appearance: image 0 retains clip");
+    assert_eq!(after[1].visible_rect, Some([120.0, 120.0, 160.0, 160.0]), "Appearance: image 1 retains clip");
+
+    // 3. Preservation: External Text and original group drawing preserved
+    assert!(str_content.contains("External Text"), "Preservation: external text preserved");
+    assert!(str_content.contains("120 120 40 40 re W n"), "Preservation: clipping path operators preserved");
+}
+
+#[test]
+fn image_arrange_preserves_extended_graphics_state_opacity() {
+    let content = "q /GS0 gs 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: /Im0 Do moved past External Text
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let text_pos = str_content.find("External Text").unwrap();
+    let do_pos = str_content.rfind("/Im0 Do").unwrap();
+    assert!(text_pos < do_pos, "Position: /Im0 Do moved past External Text");
+
+    // 2. Appearance: /GS0 gs is retained and directly precedes /Im0 Do
+    let gs_pos = str_content.rfind("/GS0 gs").unwrap();
+    assert!(text_pos < gs_pos, "Appearance: /GS0 gs is in the new moved unit");
+    assert!(gs_pos < do_pos, "Appearance: /GS0 gs directly precedes /Im0 Do");
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1, "image preserved");
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: rect preserved");
+
+    // 3. Preservation: External Text is preserved
+    assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (External Text) Tj ET"), "Preservation: text preserved");
+}
+
+#[test]
+fn image_arrange_preserves_exact_non_rectangular_clipping_path() {
+    let content = "q 120 120 m 160 120 l 140 160 l h W* n 100 0 0 100 100 100 cm /Im0 Do /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: moved image follows External Text in AST
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let text_pos = str_content.find("External Text").unwrap();
+    let last_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(text_pos < last_do, "Position: moved image follows External Text");
+
+    // 2. Appearance: polygon geometry and even-odd rule are preserved
+    assert!(str_content.contains("W*"), "Appearance: even-odd W* fill rule preserved");
+    // The original group still clips the image left behind, so the moved copy must carry its own.
+    let flat = str_content.split_whitespace().collect::<Vec<_>>().join(" ");
+    assert_eq!(flat.matches("120 120 m 160 120 l 140 160 l h W* n").count(), 2, "Appearance: exact polygon clip preserved in both units");
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2, "both images preserved");
+    for image in &after {
+        assert!(image.contains([140.0, 130.0]), "Appearance: inside the triangle shows");
+        assert!(!image.contains([125.0, 155.0]), "Appearance: inside its box but outside the triangle stays clipped");
+    }
+
+    // 3. Preservation: External Text and remaining original group content preserved
+    assert!(str_content.contains("External Text"), "Preservation: external text preserved");
+}
+
+#[test]
+fn image_remove_crop_after_arrange_keeps_position_under_outer_transform() {
+    // Arrange writes `cm inverse`, the clip, then the absolute placement; Remove Crop used to drop
+    // only the first, which drew the image under the outer translation twice.
+    let content = "1 0 0 1 50 50 cm q 100 0 0 100 0 0 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    crop(&mut doc, 0, 0, [50.0, 50.0, 100.0, 100.0]).unwrap();
+    assert_eq!(images::page_images(&doc, 0).unwrap()[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let mut doc = reopen(&doc);
+    let moved = images::page_images(&doc, 0).unwrap();
+    assert_eq!(moved[0].rect, [50.0, 50.0, 150.0, 150.0]);
+    assert_eq!(moved[0].visible_rect, Some([50.0, 50.0, 100.0, 100.0]));
+
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "the image stays where it was");
+    assert_eq!(after[0].visible_rect, Some([50.0, 50.0, 150.0, 150.0]), "the crop is gone");
+}
+
+#[test]
+fn image_arrange_refuses_to_move_past_a_clip_it_is_not_under() {
+    // The text after the image is drawn under a top-level clip; moving the image after it would
+    // crop the image to that clip.
+    let content = "q 100 0 0 100 50 50 cm /Im0 Do Q 0 0 60 60 re W n BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let before = page_content_bytes(&doc, 0);
+    assert_eq!(images::page_images(&doc, 0).unwrap()[0].visible_rect, Some([50.0, 50.0, 150.0, 150.0]));
+
+    for order in [images::ArrangeOrder::BringToFront, images::ArrangeOrder::BringForward] {
+        let err = arrange(&mut doc, 0, 0, order).unwrap_err();
+        assert!(err.to_string().contains("clipping path"), "{err}");
+    }
+    assert_eq!(page_content_bytes(&doc, 0), before, "nothing changes");
+}
+
+#[test]
+fn image_arrange_send_to_back_keeps_a_shared_clip() {
+    // The image after the text is clipped by a top-level clip set before both; behind the text it
+    // is no longer under that clip, so the moved unit has to draw it itself.
+    let content = "BT /F1 12 Tf 72 700 Td (External Text) Tj ET 0 0 60 60 re W n q 100 0 0 100 50 50 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::SendToBack).unwrap();
+    let doc = reopen(&doc);
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    assert!(str_content.rfind("/Im0 Do").unwrap() < str_content.find("External Text").unwrap(), "the image moved behind the text");
+    assert_eq!(images::page_images(&doc, 0).unwrap()[0].visible_rect, Some([50.0, 50.0, 60.0, 60.0]), "still cropped to the clip");
+}
+
+#[test]
+fn unwrapped_image_moves_successfully() {
+    let content = "100 0 0 100 50 50 cm /Im0 Do BT /F1 12 Tf 72 700 Td (Middle Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    // Initial order: /Im0 Do precedes Middle Text
+    let initial_bytes = page_content_bytes(&doc, 0);
+    let initial_str = String::from_utf8_lossy(&initial_bytes);
+    let init_do = initial_str.find("/Im0 Do").unwrap();
+    let init_text = initial_str.find("Middle Text").unwrap();
+    assert!(init_do < init_text, "/Im0 Do initially precedes Middle Text");
+
+    // Move unwrapped image to front (past Middle Text)
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: /Im0 Do now follows Middle Text in the content stream AST
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let after_text = str_content.find("Middle Text").unwrap();
+    let after_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(after_text < after_do, "Position: /Im0 Do actually moved after Middle Text");
+
+    // 2. Appearance: image rect and visibility are unchanged
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: image coordinates preserved");
+    assert_eq!(after[0].visible_rect, Some([50.0, 50.0, 150.0, 150.0]));
+
+    // 3. Preservation: Middle Text and CTM remain intact
+    assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (Middle Text) Tj ET"), "Preservation: text operation preserved");
+    assert!(str_content.contains("100 0 0 100 50 50 cm"), "Preservation: original cm preserved");
+}
+
+#[test]
+fn test_arrange_unwrapped_image_extraction() {
+    let content = b"100 0 0 100 100 100 cm /Im0 Do /Im1 Do";
+    let ops = pdfcraft_content::parse(content).ops;
+    let target = ops.iter().position(|op| op.is("Do") && op.name(0) == Some(b"Im0")).expect("target /Im0 not found");
+
+    // Scope start for unwrapped image matches target because content_units isolates Do
+    let scope_start = target;
+
+    // Accumulate effective CTM prior to the image operation
+    let mut initial_ctm = pdfcraft_content::Matrix::IDENTITY;
+    for op in &ops[..target] {
+        if op.is("cm")
+            && let Some(m) = op.nums::<6>()
+        {
+            initial_ctm = pdfcraft_content::Matrix(m).then(&initial_ctm);
+        }
+    }
+    assert_eq!(initial_ctm, pdfcraft_content::Matrix([100.0, 0.0, 0.0, 100.0, 100.0, 100.0]));
+
+    let extracted = images::extract_scope_state(&ops, scope_start, target, initial_ctm)
+        .expect("extraction must not return Err")
+        .expect("extraction must return Some rather than None");
+
+    assert_eq!(extracted.do_op.op.as_slice(), b"Do");
+    assert_eq!(extracted.do_op.name(0), Some(b"Im0".as_slice()));
+}
+
+#[test]
+fn arrange_unwrapped_image_in_mixed_scope_succeeds() {
+    // Content unit contains text and an unwrapped image; scope extraction of unit fails on BT,
+    // so it safely falls back to extracting target Do directly.
+    let content = "q BT /F1 12 Tf 72 700 Td (Preceding Text) Tj ET 100 0 0 100 50 50 cm /Im0 Do Q BT /F1 12 Tf 72 500 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let text_pos = str_content.find("External Text").unwrap();
+    let do_pos = str_content.rfind("/Im0 Do").unwrap();
+    assert!(text_pos < do_pos, "moved image follows External Text");
+
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0]);
+}
+
+#[test]
+fn image_arrange_with_transformed_clipping_path_succeeds() {
+    // Nested graphics state: outer scope establishes a scaled clipping path (cm + path + W n),
+    // inner scope draws the image.
+    let content = "q 0.5 0 0 0.5 0 0 cm 100 100 m 300 100 l 300 300 l 100 300 l h W n q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let before = images::page_images(&doc, 0).unwrap();
+    assert_eq!(before.len(), 1);
+    assert!(before[0].visible_rect.is_some());
+    let rect_before = before[0].rect;
+    let clip_before = before[0].visible_rect;
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, rect_before);
+    assert_eq!(after[0].visible_rect, clip_before);
+
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let text_pos = str_content.find("External Text").unwrap();
+    let do_pos = str_content.rfind("/Im0 Do").unwrap();
+    assert!(text_pos < do_pos, "image moved after text: {str_content}");
+}
+
+#[test]
+fn inherited_source_opacity_is_preserved() {
+    // Outer q sets /GS0 gs; inner q draws /Im0 Do; outer Q restores state before External Text
+    let content = "q /GS0 gs q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    // Initial order: /Im0 Do precedes External Text
+    let initial_bytes = page_content_bytes(&doc, 0);
+    let initial_str = String::from_utf8_lossy(&initial_bytes);
+    let init_do = initial_str.find("/Im0 Do").unwrap();
+    let init_text = initial_str.find("External Text").unwrap();
+    assert!(init_do < init_text, "/Im0 Do initially precedes External Text");
+
+    // Move image to front (past External Text, outside its original outer q...Q scope)
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: /Im0 Do now follows External Text in the AST
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let after_text = str_content.find("External Text").unwrap();
+    let after_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(after_text < after_do, "Position: /Im0 Do moved past External Text");
+
+    // 2. Appearance: effective appearance state (/GS0 gs) is injected and precedes /Im0 Do in the new unit
+    let after_gs = str_content.rfind("/GS0 gs").unwrap();
+    assert!(after_text < after_gs, "Appearance: /GS0 gs injected into the new unit at destination");
+    assert!(after_gs < after_do, "Appearance: /GS0 gs directly precedes /Im0 Do in the moved unit");
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: rect preserved");
+
+    // 3. Preservation: External Text and original outer scope structure are preserved
+    assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (External Text) Tj ET"), "Preservation: external text preserved");
+}
+
+#[test]
+fn destination_opacity_pollution_is_prevented() {
+    // /Im0 Do is fully opaque at the start; destination has active top-level /GS_translucent gs
+    let content = "100 0 0 100 50 50 cm /Im0 Do /GS_translucent gs BT /F1 12 Tf 72 700 Td (Translucent Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial_bytes = page_content_bytes(&doc, 0);
+
+    // Attempting to move opaque image 0 to front into active transparency scope must safely bail out with Err
+    let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    assert!(res.is_err(), "must return an explicit Err rather than silently corrupting opacity");
+    let err_msg = res.unwrap_err().to_string();
+    assert!(err_msg.contains("unsupported graphics state"), "error describes unsupported graphics state: {err_msg}");
+
+    // Preservation: the document contents are completely unmodified
+    let doc = reopen(&doc);
+    let after_bytes = page_content_bytes(&doc, 0);
+    assert_eq!(initial_bytes, after_bytes, "Preservation: content stream remained completely unmodified");
+}
+
+#[test]
+fn sequential_gs_operators_merging_properties_are_preserved() {
+    // Sequential gs calls: /GSalpha sets ca=0.6, /GSblend sets BM=/Multiply (without touching ca).
+    let content = "q /GSalpha gs /GSblend gs q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 72 700 Td (External Text) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+    assert_eq!(initial[0].rect, [50.0, 50.0, 150.0, 150.0]);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+
+    // 1. Position: /Im0 Do now follows External Text in the AST
+    let bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&bytes);
+    let after_text = str_content.find("External Text").unwrap();
+    let after_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(after_text < after_do, "Position: /Im0 Do moved past External Text");
+
+    // 2. Appearance: Both merged state operators (/GSalpha and /GSblend) are preserved and precede /Im0 Do
+    let after_alpha = str_content.rfind("/GSalpha gs").unwrap();
+    let after_blend = str_content.rfind("/GSblend gs").unwrap();
+    assert!(after_text < after_alpha, "Appearance: /GSalpha gs injected into moved unit");
+    assert!(after_text < after_blend, "Appearance: /GSblend gs injected into moved unit");
+    assert!(after_alpha < after_do, "Appearance: /GSalpha gs precedes /Im0 Do");
+    assert!(after_blend < after_do, "Appearance: /GSblend gs precedes /Im0 Do");
+
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert_eq!(after[0].rect, [50.0, 50.0, 150.0, 150.0], "Appearance: rect preserved");
+
+    // 3. Preservation: External Text is intact
+    assert!(str_content.contains("BT /F1 12 Tf 72 700 Td (External Text) Tj ET"), "Preservation: external text preserved");
+}
+
+#[test]
+fn destination_differing_blend_mode_pollution_is_prevented() {
+    // /Im0 Do has default Normal blend mode; destination has active top-level /GSblend gs (BM = /Multiply)
+    let content = "100 0 0 100 50 50 cm /Im0 Do /GSblend gs BT /F1 12 Tf 72 700 Td (Blended Section) Tj ET";
+    let mut doc = image_page_with(content);
+    let initial_bytes = page_content_bytes(&doc, 0);
+
+    // Attempting to move Normal-blend image to front into active Multiply-blend scope must safely bail out with Err
+    let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    assert!(res.is_err(), "must return an explicit Err rather than silently altering blend mode");
+    let err_msg = res.unwrap_err().to_string();
+    assert!(err_msg.contains("unsupported graphics state"), "error describes unsupported graphics state: {err_msg}");
+
+    // Preservation: document contents are completely unmodified
+    let doc = reopen(&doc);
+    let after_bytes = page_content_bytes(&doc, 0);
+    assert_eq!(initial_bytes, after_bytes, "Preservation: content stream remained completely unmodified");
+}
+
+fn nested_soft_mask_page(content: &str) -> Document {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 100 100] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R /GroupA 9 0 R /GroupB 10 0 R >> /ExtGState << /GSA 7 0 R /GSB 8 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
+        "<< /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 9 0 R >> >>".into(),
+        "<< /Type /ExtGState /SMask << /Type /Mask /S /Alpha /G 10 0 R >> >>".into(),
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >>\nstream\n0 g 0 0 100 50 re f\nendstream".into(),
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >>\nstream\n0 g 0 0 50 100 re f\nendstream".into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+#[test]
+fn nested_soft_masks_replay_in_correct_order_and_effective_mask_is_rendered() {
+    let content = "q /GSA gs q /GSB gs 100 0 0 100 0 0 cm /Im0 Do Q Q BT /F1 12 Tf 10 90 Td (External Text) Tj ET";
+    let mut doc = nested_soft_mask_page(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 1);
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+
+    let content_bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&content_bytes);
+
+    // 1. Assert emitted stream order: outer /GSA gs must precede inner /GSB gs, which precedes /Im0 Do
+    let after_text = str_content.find("External Text").unwrap();
+    let after_a = str_content.rfind("/GSA gs").unwrap();
+    let after_b = str_content.rfind("/GSB gs").unwrap();
+    let after_do = str_content.rfind("/Im0 Do").unwrap();
+    assert!(after_text < after_a, "Position: /GSA gs relocated past external text");
+    assert!(after_a < after_b, "Order: outer /GSA gs must be replayed before inner /GSB gs");
+    assert!(after_b < after_do, "Order: inner /GSB gs must immediately precede /Im0 Do");
+
+    // 2. The image survives saving and reopening.
+    assert_eq!(images::page_images(&reopen(&doc), 0).unwrap().len(), 1);
+
+    // 3. Rendered-pixel assertion: render output and verify Mask B (left 50x100) is effective, not Mask A (bottom 100x50)
+    let pdf_bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes), pdfcraft_render::RenderConfig::default());
+    let page =
+        renderer.render(pdfcraft_render::RenderRequest { page: 0, kind: pdfcraft_render::RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    let px = |x: u32, y: u32| {
+        let idx = ((y * page.width + x) * 4) as usize;
+        page.rgba[idx..idx + 4].to_vec()
+    };
+    // Left half (inside Mask B): image is rendered black
+    assert_eq!(px(25, 25), vec![0, 0, 0, 255], "point (25, 25) is inside Mask B: image rendered");
+    assert_eq!(px(25, 75), vec![0, 0, 0, 255], "point (25, 75) is inside Mask B: image rendered");
+    // Right half (outside Mask B): masked out to white page background
+    assert_eq!(px(75, 25), vec![255, 255, 255, 255], "point (75, 25) is outside Mask B: masked out to white");
+    assert_eq!(px(75, 75), vec![255, 255, 255, 255], "point (75, 75) is outside Mask B: masked out to white");
+}
+
+#[test]
+fn destination_differing_mask_pollution_is_prevented() {
+    // /Im0 Do has no mask; destination has active top-level /GSA gs (Mask A)
+    let content = "100 0 0 100 0 0 cm /Im0 Do /GSA gs BT /F1 12 Tf 10 90 Td (Masked Section) Tj ET";
+    let mut doc = nested_soft_mask_page(content);
+    let initial_bytes = page_content_bytes(&doc, 0);
+
+    let res = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    assert!(res.is_err(), "must return an explicit Err rather than corrupting mask state");
+    let err_msg = res.unwrap_err().to_string();
+    assert!(err_msg.contains("unsupported graphics state"), "error describes unsupported graphics state: {err_msg}");
+
+    // Preservation: document contents are completely unmodified
+    let doc = reopen(&doc);
+    let after_bytes = page_content_bytes(&doc, 0);
+    assert_eq!(initial_bytes, after_bytes, "Preservation: content stream remained completely unmodified");
+}
+
+fn soft_mask_with_alpha_page(content: &str) -> Document {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R /GroupA 9 0 R >> /ExtGState << /GSA 7 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
+        "<< /Type /ExtGState /ca 0.25 /SMask << /Type /Mask /S /Alpha /G 9 0 R >> >>".into(),
+        "<< /Type /ExtGState /SMask /None >>".into(),
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 100 100] /Group << /S /Transparency /I true >> /Length 20 >>\nstream\n0 g 0 0 100 50 re f\nendstream".into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+#[test]
+fn non_identity_cm_before_gs_preserves_mask_coordinates_and_rendering() {
+    let content = "q 2 0 0 2 10 10 cm /GSA gs 50 0 0 50 0 0 cm /Im0 Do Q BT /F1 12 Tf 10 180 Td (External Text) Tj ET";
+    let mut doc = soft_mask_with_alpha_page(content);
+
+    // Initial state: image bounds are [10, 10, 110, 110]
+    let initial_images = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial_images.len(), 1);
+    assert!(close(initial_images[0].rect, [10.0, 10.0, 110.0, 110.0]));
+
+    // Render baseline before reordering
+    let pdf_bytes_before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let mut renderer_before = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes_before), pdfcraft_render::RenderConfig::default());
+    let page_before = renderer_before.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    let px_before = |x: u32, y: u32| {
+        let idx = ((y * page_before.width + x) * 4) as usize;
+        page_before.rgba[idx..idx + 4].to_vec()
+    };
+
+    // Arrange image: BringToFront
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+
+    let content_bytes = page_content_bytes(&doc, 0);
+    let str_content = String::from_utf8_lossy(&content_bytes);
+
+    // 1. Assert AST reordering succeeds and interleaves cm before gs
+    let text_pos = str_content.find("External Text").unwrap();
+    let cm_mask_pos = str_content.rfind("2 0 0 2 10 10 cm").unwrap();
+    let gs_pos = str_content.rfind("/GSA gs").unwrap();
+    let cm_img_pos = str_content.rfind("50 0 0 50 0 0 cm").unwrap();
+    let do_pos = str_content.rfind("/Im0 Do").unwrap();
+
+    assert!(text_pos < cm_mask_pos, "Image relocated after external text");
+    assert!(cm_mask_pos < gs_pos, "CTM for soft mask established before /GSA gs");
+    assert!(gs_pos < cm_img_pos, "/GSA gs executed before image cm");
+    assert!(cm_img_pos < do_pos, "image cm executed before /Im0 Do");
+
+    // 2. Assert image bounds remain unchanged after saving and reopening
+    let reopened_doc = reopen(&doc);
+    let reopened_images = images::page_images(&reopened_doc, 0).unwrap();
+    assert_eq!(reopened_images.len(), 1);
+    assert!(close(reopened_images[0].rect, [10.0, 10.0, 110.0, 110.0]), "Image bounds preserved: {:?}", reopened_images[0].rect);
+
+    // 3. Render reopened document and assert non-overlapping pixels remain unchanged
+    let pdf_bytes_after = write_incremental(&reopened_doc, &SaveOptions::default()).unwrap();
+    let mut renderer_after = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes_after), pdfcraft_render::RenderConfig::default());
+    let page_after = renderer_after.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    let px_after = |x: u32, y: u32| {
+        let idx = ((y * page_after.width + x) * 4) as usize;
+        page_after.rgba[idx..idx + 4].to_vec()
+    };
+
+    // A point inside the masked image (e.g. at x=50, inside the image and bottom half of mask)
+    // Non-overlapping with text (text is at y=180).
+    // The pixel renders at [191, 191, 191, 255] (25% black over 100% white).
+    // In raster coordinates, raster y for PDF y=50 in a 200-high page is y=150.
+    let rendered_pixel_before = px_before(50, 150);
+    let rendered_pixel_after = px_after(50, 150);
+    assert_eq!(rendered_pixel_before, vec![191, 191, 191, 255], "baseline pixel rendered with 25% opacity mask");
+    assert_eq!(rendered_pixel_after, rendered_pixel_before, "rendered non-overlapping pixels remain unchanged");
+
+    // Outside the image: pure white background
+    assert_eq!(px_after(5, 5), vec![255, 255, 255, 255]);
+    assert_eq!(px_after(5, 5), px_before(5, 5));
+}
+
 #[test]
 fn form_artwork_edits_only_the_selected_placement() {
     let mut doc = fixture(); // three pages share resources; pages 0 and 1 also share contents
@@ -4179,6 +5117,56 @@ fn the_graphics_state_carries_over_between_content_streams() {
     assert!(close(l.rect[0], 100.0) && close(l.size, 10.0), "{l:?}");
 }
 
+fn two_stream_image_page(first: &str, second: &str) -> Document {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents [4 0 R 5 0 R] /Resources << /Font << /F1 6 0 R >> /XObject << /Im0 7 0 R /Im1 7 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{first}\nendstream", first.len()),
+        format!("<< /Length {} >>\nstream\n{second}\nendstream", second.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 8 >>\nstream\n\0\0\0\0\0\0\0\0\nendstream".into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+#[test]
+fn arrange_and_crop_image_in_second_content_stream_succeeds() {
+    let first = "q 100 0 0 100 50 50 cm /Im0 Do Q";
+    let second = "q 100 0 0 100 200 200 cm /Im1 Do Q";
+    let mut doc = two_stream_image_page(first, second);
+    let before = images::page_images(&doc, 0).unwrap();
+    assert_eq!(before.len(), 2);
+    assert_eq!(before[0].name, "Im0");
+    assert_eq!(before[1].name, "Im1");
+
+    // Arrange second image (located in the second content stream)
+    arrange(&mut doc, 0, 1, images::ArrangeOrder::SendToBack).unwrap();
+    let after_arrange = images::page_images(&reopen(&doc), 0).unwrap();
+    assert_eq!(after_arrange.len(), 2);
+
+    // Crop image in second stream
+    crop(&mut doc, 0, 0, [210.0, 210.0, 290.0, 290.0]).unwrap();
+    let after_crop = images::page_images(&reopen(&doc), 0).unwrap();
+    assert_eq!(after_crop.len(), 2);
+    assert_eq!(after_crop[0].name, "Im1");
+    assert!(close(after_crop[0].visible_rect.unwrap(), [210.0, 210.0, 290.0, 290.0]));
+    assert_eq!(after_crop[1].name, "Im0");
+    assert_eq!(after_crop[1].visible_rect, Some(after_crop[1].rect));
+}
+
 /// One page whose font draws a few Hebrew letters (ToUnicode): A ב, B ד, C י, D ו, E ק, F ש,
 /// G ל, H ם. Content streams draw Hebrew in visual order, so "בדיוק" is `(EDCBA)`.
 fn hebrew_page(content: &str) -> Document {
@@ -7530,6 +8518,155 @@ fn reading_keeps_dotted_leader_entries_whole_and_in_order() {
     );
 }
 
+#[cfg(test)]
+mod proptests {
+    use super::*;
+    use proptest::prelude::*;
+
+    proptest! {
+
+        #[test]
+        fn prop_is_entire_page_wrapped_arbitrary_bytes(bytes in proptest::collection::vec(any::<u8>(), 0..2048)) {
+            let pieces = pdfcraft_content::Pieces::join(&[&bytes]);
+            let ops = pieces.parse().ops;
+            let _ = images::is_entire_page_wrapped(&ops);
+        }
+
+        #[test]
+        fn prop_content_units_arbitrary_bytes(
+            bytes in proptest::collection::vec(any::<u8>(), 0..2048),
+            start in 0usize..50,
+            end in 0usize..50,
+        ) {
+            let pieces = pdfcraft_content::Pieces::join(&[&bytes]);
+            let ops = pieces.parse().ops;
+            let scan_start = start.min(ops.len());
+            let scan_end = end.min(ops.len()).max(scan_start);
+            let units = images::content_units(&ops, scan_start, scan_end);
+            for u in units {
+                prop_assert!(u.start <= u.end);
+                prop_assert!(u.end <= ops.len());
+            }
+        }
+
+        #[test]
+        fn prop_arrange_image_arbitrary_malformed(
+            index in 0usize..10,
+            order_idx in 0u8..4,
+            bytes in proptest::collection::vec(any::<u8>(), 0..1024),
+        ) {
+            let order = match order_idx {
+                0 => images::ArrangeOrder::BringToFront,
+                1 => images::ArrangeOrder::SendToBack,
+                2 => images::ArrangeOrder::BringForward,
+                _ => images::ArrangeOrder::SendBackward,
+            };
+            let mut doc = image_page_with(&String::from_utf8_lossy(&bytes));
+            let _ = arrange(&mut doc, 0, index, order);
+        }
+
+        #[test]
+        fn prop_crop_image_malformed_inputs(
+            x1 in -500.0f64..500.0,
+            y1 in -500.0f64..500.0,
+            x2 in -500.0f64..500.0,
+            y2 in -500.0f64..500.0,
+            bytes in proptest::collection::vec(any::<u8>(), 0..1024),
+        ) {
+            let mut doc = image_page_with(&String::from_utf8_lossy(&bytes));
+            let _ = crop(&mut doc, 0, 0, [x1, y1, x2, y2]);
+            let _ = remove_crop(&mut doc, 0, 0);
+        }
+    }
+}
+
+/// One 600×800 page: Im0 (4×2 gray image), Fm0 (200×100 Form), ExtGState GSone (ca 1).
+fn regression_page(content: &str) -> Document {
+    let form = "0 g 0 0 200 100 re f";
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 600 800] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im0 6 0 R /Fm0 7 0 R >> /ExtGState << /GSone << /Type /ExtGState /ca 1 >> >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /XObject /Subtype /Image /Width 4 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 8 >>\nstream\n\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\nendstream".into(),
+        format!("<< /Type /XObject /Subtype /Form /BBox [0 0 200 100] /Length {} >>\nstream\n{form}\nendstream", form.len()),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offs = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offs.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let x = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offs {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{x}\n%%EOF\n", objs.len() + 1).as_bytes());
+    Document::open(Arc::new(out)).unwrap()
+}
+
+fn regression_rects(doc: &Document) -> Vec<[i64; 4]> {
+    let mut v: Vec<[i64; 4]> = images::page_images(doc, 0).unwrap().iter().map(|i| i.rect.map(|x| x.round() as i64)).collect();
+    v.sort();
+    v
+}
+
+/// A `cm` inside a BDC…EMC unit applies to later content; arranging the unit must not shift anything.
+#[test]
+fn arrange_keeps_cm_leaking_out_of_marked_content() {
+    let mut doc = regression_page("/Figure <</MCID 0>> BDC 1 0 0 1 50 50 cm q 100 0 0 100 0 0 cm /Im0 Do Q EMC q 10 0 0 10 200 200 cm /Im0 Do Q");
+    let before = regression_rects(&doc);
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    assert_eq!(before, regression_rects(&reopen(&doc)), "other content moved");
+}
+
+/// Cropping a Form XObject to 100×100 keeps a 100×100 visible area (or is refused) — never 1×1.
+#[test]
+fn crop_form_xobject_keeps_requested_area() {
+    let mut doc = regression_page("q 1 0 0 1 100 100 cm /Fm0 Do Q");
+    if crop(&mut doc, 0, 0, [100.0, 100.0, 200.0, 200.0]).is_err() {
+        return; // refusing to crop vector art is also acceptable
+    }
+    let after = images::page_images(&reopen(&doc), 0).unwrap()[0].clone();
+    let v = after.visible_rect.unwrap_or(after.rect);
+    assert!((v[2] - v[0] - 100.0).abs() < 1.0 && (v[3] - v[1] - 100.0).abs() < 1.0, "expected 100x100 visible, got {v:?}");
+}
+
+/// A gs naming a missing ExtGState must not be read as 50% opacity and block the reorder.
+#[test]
+fn arrange_tolerates_missing_extgstate() {
+    let mut doc = regression_page("q /GSmissing gs 100 0 0 100 50 50 cm /Im0 Do Q /GSone gs q 10 0 0 10 200 200 cm /Im0 Do Q");
+    let r = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront);
+    assert!(r.is_ok(), "{r:?}");
+}
+
+/// Bring to front on the image already in front must not report a change it didn't make.
+#[test]
+fn noop_arrange_is_not_ok_without_change() {
+    let mut doc = regression_page("q 10 0 0 10 200 200 cm /Im0 Do Q q 100 0 0 100 50 50 cm /Im0 Do Q");
+    let before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let r = arrange(&mut doc, 0, 1, images::ArrangeOrder::BringToFront);
+    let after = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    assert!(r.is_err() || before != after, "Ok with no change");
+}
+
+/// Cropping a turned image keeps the requested upright box in user space, rather than expanding
+/// to the bounding box of the turned image coordinates.
+#[test]
+fn crop_turned_image_preserves_requested_area() {
+    let mut doc = regression_page("q 70.71 70.71 -70.71 70.71 300 100 cm /Im0 Do Q");
+    let req = [270.0, 150.0, 330.0, 200.0];
+    crop(&mut doc, 0, 0, req).expect("crop succeeds");
+    let after = &images::page_images(&reopen(&doc), 0).unwrap()[0];
+    let v = after.visible_rect.expect("visible rect exists");
+    assert!((v[0] - req[0]).abs() < 1.0, "x0: expected {}, got {}", req[0], v[0]);
+    assert!((v[1] - req[1]).abs() < 1.0, "y0: expected {}, got {}", req[1], v[1]);
+    assert!((v[2] - req[2]).abs() < 1.0, "x1: expected {}, got {}", req[2], v[2]);
+    assert!((v[3] - req[3]).abs() < 1.0, "y1: expected {}, got {}", req[3], v[3]);
+}
+
 /// Text set larger than the widest page PDF allows (14 400 pt) panicked when its paragraph was given
 /// a width: the width is clamped between the font size and 14 400 pt, and `f64::clamp` panics when
 /// its minimum is the larger. The width is now capped at 14 400 pt whatever the font size: from the
@@ -7793,6 +8930,122 @@ fn a_flatten_refused_on_a_later_page_changes_nothing() {
     assert_eq!((*doc.get(first)).clone(), before, "the first page keeps its comment and content");
 }
 
+#[test]
+fn arrange_preserves_clip_leaked_out_of_marked_unit() {
+    let content = "/Figure <</MCID 0>> BDC 0 0 300 300 re W n q 10 0 0 10 50 50 cm /Im0 Do Q EMC q 10 0 0 10 400 400 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    let initial = images::page_images(&doc, 0).unwrap();
+    assert_eq!(initial.len(), 2);
+    assert!(initial[0].visible_rect.is_some());
+    assert!(initial[1].visible_rect.is_none(), "second image is fully clipped initially");
+
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 2);
+    let img1 = after.iter().find(|img| (img.rect[0] - 400.0).abs() < 1e-3).expect("second image exists");
+    assert!(img1.visible_rect.is_none(), "second image must stay clipped after BringToFront");
+
+    // Conflicting leaking transform with leaking clip must be refused
+    let content_cm_clip =
+        "/Figure <</MCID 0>> BDC 2 0 0 2 0 0 cm 0 0 300 300 re W n q 10 0 0 10 50 50 cm /Im0 Do Q EMC q 10 0 0 10 400 400 cm /Im0 Do Q";
+    let mut doc3 = image_page_with(content_cm_clip);
+    let res3 = arrange(&mut doc3, 0, 0, images::ArrangeOrder::BringToFront);
+    assert!(res3.is_err(), "moving marked unit with both leaking cm and leaking clip must be refused");
+}
+
+#[test]
+fn arrange_preserves_leaked_color_and_text_state() {
+    let content = "/Figure <</MCID 0>> BDC /DeviceRGB cs 1 0 0 sc /F1 14 Tf 2 Tc q 10 0 0 10 50 50 cm /Im0 Do Q EMC 0 0 10 10 re f q 10 0 0 10 200 200 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let doc = reopen(&doc);
+    let bytes = page_content_bytes(&doc, 0);
+    let s = String::from_utf8_lossy(&bytes);
+    assert!(s.contains("1 0 0 sc"), "sc must be preserved in content stream: {s}");
+    assert!(s.contains("/F1 14 Tf"), "Tf must be preserved in content stream: {s}");
+    assert!(s.contains("2 Tc"), "Tc must be preserved in content stream: {s}");
+
+    // Pixel test: 0 0 10 10 re f still fills red [255, 0, 0] after arrange
+    let pdf_bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(pdf_bytes), pdfcraft_render::RenderConfig::default());
+    let page =
+        renderer.render(pdfcraft_render::RenderRequest { page: 0, kind: pdfcraft_render::RequestKind::Pixels, scale: 1.0, ..Default::default() });
+    let idx = (((page.height - 5) * page.width + 5) * 4) as usize;
+    assert_eq!(page.rgba[idx..idx + 3], [255, 0, 0], "point (5, 5 from bottom) inside 10x10 rect fills red");
+}
+
+#[test]
+fn arrange_preserves_inherited_drawing_state_for_stencil_and_form() {
+    // 1. Stencil mask test:
+    // Page has: q 1 0 0 rg q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET
+    // Non-overlapping stencil and text.
+    let content = "q 1 0 0 rg q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET";
+    let mut doc = stencil_page_with(content);
+
+    // Render before move:
+    let pdf_before = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let mut renderer_before = pdfcraft_render::PageRenderer::new(Arc::new(pdf_before), pdfcraft_render::RenderConfig::default());
+    let page_before = renderer_before.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    let stencil_pixel_idx = (((page_before.height - 75) * page_before.width + 75) * 4) as usize;
+    assert_eq!(page_before.rgba[stencil_pixel_idx..stencil_pixel_idx + 3], [255, 0, 0], "stencil starts red");
+
+    // Bring to front
+    arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+
+    // Save and reopen
+    let doc = reopen(&doc);
+
+    // Verify content stream has inherited color
+    let bytes = page_content_bytes(&doc, 0);
+    let s = String::from_utf8_lossy(&bytes);
+    assert!(s.contains("1 0 0 rg"), "inherited 1 0 0 rg must be replayed in moved unit: {s}");
+
+    // Render after reopen and verify stencil remains red:
+    let pdf_after = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let mut renderer_after = pdfcraft_render::PageRenderer::new(Arc::new(pdf_after), pdfcraft_render::RenderConfig::default());
+    let page_after = renderer_after.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    assert_eq!(page_after.rgba[stencil_pixel_idx..stencil_pixel_idx + 3], [255, 0, 0], "stencil stays red after BringToFront and reopen");
+
+    // 2. Form XObject test:
+    // Page has: q 0 1 0 rg q 1 0 0 1 50 50 cm /Fm0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET
+    let form_content = "q 0 1 0 rg q 1 0 0 1 50 50 cm /Fm0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET";
+    let mut form_doc = form_page_with(form_content);
+
+    let form_pdf_before = write_incremental(&form_doc, &SaveOptions::default()).unwrap();
+    let mut form_renderer_before = pdfcraft_render::PageRenderer::new(Arc::new(form_pdf_before), pdfcraft_render::RenderConfig::default());
+    let form_page_before = form_renderer_before.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    let form_pixel_idx = (((form_page_before.height - 75) * form_page_before.width + 75) * 4) as usize;
+    assert_eq!(form_page_before.rgba[form_pixel_idx..form_pixel_idx + 3], [0, 255, 0], "form starts green");
+
+    arrange(&mut form_doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+    let form_doc = reopen(&form_doc);
+
+    let form_pdf_after = write_incremental(&form_doc, &SaveOptions::default()).unwrap();
+    let mut form_renderer_after = pdfcraft_render::PageRenderer::new(Arc::new(form_pdf_after), pdfcraft_render::RenderConfig::default());
+    let form_page_after = form_renderer_after.render(pdfcraft_render::RenderRequest {
+        page: 0,
+        kind: pdfcraft_render::RequestKind::Pixels,
+        scale: 1.0,
+        ..Default::default()
+    });
+    assert_eq!(form_page_after.rgba[form_pixel_idx..form_pixel_idx + 3], [0, 255, 0], "form stays green after BringToFront and reopen");
+}
 /// Existing-row alignment is explicitly refused without mutating the paragraph.
 #[test]
 fn one_row_of_a_paragraph_takes_its_own_alignment_is_refused_without_changing_the_document() {
@@ -8535,6 +9788,120 @@ fn a_run_of_spaces_in_a_subset_without_a_space_glyph_keeps_its_width() {
     assert_eq!(content.matches("[-330] TJ").count(), 5, "{content}");
 }
 
+#[test]
+fn image_exclusive_scope_resets_path_on_scope_exit() {
+    // An earlier scope has a path operation closed by Q (with 'h' closepath).
+    // The subsequent image in its own scope must cleanly extract and allow crop removal.
+    let content = "q 0 0 m 10 10 l h Q q 200 0 0 100 100 100 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    crop(&mut doc, 0, 0, [100.0, 100.0, 250.0, 180.0]).unwrap();
+    let before = images::page_images(&doc, 0).unwrap();
+    assert_eq!(before.len(), 1);
+    remove_crop(&mut doc, 0, 0).unwrap();
+}
+
+#[test]
+fn content_units_does_not_swallow_subsequent_units_on_standalone_gs() {
+    // /GS0 gs followed by Q and subsequent images must isolate each Do unit properly
+    let content = "q /GS0 gs Q q 200 0 0 100 100 100 cm /Im0 Do Q q 10 0 0 10 300 300 cm /Im0 Do Q";
+    let pieces = pdfcraft_content::Pieces::join(&[content.as_bytes()]);
+    let ops = pieces.parse().ops;
+    let units = images::content_units(&ops, 0, ops.len());
+    assert_eq!(units.len(), 2);
+}
+
+#[test]
+fn different_inline_soft_masks_have_distinct_identities() {
+    let doc = Document::new_empty();
+    let mut dict1 = Dict::default();
+    let mut mask1 = Dict::default();
+    mask1.set(b"Type".to_vec(), Object::Name(b"Mask1".to_vec()));
+    dict1.set(b"SMask".to_vec(), Object::Dict(mask1));
+
+    let mut dict2 = Dict::default();
+    let mut mask2 = Dict::default();
+    mask2.set(b"Type".to_vec(), Object::Name(b"Mask2".to_vec()));
+    dict2.set(b"SMask".to_vec(), Object::Dict(mask2));
+
+    let mut state1 = images::EffectiveGState::default();
+    state1.merge_dict(&dict1, &doc, pdfcraft_content::Matrix::IDENTITY);
+
+    let mut state2 = images::EffectiveGState::default();
+    state2.merge_dict(&dict2, &doc, pdfcraft_content::Matrix::IDENTITY);
+
+    assert!(state1.visually_differs(&state2), "two different inline soft masks must visually differ");
+}
+
+#[test]
+fn is_entire_page_wrapped_with_nested_scopes() {
+    let wrapped = "q 1 0 0 1 0 0 cm q 0 0 10 10 re f Q 200 0 0 100 100 100 cm /Im0 Do Q";
+    let pieces = pdfcraft_content::Pieces::join(&[wrapped.as_bytes()]);
+    let ops = pieces.parse().ops;
+    assert!(images::is_entire_page_wrapped(&ops), "page wrapped in outer q...Q with inner nested q...Q is wrapped");
+
+    let unwrapped = "q 1 0 0 1 0 0 cm Q q 200 0 0 100 100 100 cm /Im0 Do Q";
+    let pieces2 = pdfcraft_content::Pieces::join(&[unwrapped.as_bytes()]);
+    let ops2 = pieces2.parse().ops;
+    assert!(!images::is_entire_page_wrapped(&ops2), "page with two separate top-level q...Q scopes is not wrapped");
+}
+
+#[test]
+fn hostile_page_with_many_gs_and_nested_q_does_not_hang_or_oom() {
+    use std::fmt::Write as _;
+    let mut stream = String::new();
+    for i in 0..10_000 {
+        let _ = write!(stream, "/G{i} gs ");
+    }
+    for _ in 0..500 {
+        stream.push_str("q ");
+    }
+    stream.push_str("100 0 0 100 0 0 cm /Im0 Do ");
+    for _ in 0..500 {
+        stream.push_str("Q ");
+    }
+    let doc = image_page_with(&stream);
+    let start = std::time::Instant::now();
+    let imgs = images::page_images(&doc, 0).unwrap();
+    assert_eq!(imgs.len(), 1);
+    assert!(start.elapsed().as_secs() < 5, "page_images on hostile 10k gs must finish in under 5s, took {:?}", start.elapsed());
+}
+
+#[test]
+fn crop_image_with_leading_cm_in_scope_places_clip_before_internal_cm() {
+    let content = "q 10 0 0 10 50 50 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    let before = images::page_images(&doc, 0).unwrap();
+    assert_eq!(before.len(), 1);
+    crop(&mut doc, 0, 0, [50.0, 50.0, 55.0, 55.0]).unwrap();
+    let doc = reopen(&doc);
+    let after = images::page_images(&doc, 0).unwrap();
+    assert_eq!(after.len(), 1);
+    assert!(after[0].visible_rect.is_some());
+    let (v0, v1, v2, v3) =
+        (after[0].visible_rect.unwrap()[0], after[0].visible_rect.unwrap()[1], after[0].visible_rect.unwrap()[2], after[0].visible_rect.unwrap()[3]);
+    assert!((v0 - 50.0).abs() < 1e-3 && (v2 - 55.0).abs() < 1e-3, "visible rect must match crop coordinates: {:?}", after[0].visible_rect);
+    assert!((v1 - 50.0).abs() < 1e-3 && (v3 - 55.0).abs() < 1e-3, "visible rect must match crop coordinates: {:?}", after[0].visible_rect);
+}
+
+#[test]
+fn remove_crop_preserves_cm_before_extgstate() {
+    let content = "q 2 0 0 2 0 0 cm /GS0 gs 0 0 100 100 re W n 10 0 0 10 50 50 cm /Im0 Do Q";
+    let mut doc = image_page_with(content);
+    let before = images::page_images(&doc, 0).unwrap();
+    assert_eq!(before.len(), 1);
+    crop(&mut doc, 0, 0, [100.0, 100.0, 110.0, 110.0]).unwrap();
+    remove_crop(&mut doc, 0, 0).unwrap();
+    let doc = reopen(&doc);
+    let bytes = page_content_bytes(&doc, 0);
+    let s = String::from_utf8_lossy(&bytes);
+    assert!(s.contains("W n"), "the author clipping path must remain: {s}");
+    assert!(!s.contains("PdfCraftImageCrop"), "the editor crop must be removed: {s}");
+    // Verify that the initial cm appears before /GS0 gs
+    let cm_pos = s.find("2 0 0 2 0 0 cm").expect("cm must be preserved");
+    let gs_pos = s.find("/GS0 gs").expect("gs must be preserved");
+    assert!(cm_pos < gs_pos, "cm must precede /GS0 gs so soft mask space is preserved: {s}");
+}
+
 /// Inside a text object `q`/`Q` save and restore the text and text line matrices (ISO 32000-2
 /// §9.4.1, as corrected by the PDF Association's errata, issue 368), as the renderer does: the
 /// text after `Q` is found, and stays, where it is drawn.
@@ -8611,3 +9978,363 @@ fn styled_existing_justification_is_refused_instead_of_silently_left_aligning()
     assert_eq!(page_content_bytes(&doc, 0), before);
     assert_eq!(page_content_bytes(&reopen(&doc), 0), before);
 }
+
+#[test]
+fn image_arrange_refuses_crossed_scope_boundaries_without_changes() {
+    for content in ["/P <</MCID 0>> BDC q 10 0 0 10 0 0 cm /Im0 Do EMC Q /Im0 Do", "q /P <</MCID 0>> BDC /Im0 Do Q EMC /Im0 Do"] {
+        let mut doc = image_page_with(content);
+        let before = page_content_bytes(&doc, 0);
+        assert!(arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).is_err(), "{content}");
+        assert_eq!(page_content_bytes(&doc, 0), before);
+    }
+}
+
+#[test]
+fn removing_a_crop_preserves_author_clips_and_works_under_outer_clip() {
+    for content in ["0 0 300 300 re W n q 10 0 0 10 50 50 cm /Im0 Do Q", "q 50 50 8 8 re W n 10 0 0 10 50 50 cm /Im0 Do Q"] {
+        let mut doc = image_page_with(content);
+        let original = images::page_images(&doc, 0).unwrap()[0].clone();
+        crop(&mut doc, 0, 0, [52.0, 52.0, 55.0, 55.0]).unwrap();
+        let mut doc = reopen(&doc);
+        remove_crop(&mut doc, 0, 0).unwrap();
+        let mut doc = reopen(&doc);
+        let restored = images::page_images(&doc, 0).unwrap()[0].clone();
+        assert_eq!(restored.rect, original.rect);
+        assert_eq!(restored.visible_rect, original.visible_rect);
+        assert_eq!(restored.contains([59.0, 59.0]), original.contains([59.0, 59.0]));
+        assert!(remove_crop(&mut doc, 0, 0).is_err());
+    }
+}
+
+#[test]
+fn remove_crop_refuses_an_unmarked_author_clip_without_changes() {
+    let mut doc = image_page_with("q 50 50 8 8 re W n 10 0 0 10 50 50 cm /Im0 Do Q");
+    let before = page_content_bytes(&doc, 0);
+    assert!(remove_crop(&mut doc, 0, 0).is_err());
+    assert_eq!(page_content_bytes(&doc, 0), before);
+}
+
+#[test]
+fn arrange_refuses_unrestorable_extended_print_state() {
+    let mut unexpectedly_moved = Vec::new();
+    for (key, value) in [
+        ("TR", Object::name("Identity")),
+        ("TR2", Object::name("Default")),
+        ("OP", Object::Bool(true)),
+        ("op", Object::Bool(true)),
+        ("OPM", Object::Int(1)),
+        ("BG", Object::name("Default")),
+        ("BG2", Object::name("Default")),
+        ("UCR", Object::name("Default")),
+        ("UCR2", Object::name("Default")),
+        ("HT", Object::name("Default")),
+    ] {
+        let mut doc = image_page_with("q 100 0 0 100 50 50 cm /Im0 Do Q /Print gs BT /F1 12 Tf 20 700 Td (Text) Tj ET");
+        let page = pdfcraft_model::pages(&doc)[0].clone();
+        let mut resources = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().unwrap().clone();
+        resources.set(
+            b"ExtGState".to_vec(),
+            Object::Dict(Dict::from_iter([(b"Print".to_vec(), Object::Dict(Dict::from_iter([(key.as_bytes().to_vec(), value)])))])),
+        );
+        doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources))).unwrap();
+        let before = page_content_bytes(&doc, 0);
+        match arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront) {
+            Ok(()) => unexpectedly_moved.push(key),
+            Err(error) => {
+                assert!(error.to_string().contains("graphics state"), "{key}: {error}");
+                assert_eq!(page_content_bytes(&doc, 0), before, "{key} refusal changes nothing");
+            }
+        }
+    }
+    assert!(unexpectedly_moved.is_empty(), "unrestorable destination state was accepted: {unexpectedly_moved:?}");
+}
+
+#[test]
+fn arrange_keeps_implicit_device_spaces_before_sc_and_scn() {
+    for (select, color) in [("0 g", "0.5 sc"), ("0 0 0 rg", "1 0 0 sc"), ("0 0 0 1 k", "0 1 1 0 scn")] {
+        for stroke in [false, true] {
+            let (select, color) = if stroke { (select.to_uppercase(), color.to_uppercase()) } else { (select.into(), color.into()) };
+            for content in [
+                format!("q {select} {color} q 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET"),
+                format!("q {select} q {color} 100 0 0 100 50 50 cm /Im0 Do Q Q BT /F1 12 Tf 20 700 Td (Text) Tj ET"),
+            ] {
+                let mut doc = stencil_page_with(&content);
+                arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+                let doc = reopen(&doc);
+                let bytes = page_content_bytes(&doc, 0);
+                let ops = pdfcraft_content::parse(&bytes).ops;
+                let do_index = ops.iter().rposition(|op| op.is("Do")).unwrap();
+                let start = ops[..do_index].iter().rposition(|op| op.is("q")).unwrap();
+                let relocated = &ops[start..do_index];
+                let selector = select.split_whitespace().last().unwrap();
+                let color_op = color.split_whitespace().last().unwrap();
+                let space_index = relocated.iter().position(|op| op.is(selector));
+                let color_index = relocated.iter().position(|op| op.is(color_op));
+                assert!(
+                    space_index.is_some() && space_index < color_index,
+                    "{select} must select its device space before {color}: {}",
+                    String::from_utf8_lossy(&bytes)
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn arrange_restores_initial_rendering_intent_from_ri_and_gs() {
+    for selection in ["/Saturation ri", "/Print gs"] {
+        let mut doc = image_page_with(&format!("q 100 0 0 100 50 50 cm /Im0 Do Q {selection} BT /F1 12 Tf 20 700 Td (Text) Tj ET"));
+        let page = pdfcraft_model::pages(&doc)[0].clone();
+        let mut resources = doc.resolve(page.dict.get(b"Resources").unwrap()).as_dict().unwrap().clone();
+        resources.set(
+            b"ExtGState".to_vec(),
+            Object::Dict(Dict::from_iter([(b"Print".to_vec(), Object::Dict(Dict::from_iter([(b"RI".to_vec(), Object::name("Saturation"))])))])),
+        );
+        doc.update_dict(page.obj, |d| d.set(b"Resources".to_vec(), Object::Dict(resources))).unwrap();
+        arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        let doc = reopen(&doc);
+        let bytes = page_content_bytes(&doc, 0);
+        assert!(
+            String::from_utf8_lossy(&bytes).contains("/RelativeColorimetric ri"),
+            "default rendering intent must be restored after {selection}: {}",
+            String::from_utf8_lossy(&bytes)
+        );
+    }
+}
+
+#[test]
+fn editor_crop_moves_with_repeated_group_translation() {
+    let mut doc = image_page();
+    let caption_rect = text::text_lines(&doc, 0).unwrap()[0].rect;
+    crop(&mut doc, 0, 0, [150.0, 120.0, 250.0, 170.0]).unwrap();
+    let start = images::page_images(&doc, 0).unwrap()[0].clone();
+    let mut count = 0;
+    for iteration in 0..20 {
+        images::translate_images(&mut doc, 0, &[0], [1.0, -2.0]).unwrap();
+        let ops = pdfcraft_content::parse(&page_content_bytes(&doc, 0)).ops;
+        if iteration == 0 {
+            count = ops.len();
+        }
+        assert_eq!(ops.len(), count, "repeated moves fold the same transform");
+    }
+    let shifted = |r: [f64; 4]| [r[0] + 20.0, r[1] - 40.0, r[2] + 20.0, r[3] - 40.0];
+    let doc = reopen(&doc);
+    let after = &images::page_images(&doc, 0).unwrap()[0];
+    assert!(close(after.rect, shifted(start.rect)));
+    assert!(
+        close(after.visible_rect.unwrap(), shifted(start.visible_rect.unwrap())),
+        "the editor crop moves with its pixels: {:?}",
+        after.visible_rect
+    );
+    assert_eq!(text::text_lines(&doc, 0).unwrap()[0].text, "Caption");
+    assert_eq!(text::text_lines(&doc, 0).unwrap()[0].rect, caption_rect);
+}
+
+#[test]
+fn arranging_original_image_keeps_it_independent_of_added_items() {
+    for update in [false, true] {
+        let mut doc = image_page();
+        let caption_rect = text::text_lines(&doc, 0).unwrap()[0].rect;
+        add_content(
+            &mut doc,
+            0,
+            &Content::Text(AddedText { rect: [20.0, 250.0, 250.0, 290.0], text: "Added caption".into(), ..AddedText::default() }),
+        )
+        .unwrap();
+        arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        let mut doc = reopen(&doc);
+        assert_eq!(list_added(&doc).len(), 1, "the added item stays editable");
+        if update {
+            update_content(
+                &mut doc,
+                0,
+                0,
+                &Content::Text(AddedText { rect: [20.0, 250.0, 250.0, 290.0], text: "Updated caption".into(), ..AddedText::default() }),
+            )
+            .unwrap();
+        } else {
+            delete_content(&mut doc, 0, 0).unwrap();
+        }
+        let doc = reopen(&doc);
+        assert_eq!(images::page_images(&doc, 0).unwrap().len(), 1, "editing/deleting an added item must preserve arranged original artwork");
+        assert_eq!(images::page_images(&doc, 0).unwrap()[0].rect, [100.0, 100.0, 300.0, 200.0]);
+        let text = text::text_lines(&doc, 0).unwrap().into_iter().map(|line| line.text).collect::<Vec<_>>();
+        assert!(text.iter().any(|line| line == "Caption"), "the original caption survives");
+        assert_eq!(text.iter().any(|line| line == "Updated caption"), update);
+        assert_eq!(text::text_lines(&doc, 0).unwrap().iter().find(|line| line.text == "Caption").unwrap().rect, caption_rect);
+    }
+}
+
+#[test]
+fn arranging_nested_marked_image_refuses_without_losing_tags() {
+    for marked in ["/Figure <</MCID 3>> BDC", "/Figure BMC"] {
+        let mut doc = image_page_with(&format!(
+            "q {marked} 100 0 0 100 50 50 cm /Im0 Do EMC BT /F1 12 Tf 20 700 Td (Text) Tj ET Q BT /F1 12 Tf 20 720 Td (Outside) Tj ET"
+        ));
+        let before = page_content_bytes(&doc, 0);
+        let error = arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap_err();
+        assert!(error.to_string().contains("marked-content"), "{error}");
+        assert_eq!(page_content_bytes(&doc, 0), before);
+        assert_eq!(page_content_bytes(&reopen(&doc), 0), before);
+    }
+}
+
+#[test]
+fn editor_crop_group_move_keeps_an_outer_author_clip_fixed() {
+    let mut doc = image_page_with("0 0 220 300 re W n q 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 10 250 Td (Caption) Tj ET");
+    crop(&mut doc, 0, 0, [150.0, 120.0, 210.0, 170.0]).unwrap();
+    let mut operators = 0;
+    for i in 0..20 {
+        images::translate_images(&mut doc, 0, &[0], [1.0, -2.0]).unwrap();
+        let count = pdfcraft_content::parse(&page_content_bytes(&doc, 0)).ops.len();
+        if i == 0 {
+            operators = count;
+        }
+        assert_eq!(count, operators, "moves under an inherited clip must fold their transform");
+    }
+    let doc = reopen(&doc);
+    let image = &images::page_images(&doc, 0).unwrap()[0];
+    assert!(close(image.rect, [120.0, 60.0, 320.0, 160.0]));
+    assert!(
+        close(image.visible_rect.unwrap(), [170.0, 80.0, 220.0, 130.0]),
+        "the editor crop moves but its author's outer clip stays fixed: {:?}",
+        image.visible_rect
+    );
+    let bytes = page_content_bytes(&doc, 0);
+    assert!(String::from_utf8_lossy(&bytes).starts_with("0 0 220 300 re W n"));
+    assert_eq!(text::text_lines(&doc, 0).unwrap()[0].text, "Caption");
+}
+
+fn review_state_raster(doc: &Document) -> Vec<u8> {
+    let bytes = write_full(doc, &SaveOptions::default()).unwrap();
+    let mut renderer = pdfcraft_render::PageRenderer::new(Arc::new(bytes), Default::default());
+    renderer.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() }).rgba.to_vec()
+}
+
+#[test]
+fn review_arrange_form_keeps_inherited_text_spacing() {
+    for (spacing, later_spacing) in [(0, false), (12, false), (0, true)] {
+        let initial = if later_spacing { String::new() } else { format!("BT {spacing} Tc ET") };
+        let later = if later_spacing { "BT 12 Tc ET" } else { "" };
+        let content = format!("q {initial} q 1 0 0 1 20 20 cm /Fm0 Do Q Q {later} q 0 0 1 rg 200 200 5 5 re f Q");
+        let mut doc = form_page_with(&content);
+        let form = pdfcraft_cos::ObjRef::new(6, 0);
+        let dict = doc.get(form).as_dict().unwrap().clone();
+        doc.set(form, Object::Stream(pdfcraft_cos::Stream::from_raw(dict, b"BT /F1 20 Tf 0 15 Td (ABC) Tj ET".to_vec())));
+        let doc_before = reopen(&doc);
+        let before = review_state_raster(&doc_before);
+        assert!(before.as_chunks::<4>().0.iter().any(|p| p[0] == 0 && p[1] == 0 && p[2] == 0), "the Form actually paints text");
+        arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        let saved = reopen(&doc);
+        assert_eq!(images::page_images(&saved, 0).unwrap()[0].rect, images::page_images(&doc_before, 0).unwrap()[0].rect);
+        assert_eq!(review_state_raster(&saved), before, "inherited {spacing} Tc must survive arranging the Form and reopening");
+    }
+}
+
+fn review_shared_mask_page(states: &str, luminosity_b: bool, mask_paint: &str) -> Document {
+    let content = format!("q {states} q 100 0 0 100 20 20 cm /Im0 Do Q Q q 0 0 1 rg 200 200 5 5 re f Q");
+    let stream = format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len());
+    let subtype = if luminosity_b { "Luminosity" } else { "Alpha" };
+    let mask_b = format!("<< /Type /ExtGState /SMask << /S /{subtype} /G 8 0 R >> >>");
+    let group = format!(
+        "<< /Type /XObject /Subtype /Form /BBox [0 0 300 300] /Group << /S /Transparency /I true /CS /DeviceGray >> /Length {} >>\nstream\n{mask_paint}\nendstream",
+        mask_paint.len()
+    );
+    build(&[
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> /ExtGState << /A 6 0 R /B 7 0 R >> >> >>",
+        &stream,
+        "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\0\0\0\0\nendstream",
+        "<< /Type /ExtGState /SMask << /S /Alpha /G 8 0 R >> >>",
+        &mask_b,
+        &group,
+    ])
+}
+
+#[test]
+fn review_repeated_gs_keeps_alpha_vs_luminosity_mask_chronology() {
+    for states in ["/A gs", "/A gs /B gs", "/A gs /B gs /A gs"] {
+        let mut doc = review_shared_mask_page(states, true, "0.25 g 0 0 300 300 re f");
+        let before = review_state_raster(&reopen(&doc));
+        assert!(before.as_chunks::<4>().0.iter().any(|p| p[0] == p[1] && p[1] == p[2] && p[0] < 230), "the masked image is visible");
+        arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        assert_eq!(review_state_raster(&reopen(&doc)), before, "mask application order must survive: {states}");
+    }
+}
+
+#[test]
+fn review_repeated_gs_keeps_last_mask_establishment_ctm() {
+    for states in [
+        "1 0 0 1 50 0 cm /A gs 1 0 0 1 -50 0 cm",
+        "/A gs 1 0 0 1 50 0 cm /B gs 1 0 0 1 -50 0 cm",
+        "/A gs 1 0 0 1 50 0 cm /B gs 1 0 0 1 -50 0 cm /A gs",
+    ] {
+        let mut doc = review_shared_mask_page(states, false, "0.25 g 0 0 60 300 re f");
+        let before = review_state_raster(&reopen(&doc));
+        arrange(&mut doc, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        assert_eq!(review_state_raster(&reopen(&doc)), before, "mask CTM must survive: {states}");
+    }
+}
+
+#[test]
+fn review_soft_masks_sharing_a_group_keep_distinct_configurations() {
+    let doc = Document::new_empty();
+    let mask = |subtype: &str| {
+        Dict::from_iter([(
+            b"SMask".to_vec(),
+            Object::Dict(Dict::from_iter([(b"S".to_vec(), Object::name(subtype)), (b"G".to_vec(), Object::Ref(pdfcraft_cos::ObjRef::new(8, 0)))])),
+        )])
+    };
+    let mut alpha = images::EffectiveGState::default();
+    let mut luminosity = images::EffectiveGState::default();
+    alpha.merge_dict(&mask("Alpha"), &doc, pdfcraft_content::Matrix::IDENTITY);
+    luminosity.merge_dict(&mask("Luminosity"), &doc, pdfcraft_content::Matrix::IDENTITY);
+    assert!(alpha.visually_differs(&luminosity), "a shared group does not make Alpha and Luminosity the same mask");
+    for (key, value) in [
+        (b"BC".to_vec(), Object::Array(vec![Object::Real(0.5)])),
+        (
+            b"TR".to_vec(),
+            Object::Dict(Dict::from_iter([
+                (b"FunctionType".to_vec(), Object::Int(2)),
+                (b"Domain".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(1)])),
+                (b"N".to_vec(), Object::Int(2)),
+            ])),
+        ),
+    ] {
+        let mut changed = mask("Luminosity");
+        let Object::Dict(definition) = changed.get_mut(b"SMask").unwrap() else { panic!("mask dictionary") };
+        definition.set(key, value);
+        let mut state = images::EffectiveGState::default();
+        state.merge_dict(&changed, &doc, pdfcraft_content::Matrix::IDENTITY);
+        assert!(state.visually_differs(&luminosity), "mask backdrop and transfer function belong to its definition");
+    }
+}
+
+#[test]
+fn review_inside_scope_group_move_matches_direct_transform_under_outer_scale() {
+    for scale in [1, 2] {
+        let content = format!("{scale} 0 0 {scale} 0 0 cm q 40 0 0 40 10 10 cm /Im0 Do Q q 0 0 1 rg 75 75 5 5 re f Q");
+        let mut cropped = image_page_with(&content);
+        let keep = if scale == 2 { [30.0, 30.0, 70.0, 70.0] } else { [15.0, 15.0, 35.0, 35.0] };
+        crop(&mut cropped, 0, 0, keep).unwrap();
+        arrange(&mut cropped, 0, 0, images::ArrangeOrder::BringToFront).unwrap();
+        for offset in [[10.0, 0.0], [0.0, 10.0], [-10.0, 3.0]] {
+            let mut grouped = reopen(&cropped);
+            let mut direct = reopen(&cropped);
+            let before = images::page_images(&grouped, 0).unwrap()[0].clone();
+            images::translate_images(&mut grouped, 0, &[0], offset).unwrap();
+            images::change_image(&mut direct, 0, 0, &images::ImageChange::Transform([1.0, 0.0, 0.0, 1.0, offset[0], offset[1]])).unwrap();
+            let moved = |r: [f64; 4]| [r[0] + offset[0], r[1] + offset[1], r[2] + offset[0], r[3] + offset[1]];
+            let saved = reopen(&grouped);
+            let image = &images::page_images(&saved, 0).unwrap()[0];
+            assert!(close(image.rect, moved(before.rect)), "scale {scale} offset {offset:?}: {:?}", image.rect);
+            assert!(close(image.visible_rect.unwrap(), moved(before.visible_rect.unwrap())), "the crop follows the complete displacement");
+            assert_eq!(
+                review_state_raster(&saved),
+                review_state_raster(&reopen(&direct)),
+                "group and direct transforms must agree, preserving other artwork"
+            );
+        }
+    }
+}
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index fdceaa9b03..0fb00324b6 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -24,6 +24,7 @@ use crate::EditError;
 mod regions;
 #[path = "text_session.rs"]
 mod session;
+pub use fallback::strip_subset_tag;
 use regions::{alignment_frame, group_blocks, is_centred, rewrite_styled_block};
 pub use session::TextSession;
 
@@ -47,7 +48,7 @@ pub use editor::{TextEditLayout, TextEditorFont, register_text_font, text_edit_l
 pub(crate) use fallback::SOURCE_SPACE_CALLS;
 use fallback::{
     MAX_TYPE3_GLYPHS, Type3Glyph, fallback_face, needs_type3, no_fallback_font, no_glyph_for, same_base_font, same_font, source_encodes,
-    source_family, source_program, source_show, source_space, source_width, strip_subset_tag, type3_faces, type3_glyph, write_type3_glyphs,
+    source_family, source_program, source_show, source_space, source_width, type3_faces, type3_glyph, write_type3_glyphs,
 };
 #[cfg(test)]
 use fallback::{add_type3_font, is_type3_fallback};
diff --git a/crates/edit/src/text/fallback.rs b/crates/edit/src/text/fallback.rs
index b8f45a221f..78f9014a20 100644
--- a/crates/edit/src/text/fallback.rs
+++ b/crates/edit/src/text/fallback.rs
@@ -163,7 +163,7 @@ pub(crate) fn same_base_font(a: &str, b: &str) -> bool {
 }
 
 /// `ABCDEF+Arial` → `Arial`. A name without a subset tag is returned unchanged.
-pub(crate) fn strip_subset_tag(name: &str) -> &str {
+pub fn strip_subset_tag(name: &str) -> &str {
     let bytes = name.as_bytes();
     let is_tag = bytes.get(6) == Some(&b'+') && bytes.get(..6).is_some_and(|tag| tag.iter().all(u8::is_ascii_uppercase));
     if is_tag { name.get(7..).unwrap_or(name) } else { name }
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index fdee0bcf82..f5b924c921 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -19,6 +19,7 @@ pdfcraft-annot = { workspace = true }
 pdfcraft-forms = { workspace = true }
 pdfcraft-xfa = { workspace = true }
 pdfcraft-edit = { workspace = true }
+pdfcraft-content = { workspace = true }
 pdfcraft-audit = { workspace = true }
 pdfcraft-redact = { workspace = true }
 pdfcraft-print = { workspace = true }
diff --git a/crates/engine/src/copy_image.rs b/crates/engine/src/copy_image.rs
index b377903ee4..53b890f27c 100644
--- a/crates/engine/src/copy_image.rs
+++ b/crates/engine/src/copy_image.rs
@@ -18,9 +18,8 @@ impl Document {
     /// [`Document::page_images`]: a raster image, or Form artwork that holds one.
     pub fn page_image_at(&self, page: usize, at: [f64; 2]) -> Option<usize> {
         let editor = self.editor.as_ref()?;
-        let inside = |r: &[f64; 4]| (r[0]..=r[2]).contains(&at[0]) && (r[1]..=r[3]).contains(&at[1]);
         self.page_images(page).iter().rposition(|i| {
-            inside(&i.rect)
+            i.contains(at)
                 && match (i.is_form, i.object) {
                     (false, Some(_)) => true,
                     (true, Some(form)) => picture_in_form(&editor.cos, form).is_some(),
diff --git a/crates/engine/src/doc_state.rs b/crates/engine/src/doc_state.rs
index d28429de6f..91b33ad017 100644
--- a/crates/engine/src/doc_state.rs
+++ b/crates/engine/src/doc_state.rs
@@ -1,4 +1,4 @@
-use super::{Arc, EditError, Hidden, SignatureInfo, TrustStore, optimize};
+use super::{Arc, ArrangeOrder, EditError, Hidden, SignatureInfo, TrustStore, optimize};
 
 /// A change to an existing page image.
 #[derive(Clone, Debug, PartialEq)]
@@ -20,6 +20,12 @@ pub enum ImageEdit {
         bytes: Arc<Vec<u8>>,
     },
     Delete,
+    /// Affine transform [a, b, c, d, e, f] applied to the image's matrix.
+    Transform([f64; 6]),
+    /// Change the stacking order.
+    Arrange(ArrangeOrder),
+    /// Remove any private crop on the image.
+    RemoveCrop,
 }
 
 /// Forms ▸ Merge data files into spreadsheet: the field values of each file (FDF, XFDF or a
diff --git a/crates/engine/src/edit/labels.rs b/crates/engine/src/edit/labels.rs
index c3339453af..afc6056e85 100644
--- a/crates/engine/src/edit/labels.rs
+++ b/crates/engine/src/edit/labels.rs
@@ -111,10 +111,17 @@ pub const EDIT_LABELS: &[&str] = &[
     "Move object",
     "Move objects",
     "Move image",
+    "Transform image",
     "Rotate image",
+    "Crop image",
     "Flip image",
     "Replace image",
     "Delete image",
+    "Bring to front",
+    "Bring forward",
+    "Send backward",
+    "Send to back",
+    "Remove crop",
     "Add header & footer",
     "Update header & footer",
     "Add watermark",
@@ -254,11 +261,19 @@ impl Edit {
             Edit::MoveObjects { objects, .. } => plural("Move object", "Move objects", objects.len()),
             Edit::EditPageImage { change, .. } => Label::of(match change {
                 ImageEdit::Move(_) => "Move image",
+                ImageEdit::Transform(_) => "Transform image",
                 ImageEdit::Rotate(_) | ImageEdit::RotateBy(_) => "Rotate image",
                 ImageEdit::Crop(_) => "Crop image",
                 ImageEdit::Flip { .. } => "Flip image",
                 ImageEdit::Replace { .. } => "Replace image",
                 ImageEdit::Delete => "Delete image",
+                ImageEdit::Arrange(ord) => match ord {
+                    pdfcraft_edit::ArrangeOrder::BringToFront => "Bring to front",
+                    pdfcraft_edit::ArrangeOrder::BringForward => "Bring forward",
+                    pdfcraft_edit::ArrangeOrder::SendBackward => "Send backward",
+                    pdfcraft_edit::ArrangeOrder::SendToBack => "Send to back",
+                },
+                ImageEdit::RemoveCrop => "Remove crop",
             }),
             Edit::AddHeaderFooter { replace: false, .. } => Label::of("Add header & footer"),
             Edit::AddHeaderFooter { .. } => Label::of("Update header & footer"),
diff --git a/crates/engine/src/edit/run.rs b/crates/engine/src/edit/run.rs
index c6b1a7438b..5ed70aed7a 100644
--- a/crates/engine/src/edit/run.rs
+++ b/crates/engine/src/edit/run.rs
@@ -4,6 +4,7 @@ use super::{
 };
 use crate::SourceProblem;
 use crate::sources::{comment_source, import_pdf_comments};
+use pdfcraft_content::Matrix;
 
 /// Whether the opening password allows an edit (§7.6.4.2, Table 22).
 pub(crate) fn check_permission(edit: &Edit, p: &pdfcraft_cos::Permissions) -> Result<(), EditError> {
@@ -250,6 +251,169 @@ impl EditCtx {
     }
 }
 
+fn run_edit_page_image(doc: &mut pdfcraft_cos::Document, page: usize, index: usize, change: &ImageEdit) -> Result<(), EditError> {
+    match change {
+        ImageEdit::Move(to) if !to.iter().all(|v| v.is_finite()) => {
+            return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("invalid position".into())));
+        }
+        ImageEdit::Transform(t) => {
+            let [a, b, c, d, _, _] = *t;
+            let determinant = a * d - b * c;
+            if !t.iter().all(|v| v.is_finite()) || !determinant.is_finite() || determinant.abs() < 1e-9 {
+                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("the image transform must be finite and nonsingular".into())));
+            }
+        }
+        ImageEdit::Crop(keep) if !keep.iter().all(|v| v.is_finite()) => {
+            return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("invalid crop".into())));
+        }
+        _ => {}
+    }
+    let img = pdfcraft_edit::page_images(doc, page)?
+        .into_iter()
+        .nth(index)
+        .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} has no image {}", page + 1, index + 1))))?;
+    let c = match change {
+        ImageEdit::Move(to) => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::rect_to_rect(img.rect, *to)),
+        ImageEdit::Transform(t) => pdfcraft_edit::ImageChange::Transform(*t),
+        ImageEdit::Rotate(q) => {
+            pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(img.visible_rect.unwrap_or(img.rect), *q, false, false))
+        }
+        ImageEdit::RotateBy(degrees) => {
+            let t = pdfcraft_edit::turn_by_degrees(img.visible_rect.unwrap_or(img.rect), *degrees)
+                .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("the rotation angle must be a finite number".into())))?;
+            pdfcraft_edit::ImageChange::Transform(t)
+        }
+        ImageEdit::Flip { horizontal } => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(
+            img.visible_rect.unwrap_or(img.rect),
+            0,
+            *horizontal,
+            !*horizontal,
+        )),
+        ImageEdit::Replace { name, bytes } => {
+            if img.is_form {
+                return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("grouped Form artwork cannot be replaced with a bitmap".into())));
+            }
+            pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0)
+        }
+        ImageEdit::Crop(keep) => pdfcraft_edit::ImageChange::Crop(*keep),
+        ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
+        ImageEdit::Arrange(order) => pdfcraft_edit::ImageChange::Arrange(*order),
+        ImageEdit::RemoveCrop => pdfcraft_edit::ImageChange::RemoveCrop,
+    };
+    let page_model = pdfcraft_model::pages(doc)
+        .into_iter()
+        .nth(page)
+        .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} not found", page + 1))))?;
+    let target_stream_obj = match page_model.dict.get(b"Contents") {
+        None => None,
+        Some(c) => match &*doc.resolve(c) {
+            pdfcraft_cos::Object::Array(a) => a.get(img.stream).and_then(|o| o.as_ref()),
+            _ if img.stream == 0 => c.as_ref(),
+            _ => None,
+        },
+    };
+
+    let added_items: Vec<(usize, pdfcraft_edit::Added)> = pdfcraft_edit::list_added(doc).into_iter().filter(|a| a.page == page).enumerate().collect();
+    // Ownership belongs to the drawing stream, not the XObject: original and added images may
+    // show the same resource without sharing an editable item.
+    let shows_image = |a: &pdfcraft_edit::Added| img.object.is_some_and(|t| matches!(&a.content, AddedContent::Image(ai) if ai.image == t));
+    let matched_added = added_items.iter().find(|(_, a)| target_stream_obj == Some(a.obj) && (img.object.is_none() || shows_image(a)));
+
+    let mut ai_to_update = None;
+    if let Some((added_idx, added_item)) = matched_added
+        && let AddedContent::Image(ai) = added_item.content.clone()
+    {
+        let has_active_crop = ai.crop.iter().any(|v| v.abs() > 1e-6)
+            || img.visible_rect.is_some_and(|v| {
+                (v[0] - img.rect[0]).abs() > 1e-4
+                    || (v[1] - img.rect[1]).abs() > 1e-4
+                    || (v[2] - img.rect[2]).abs() > 1e-4
+                    || (v[3] - img.rect[3]).abs() > 1e-4
+            });
+        let non_axis_transform = matches!(change, ImageEdit::Transform([a, b, c, d, _, _])
+            if !((b.abs() < 1e-5 && c.abs() < 1e-5) || (a.abs() < 1e-5 && d.abs() < 1e-5)));
+        let should_promote = has_active_crop
+            || non_axis_transform
+            || matches!(change, ImageEdit::Crop(_) | ImageEdit::RemoveCrop | ImageEdit::RotateBy(_) | ImageEdit::Arrange(_) | ImageEdit::Delete);
+
+        if should_promote {
+            doc.update_dict(added_item.obj, |d| {
+                d.remove(b"PCAdded");
+                d.remove(b"PCMark");
+            })
+            .map_err(|e| EditError::Edit(pdfcraft_edit::EditError::Invalid(e.to_string())))?;
+        } else {
+            ai_to_update = Some((*added_idx, ai));
+        }
+    }
+
+    if let Some((added_idx, mut ai)) = ai_to_update {
+        let view = Matrix(page_model.view_matrix(doc));
+        let to_display = view.invert().ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("invalid page transform".into())))?;
+
+        match change {
+            ImageEdit::Move(to) => {
+                ai.rect = to_display.bbox(*to);
+                pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+            }
+            ImageEdit::Transform(_) | ImageEdit::Flip { .. } => {
+                let pdfcraft_edit::ImageChange::Transform(t) = c else {
+                    return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("expected transform".into())));
+                };
+                let t_display = view.then(&Matrix(t)).then(&to_display);
+                let [ta, tb, tc, td, _, _] = t_display.0;
+                let is_parallel = tb.abs() < 1e-5 && tc.abs() < 1e-5;
+                let is_perpendicular = ta.abs() < 1e-5 && td.abs() < 1e-5;
+
+                let (quarters_ccw, disp_flip_h, disp_flip_v) = if is_parallel {
+                    (0, ta < 0.0, td < 0.0)
+                } else if is_perpendicular {
+                    match (tb > 0.0, tc > 0.0) {
+                        (true, false) => (1, false, false),
+                        (false, true) => (3, false, false),
+                        (true, true) => (1, false, true),
+                        (false, false) => (1, true, false),
+                    }
+                } else {
+                    return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid(
+                        "non-axis-aligned transforms are not supported for added images".into(),
+                    )));
+                };
+                let (toggle_h, toggle_v) = if ai.rotation % 2 == 1 { (disp_flip_v, disp_flip_h) } else { (disp_flip_h, disp_flip_v) };
+                ai.flip_h ^= toggle_h;
+                ai.flip_v ^= toggle_v;
+                ai.rotation = (ai.rotation + quarters_ccw) % 4;
+                ai.rect = t_display.bbox(ai.rect);
+                pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+            }
+            ImageEdit::Rotate(q) => {
+                let k = ((4 - q.rem_euclid(4)) % 4) as u8;
+                ai.rotation = (ai.rotation + k) % 4;
+                let r = ai.rect;
+                let (cx, cy) = ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+                if k % 2 == 1 {
+                    let (w, h) = (r[2] - r[0], r[3] - r[1]);
+                    ai.rect = [cx - h / 2.0, cy - w / 2.0, cx + h / 2.0, cy + w / 2.0];
+                }
+                pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+            }
+            ImageEdit::Replace { .. } => {
+                let pdfcraft_edit::ImageChange::Replace(new_image) = c else {
+                    return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid("expected replace".into())));
+                };
+                ai.image = new_image;
+                pdfcraft_edit::update_content(doc, page, added_idx, &AddedContent::Image(ai))?;
+            }
+            ImageEdit::Crop(_) | ImageEdit::RemoveCrop | ImageEdit::RotateBy(_) | ImageEdit::Arrange(_) | ImageEdit::Delete => {
+                pdfcraft_edit::change_image(doc, page, index, &c)?;
+            }
+        }
+    } else {
+        pdfcraft_edit::change_image(doc, page, index, &c)?;
+    }
+    Ok(())
+}
+
 /// Perform an edit on a working copy (the caller discards it on error).
 pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut EditCtx) -> Result<(), EditError> {
     match edit {
@@ -525,40 +689,7 @@ pub(crate) fn run_edit(doc: &mut pdfcraft_cos::Document, edit: &Edit, cx: &mut E
         Edit::AddOcrText { page, words } => {
             pdfcraft_edit::stamp(doc, *page, "OCR", pdfcraft_ocr::text_layer(words))?;
         }
-        Edit::EditPageImage { page, index, change } => {
-            let img = pdfcraft_edit::page_images(doc, *page)?
-                .into_iter()
-                .nth(*index)
-                .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid(format!("page {} has no image {}", page + 1, index + 1))))?;
-            let c = match change {
-                ImageEdit::Move(to) => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::rect_to_rect(img.rect, *to)),
-                ImageEdit::Rotate(q) => {
-                    pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(img.visible_rect.unwrap_or(img.rect), *q, false, false))
-                }
-                ImageEdit::RotateBy(degrees) => {
-                    let t = pdfcraft_edit::turn_by_degrees(img.visible_rect.unwrap_or(img.rect), *degrees)
-                        .ok_or_else(|| EditError::Edit(pdfcraft_edit::EditError::Invalid("the rotation angle must be a finite number".into())))?;
-                    pdfcraft_edit::ImageChange::Transform(t)
-                }
-                ImageEdit::Flip { horizontal } => pdfcraft_edit::ImageChange::Transform(pdfcraft_edit::turn_about_centre(
-                    img.visible_rect.unwrap_or(img.rect),
-                    0,
-                    *horizontal,
-                    !*horizontal,
-                )),
-                ImageEdit::Replace { name, bytes } => {
-                    if img.is_form {
-                        return Err(EditError::Edit(pdfcraft_edit::EditError::Invalid(
-                            "grouped Form artwork cannot be replaced with a bitmap".into(),
-                        )));
-                    }
-                    pdfcraft_edit::ImageChange::Replace(embed_image(doc, name, bytes)?.0)
-                }
-                ImageEdit::Crop(keep) => pdfcraft_edit::ImageChange::Crop(*keep),
-                ImageEdit::Delete => pdfcraft_edit::ImageChange::Delete,
-            };
-            pdfcraft_edit::change_image(doc, *page, *index, &c)?;
-        }
+        Edit::EditPageImage { page, index, change } => run_edit_page_image(doc, *page, *index, change)?,
         Edit::MoveObjects { page, objects, offset } => pdfcraft_edit::move_objects(doc, *page, objects, *offset)?,
         Edit::EditTextBlock { page, block, text, style } => {
             pdfcraft_edit::rewrite_block(doc, *page, *block, Some(text), style)?;
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 0b49cfd4e1..fe139164be 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -54,6 +54,7 @@ mod stamp_preview;
 mod test_hooks;
 pub mod text_fonts;
 mod text_preview;
+pub mod text_script;
 pub mod text_style_bookmarks;
 pub mod word_count;
 pub mod xfa;
@@ -64,6 +65,7 @@ use std::sync::Arc;
 pub use links::{
     MAX_REMOTE_DOCUMENT_BYTES, RemoteDocumentPathError, read_remote_document, remote_document_path_is_absolute, resolve_remote_document_path,
 };
+pub use pdfcraft_edit::strip_subset_tag;
 pub use signature_image::{ImageSignaturePreview, SignatureImage};
 pub use signature_scan::{PhotoRect, ScanError, SignaturePhoto, Turn};
 pub use stamp_preview::{CommentLayer, StampPreview};
@@ -137,7 +139,7 @@ pub use history::Label;
 use layers::{apply_layer_state, set_default_layer_state, use_layer_choices};
 pub use open::{OpenContext, PreparedDocument};
 pub use page_filter::{PageOrientation, PageParity, filter_pages};
-pub use pictures::MarkFile;
+pub use pictures::{MarkFile, image_dimensions};
 use pictures::{embed_image, fit_picture, mark_source};
 use protection::unrestricted;
 pub use protection::{Changes, Printing, Protection, SecuritySummary};
@@ -154,6 +156,8 @@ use xfa_form::{
 mod clock;
 mod doc_state;
 
+pub use pdfcraft_edit::ArrangeOrder;
+
 use clock::{local_utc_offset, parse_ymd};
 pub use doc_state::{DocId, ImageEdit, OptimizeReport, RecoverySnapshot, SplitPart, guard, merge_data_files};
 use doc_state::{LOW_RESOLUTION_PRINT_DPI, render_threads, renderer_password, signatures_of, writable};
diff --git a/crates/engine/src/pictures.rs b/crates/engine/src/pictures.rs
index b29941720a..49d76f07c0 100644
--- a/crates/engine/src/pictures.rs
+++ b/crates/engine/src/pictures.rs
@@ -2,6 +2,8 @@
 
 use std::sync::Arc;
 
+use image::ImageDecoder;
+
 use crate::EditError;
 
 /// A picture for a watermark or background (Acrobat: Source ▸ File): an image, or `page`
@@ -57,3 +59,69 @@ pub(crate) fn mark_source(doc: &mut pdfcraft_cos::Document, f: &MarkFile) -> Res
         Ok(pdfcraft_edit::MarkSource { xobject, size, image: true })
     }
 }
+
+/// The dimensions of an image from its bytes (JPEG, PNG, TIFF), without decoding the full raster.
+pub fn image_dimensions(bytes: &[u8]) -> Option<(u32, u32)> {
+    let format = image::guess_format(bytes).ok()?;
+    let mut reader = image::ImageReader::with_format(std::io::Cursor::new(bytes), format);
+    let mut limits = image::Limits::default();
+    limits.max_alloc = Some(64_000_000 * 4);
+    reader.limits(limits);
+    let mut decoder = reader.into_decoder().ok()?;
+    let (mut w, mut h) = image::ImageDecoder::dimensions(&decoder);
+    if w == 0 || h == 0 {
+        return None;
+    }
+    if format == image::ImageFormat::Jpeg
+        && u64::from(w) * u64::from(h) <= (64 << 20)
+        && let Ok(orientation) = decoder.orientation()
+        && matches!(
+            orientation,
+            image::metadata::Orientation::Rotate90
+                | image::metadata::Orientation::Rotate270
+                | image::metadata::Orientation::Rotate90FlipH
+                | image::metadata::Orientation::Rotate270FlipH
+        )
+    {
+        std::mem::swap(&mut w, &mut h);
+    }
+    Some((w, h))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn phone_jpeg(w: u32, h: u32, orientation: u8) -> Vec<u8> {
+        use image::codecs::jpeg::JpegEncoder;
+        let mut jpeg = Vec::new();
+        let mut encoder = JpegEncoder::new(&mut jpeg);
+        encoder.encode_image(&image::RgbImage::from_pixel(w, h, image::Rgb([20, 20, 20]))).expect("valid jpeg");
+        let mut exif = b"Exif\0\0II\x2a\0\x08\0\0\0\x01\0\x12\x01\x03\0\x01\0\0\0".to_vec();
+        exif.extend_from_slice(&[orientation, 0, 0, 0, 0, 0, 0, 0]);
+        let mut out = jpeg[..2].to_vec();
+        out.extend_from_slice(&[0xff, 0xe1]);
+        out.extend_from_slice(&((exif.len() + 2) as u16).to_be_bytes());
+        out.extend_from_slice(&exif);
+        out.extend_from_slice(&jpeg[2..]);
+        out
+    }
+
+    #[test]
+    fn jpeg_exif_orientation_swaps_dimensions_for_quarter_turns() {
+        let turned_6 = phone_jpeg(60, 20, 6);
+        assert_eq!(image_dimensions(&turned_6), Some((20, 60)));
+
+        let turned_8 = phone_jpeg(60, 20, 8);
+        assert_eq!(image_dimensions(&turned_8), Some((20, 60)));
+
+        let upright_1 = phone_jpeg(60, 20, 1);
+        assert_eq!(image_dimensions(&upright_1), Some((60, 20)));
+    }
+
+    #[test]
+    fn invalid_inputs_return_none() {
+        assert_eq!(image_dimensions(&[]), None);
+        assert_eq!(image_dimensions(b"not an image"), None);
+    }
+}
diff --git a/crates/engine/src/session/editing.rs b/crates/engine/src/session/editing.rs
index 7758dc7c85..be7fd5aca5 100644
--- a/crates/engine/src/session/editing.rs
+++ b/crates/engine/src/session/editing.rs
@@ -8,6 +8,15 @@ use super::{
 };
 use crate::{EditNotice, MarkKind};
 
+/// Whether the edit, or any edit inside a batch, deletes pages.
+fn deletes_pages(edit: &Edit) -> bool {
+    match edit {
+        Edit::DeletePages { .. } => true,
+        Edit::Batch { edits, .. } => edits.iter().any(deletes_pages),
+        _ => false,
+    }
+}
+
 impl Session {
     /// Apply an edit. On success the previous state is undoable and the view data is refreshed.
     pub fn apply(&mut self, id: DocId, edit: Edit) -> Result<(), EditError> {
@@ -163,6 +172,11 @@ impl Session {
         // Signed documents are only ever saved incrementally: an edit that needs a full rewrite
         // (applying redactions, changing security, sanitizing) would invalidate the signatures.
         // So does any edit to a file rebuilt from object headers: it has no chain to append to.
+        // Deleted pages remain in earlier incremental revisions (#3407), so rewrite
+        // unsigned files in full. Signed files must retain their signed bytes.
+        if !signed && deletes_pages(&edit) {
+            next.require_full_save();
+        }
         let rewrites = |c: &pdfcraft_cos::Document| c.full_save_required() || c.encryption_changed();
         if signed && ((rewrites(&next) && !rewrites(&editor.cos)) || (next.is_modified() && next.revisions().is_empty())) {
             return Err(EditError::SignedRewrite(edit.label().to_string()));
@@ -399,6 +413,7 @@ impl Session {
                     | Edit::DeleteContent { .. }
                     | Edit::ReplaceImage { .. }
                     | Edit::PasteContent { .. }
+                    | Edit::EditPageImage { .. }
             ) || matches!(e, Edit::MoveObjects { objects, .. } if objects.iter().any(|o| o.kind == ObjectKind::Added))
         });
         let touches_marks = edit.is_none_or(|e| {
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index 9553a5d10b..4731c3f9ff 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -33,6 +33,39 @@ pub(crate) fn fixture(n: usize) -> Vec<u8> {
     out
 }
 
+fn fixture_with_rotation_and_user_unit(rotate: i64, user_unit: f64) -> Vec<u8> {
+    let mut objs: Vec<Vec<u8>> = vec![b"<< /Type /Catalog /Pages 2 0 R >>".to_vec()];
+    objs.push(b"<< /Type /Pages /Kids [4 0 R] /Count 1 /MediaBox [0 0 200 300] >>".to_vec());
+    objs.push(b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_vec());
+    let mut page_dict = String::from("<< /Type /Page /Parent 2 0 R /Contents 5 0 R /Resources << /Font << /F1 3 0 R >> >>");
+    if rotate != 0 {
+        page_dict.push_str(&format!(" /Rotate {rotate}"));
+    }
+    if (user_unit - 1.0).abs() > 1e-6 {
+        page_dict.push_str(&format!(" /UserUnit {user_unit}"));
+    }
+    page_dict.push_str(" >>");
+    objs.push(page_dict.into_bytes());
+    let body = "BT /F1 24 Tf 20 150 Td (Page 1) Tj ET";
+    objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()).into_bytes());
+
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
 fn session_with(n: usize) -> (Session, DocId) {
     let mut s = Session::new().with_clock(|| 1_700_000_000);
     let id = s.open("fixture.pdf", None, Arc::new(fixture(n)), None).expect("opens");
@@ -934,9 +967,10 @@ fn revert_preserves_the_saved_pages_after_undo() {
 #[test]
 fn full_save_is_readable_and_smaller_after_deletes() {
     let (mut s, id) = session_with(5);
+    let original = s.save_bytes(id).unwrap();
     s.apply(id, Edit::DeletePages { pages: vec![0, 1, 2] }).unwrap();
     let full = s.save_full_bytes(id).unwrap();
-    assert!(full.len() < s.save_bytes(id).unwrap().len());
+    assert!(full.len() < original.len());
     let mut s2 = Session::new();
     let id2 = s2.open("full.pdf", None, full, None).unwrap();
     assert_eq!(page_texts(&s2, id2), ["Page 4", "Page 5"]);
@@ -6158,24 +6192,27 @@ fn a_static_xfa_form_takes_many_data_values_as_one_by_one() {
 /// Opening a static XFA form whose datasets fill thousands of fields took minutes: each value
 /// read the whole form again (twice), so the time grew with the square of the fields. Eight
 /// times the fields now takes at most about eight times as long (it took about fifty).
+///
+/// Each round opens the small form and then the large one, so a busy spell on a shared machine
+/// slows both, and the best round's ratio is checked. Timing every small opening before the
+/// large ones let such a spell fall on the large ones alone.
 #[test]
 fn opening_a_static_xfa_form_grows_linearly_with_its_data_values() {
-    let time = |n: usize| {
-        let bytes = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(n));
-        (0..3)
-            .map(|_| {
-                let mut s = Session::new();
-                let start = std::time::Instant::now();
-                s.open("many.pdf", None, bytes.clone(), None).expect("opens");
-                start.elapsed()
-            })
-            .min()
-            .unwrap_or_default()
+    let small = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(100));
+    let large = Arc::new(pdfcraft_xfa::fixtures::static_shell_many(800));
+    let time = |bytes: &Arc<Vec<u8>>| {
+        let mut s = Session::new();
+        let start = std::time::Instant::now();
+        s.open("many.pdf", None, bytes.clone(), None).expect("opens");
+        start.elapsed()
     };
-    let small = time(100);
-    let large = time(800);
-    let ratio = large.as_secs_f64() / small.as_secs_f64().max(1e-6);
-    assert!(ratio < 16.0, "100 fields: {small:?}, 800 fields: {large:?} ({ratio:.1}x)");
+    // The first openings also pay for what the process sets up once.
+    time(&small);
+    time(&large);
+    let rounds: Vec<_> = (0..5).map(|_| (time(&small), time(&large))).collect();
+    let ratio = |(s, l): &(std::time::Duration, std::time::Duration)| l.as_secs_f64() / s.as_secs_f64().max(1e-6);
+    let best = rounds.iter().map(ratio).fold(f64::INFINITY, f64::min);
+    assert!(best < 16.0, "100 and 800 fields, by round: {rounds:?} (best {best:.1}x)");
 }
 
 /// A date goes into the XFA data in the field's data picture (`<bind><picture>`), as other
@@ -8101,6 +8138,13 @@ fn copy_image_finds_the_image_under_a_point_and_decodes_it_at_full_size() {
     assert_eq!((w, h), (3, 2));
     assert_eq!(rgba, px.into_raw());
     assert!(d.page_image_rgba(0, 1).is_err());
+
+    // When the image is cropped, page_image_at only hit-tests the visible cropped region:
+    let crop_keep = [r[0] + (r[2] - r[0]) * 0.25, r[1] + (r[3] - r[1]) * 0.25, r[0] + (r[2] - r[0]) * 0.75, r[1] + (r[3] - r[1]) * 0.75];
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop(crop_keep) }).unwrap();
+    let d = s.get(id).unwrap();
+    assert_eq!(d.page_image_at(0, [(r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0]), Some(0));
+    assert_eq!(d.page_image_at(0, [r[0] + 0.1, r[1] + 0.1]), None, "cropped-away corner must not hit-test positive");
 }
 
 /// Copy Image: a JPEG drawn through grouped Form artwork (as Word, InDesign and scanners write
@@ -9297,6 +9341,474 @@ fn a_page_truncated_for_forms_and_pictures_is_listed_once() {
     assert_eq!(truncated, [0]);
 }
 
+/// Moving an added image, then rotating it, must keep the moved position.
+#[test]
+fn added_image_move_then_rotate_keeps_position() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+    let rect = |s: &Session| s.get(id).unwrap().page_images(0)[0].rect;
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([120.0, 120.0, 160.0, 160.0]) }).unwrap();
+    let moved = rect(&s);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+    let rotated = rect(&s);
+    let c = |r: [f64; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+    let (a, b) = (c(moved), c(rotated));
+    assert!((a.0 - b.0).abs() < 1.0 && (a.1 - b.1).abs() < 1.0, "rotate moved the centre from {a:?} to {b:?}");
+}
+
+/// Transforming an added image, then rotating it, must keep the moved position.
+#[test]
+fn added_image_transform_then_rotate_keeps_position() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+    let rect = |s: &Session| s.get(id).unwrap().page_images(0)[0].rect;
+    // Translate by (100, 100): matrix [1, 0, 0, 1, 100, 100]
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, 1.0, 100.0, 100.0]) }).unwrap();
+    let transformed = rect(&s);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+    let rotated = rect(&s);
+    let c = |r: [f64; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+    let (a, b) = (c(transformed), c(rotated));
+    assert!((a.0 - b.0).abs() < 1.0 && (a.1 - b.1).abs() < 1.0, "rotate moved the centre from {a:?} to {b:?}");
+}
+
+/// Moving an added image, then rotating by degrees, must keep the moved position.
+#[test]
+fn added_image_move_then_rotate_by_keeps_position() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+    let rect = |s: &Session| s.get(id).unwrap().page_images(0)[0].rect;
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([120.0, 120.0, 160.0, 160.0]) }).unwrap();
+    let moved = rect(&s);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::RotateBy(90.0) }).unwrap();
+    let rotated = rect(&s);
+    let c = |r: [f64; 4]| ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+    let (a, b) = (c(moved), c(rotated));
+    assert!((a.0 - b.0).abs() < 1.0 && (a.1 - b.1).abs() < 1.0, "rotate_by moved the centre from {a:?} to {b:?}");
+}
+
+/// Arranging an added image moves it into the document stream and converts it to an ordinary
+/// page image (dropping the PCAdded marker), so no empty shell remains in list_added.
+#[test]
+fn added_image_arrange_converts_to_ordinary_image() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "p1.png".into(), bytes: Arc::new(png.clone()) }).unwrap();
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([100.0, 100.0, 200.0, 200.0]), name: "p2.png".into(), bytes: Arc::new(png) }).unwrap();
+    assert_eq!(s.get(id).unwrap().page_images(0).len(), 2);
+    assert_eq!(s.get(id).unwrap().added().len(), 2);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 1, change: ImageEdit::Arrange(ArrangeOrder::SendToBack) }).unwrap();
+    assert_eq!(s.get(id).unwrap().page_images(0).len(), 2);
+    assert_eq!(s.get(id).unwrap().added().len(), 1, "arranged image is converted and no longer an added-item shell");
+}
+
+#[test]
+fn added_image_crop_then_move_keeps_crop() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 100.0, 100.0]), name: "p.png".into(), bytes: Arc::new(png) }).unwrap();
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop([30.0, 30.0, 70.0, 70.0]) }).unwrap();
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([50.0, 50.0, 130.0, 130.0]) }).unwrap();
+    let img = s.get(id).unwrap().page_images(0)[0].clone();
+    assert_eq!(img.visible_rect, Some([60.0, 60.0, 100.0, 100.0]));
+}
+
+#[test]
+fn added_image_move_and_transform_on_rotated_and_user_unit_pages() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 2, 2);
+        enc.set_color(png::ColorType::Rgb);
+        enc.write_header().unwrap().write_image_data(&[255u8; 12]).unwrap();
+    }
+    let png_bytes = Arc::new(png);
+
+    let cases = [(90, 1.0), (180, 1.0), (270, 1.0), (0, 2.0), (90, 2.0)];
+
+    for (rotate, user_unit) in cases {
+        let pdf = fixture_with_rotation_and_user_unit(rotate, user_unit);
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        let id = s.open("test.pdf", None, Arc::new(pdf), None).expect("opens");
+
+        s.apply(id, Edit::AddImage { page: 0, rect: Some([10.0, 10.0, 50.0, 50.0]), name: "img.png".into(), bytes: png_bytes.clone() }).unwrap();
+
+        // Target user-space rectangle R
+        let r = [30.0, 40.0, 80.0, 90.0];
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move(r) }).unwrap();
+
+        let painted = s.get(id).unwrap().page_images(0)[0].rect;
+        for i in 0..4 {
+            assert!(
+                (painted[i] - r[i]).abs() < 1e-3,
+                "Move: rotate={rotate}, user_unit={user_unit}: painted[{i}] = {}, expected {}",
+                painted[i],
+                r[i]
+            );
+        }
+
+        let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+        let added = pdfcraft_edit::list_added(&cos);
+        assert_eq!(added.len(), 1);
+        let stream_obj = match &*cos.get(added[0].obj) {
+            pdfcraft_cos::Object::Stream(s) => s.clone(),
+            other => panic!("expected stream, got {other:?}"),
+        };
+        let pc_rect = stream_obj
+            .dict
+            .get(b"PCAdded")
+            .and_then(|o| cos.resolve(o).as_dict().cloned())
+            .and_then(|d| d.get(b"Rect").cloned())
+            .and_then(|o| cos.resolve(&o).as_array().cloned())
+            .unwrap();
+        let pc_box: [f64; 4] =
+            [pc_rect[0].as_f64().unwrap(), pc_rect[1].as_f64().unwrap(), pc_rect[2].as_f64().unwrap(), pc_rect[3].as_f64().unwrap()];
+        let content = String::from_utf8(stream_obj.decoded().unwrap()).unwrap();
+        let re_idx = content.find(" re W n").expect("re W n in content stream");
+        let prefix = &content[..re_idx];
+        let nums: Vec<f64> =
+            prefix.split_whitespace().rev().take(4).collect::<Vec<_>>().into_iter().rev().map(|val| val.parse::<f64>().unwrap()).collect();
+        assert_eq!(nums.len(), 4);
+        let (rx, ry, rw, rh) = (nums[0], nums[1], nums[2], nums[3]);
+        assert!((rx - pc_box[0]).abs() < 1e-3, "re x {rx} != pc_box[0] {}", pc_box[0]);
+        assert!((ry - pc_box[1]).abs() < 1e-3, "re y {ry} != pc_box[1] {}", pc_box[1]);
+        assert!((rw - (pc_box[2] - pc_box[0])).abs() < 1e-3, "re w {rw} != {}", pc_box[2] - pc_box[0]);
+        assert!((rh - (pc_box[3] - pc_box[1])).abs() < 1e-3, "re h {rh} != {}", pc_box[3] - pc_box[1]);
+
+        // Transform test: user-space translation by (10, 10)
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, 1.0, 10.0, 10.0]) }).unwrap();
+
+        let expected_transformed = [r[0] + 10.0, r[1] + 10.0, r[2] + 10.0, r[3] + 10.0];
+        let painted_transformed = s.get(id).unwrap().page_images(0)[0].rect;
+        for i in 0..4 {
+            assert!(
+                (painted_transformed[i] - expected_transformed[i]).abs() < 1e-3,
+                "Transform: rotate={rotate}, user_unit={user_unit}: painted[{i}] = {}, expected {}",
+                painted_transformed[i],
+                expected_transformed[i]
+            );
+        }
+    }
+}
+
+#[test]
+fn replace_on_added_image_replaces_xobject_and_undo_restores() {
+    let make_png = |rgb: [u8; 3]| {
+        let mut png = Vec::new();
+        {
+            let mut enc = png::Encoder::new(&mut png, 2, 2);
+            enc.set_color(png::ColorType::Rgb);
+            let data = [rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2]];
+            enc.write_header().unwrap().write_image_data(&data).unwrap();
+        }
+        Arc::new(png)
+    };
+    let png1 = make_png([255, 0, 0]);
+    let png2 = make_png([0, 0, 255]);
+
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([20.0, 20.0, 60.0, 60.0]), name: "img1.png".into(), bytes: png1 }).unwrap();
+
+    let old_obj = s.get(id).unwrap().page_images(0)[0].object.expect("initial image object ref");
+
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Replace { name: "img2.png".into(), bytes: png2 } }).unwrap();
+
+    let new_obj = s.get(id).unwrap().page_images(0)[0].object.expect("new image object ref");
+    assert_ne!(new_obj, old_obj, "after Replace the page references the new XObject");
+
+    s.undo(id).unwrap();
+
+    let restored_obj = s.get(id).unwrap().page_images(0)[0].object.expect("restored image object ref");
+    assert_eq!(restored_obj, old_obj, "undo restores the old XObject");
+
+    // Also test replacement on an image with active crop (promoted path)
+    let png3 = make_png([0, 255, 0]);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Crop([25.0, 25.0, 55.0, 55.0]) }).unwrap();
+    let crop_obj = s.get(id).unwrap().page_images(0)[0].object.expect("crop image object ref");
+    assert_eq!(crop_obj, old_obj);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Replace { name: "img3.png".into(), bytes: png3 } }).unwrap();
+    let promoted_new_obj = s.get(id).unwrap().page_images(0)[0].object.expect("promoted replace object ref");
+    assert_ne!(promoted_new_obj, crop_obj);
+    s.undo(id).unwrap();
+    assert_eq!(s.get(id).unwrap().page_images(0)[0].object.expect("undo promoted replace"), crop_obj);
+}
+
+#[test]
+fn mirroring_transform_on_added_image_flips_and_non_finite_is_refused() {
+    let make_png = |rgb: [u8; 3]| {
+        let mut png = Vec::new();
+        {
+            let mut enc = png::Encoder::new(&mut png, 2, 2);
+            enc.set_color(png::ColorType::Rgb);
+            let data = [rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2]];
+            enc.write_header().unwrap().write_image_data(&data).unwrap();
+        }
+        Arc::new(png)
+    };
+    let png1 = make_png([255, 0, 0]);
+
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([0.0, 0.0, 80.0, 40.0]), name: "img1.png".into(), bytes: png1 }).unwrap();
+
+    let initial_img = s.get(id).unwrap().page_images(0)[0].clone();
+    assert_eq!(initial_img.rect, [0.0, 0.0, 80.0, 40.0]);
+    assert!(initial_img.matrix[0] > 0.0, "initially unflipped");
+
+    // Mirroring transform: [-1.0, 0.0, 0.0, 1.0, 80.0, 0.0]
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([-1.0, 0.0, 0.0, 1.0, 80.0, 0.0]) }).unwrap();
+
+    let flipped_img = s.get(id).unwrap().page_images(0)[0].clone();
+    assert!(flipped_img.matrix[0] < 0.0, "horizontal mirror flips matrix x-axis, got matrix: {:?}", flipped_img.matrix);
+
+    let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let added = pdfcraft_edit::list_added(&cos);
+    assert_eq!(added.len(), 1);
+    let AddedContent::Image(ai) = &added[0].content else { panic!("expected added image") };
+    assert!(ai.flip_h, "PCAdded record must have flip_h = true");
+
+    // Mirroring horizontally again flips it back
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([-1.0, 0.0, 0.0, 1.0, 80.0, 0.0]) }).unwrap();
+    let unflipped_img = s.get(id).unwrap().page_images(0)[0].clone();
+    assert!(unflipped_img.matrix[0] > 0.0, "double horizontal mirror restores positive x-axis");
+    let cos2 = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let AddedContent::Image(ai2) = &pdfcraft_edit::list_added(&cos2)[0].content else { panic!("expected added image") };
+    assert!(!ai2.flip_h, "PCAdded record must have flip_h = false");
+
+    // Mirroring vertically: [1.0, 0.0, 0.0, -1.0, 0.0, 40.0]
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, -1.0, 0.0, 40.0]) }).unwrap();
+    let v_flipped_img = s.get(id).unwrap().page_images(0)[0].clone();
+    assert!(v_flipped_img.matrix[3] < 0.0, "vertical mirror flips matrix y-axis, got matrix: {:?}", v_flipped_img.matrix);
+    let cos3 = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let AddedContent::Image(ai3) = &pdfcraft_edit::list_added(&cos3)[0].content else { panic!("expected added image") };
+    assert!(ai3.flip_v, "PCAdded record must have flip_v = true");
+
+    // Non-finite transform must be refused with error
+    let res = s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([f64::NAN, 0.0, 0.0, 1.0, 0.0, 0.0]) });
+    assert!(res.is_err(), "NaN transform must be refused");
+
+    let res_inf = s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.0, 0.0, f64::INFINITY, 0.0, 0.0]) });
+    assert!(res_inf.is_err(), "infinite transform must be refused");
+
+    let res_move = s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([f64::NAN, 20.0, 100.0, 60.0]) });
+    assert!(res_move.is_err(), "NaN position must be refused");
+}
+
+#[test]
+fn transform_on_added_image_folds_quarter_turns_and_promotes_non_axis_aligned() {
+    let make_png = |rgb: [u8; 3]| {
+        let mut png = Vec::new();
+        {
+            let mut enc = png::Encoder::new(&mut png, 2, 2);
+            enc.set_color(png::ColorType::Rgb);
+            let data = [rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2], rgb[0], rgb[1], rgb[2]];
+            enc.write_header().unwrap().write_image_data(&data).unwrap();
+        }
+        Arc::new(png)
+    };
+    let png1 = make_png([0, 128, 255]);
+
+    let (mut s, id) = session_with(1);
+    s.apply(id, Edit::AddImage { page: 0, rect: Some([100.0, 100.0, 200.0, 150.0]), name: "img.png".into(), bytes: png1 }).unwrap();
+
+    // 1. A pure 90° clockwise rotation matrix about the image centre:
+    let rot_90_cw = pdfcraft_edit::turn_about_centre([100.0, 100.0, 200.0, 150.0], 1, false, false);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(rot_90_cw) }).unwrap();
+
+    let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let added = pdfcraft_edit::list_added(&cos);
+    assert_eq!(added.len(), 1, "stays as PCAdded image");
+    let AddedContent::Image(ai) = &added[0].content else { panic!("expected added image") };
+    assert_eq!(ai.rotation, 3, "quarter turn clockwise folds into ai.rotation = 3 (270° CCW)");
+    // Centre is (150, 125); rotated width=50, height=100 -> [125, 75, 175, 175]
+    assert!((ai.rect[0] - 125.0).abs() < 1e-4);
+    assert!((ai.rect[1] - 75.0).abs() < 1e-4);
+    assert!((ai.rect[2] - 175.0).abs() < 1e-4);
+    assert!((ai.rect[3] - 175.0).abs() < 1e-4);
+
+    // 2. A pure 90° counter-clockwise rotation matrix:
+    let rot_90_ccw = pdfcraft_edit::turn_about_centre(ai.rect, 3, false, false);
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(rot_90_ccw) }).unwrap();
+
+    let cos2 = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    let AddedContent::Image(ai2) = &pdfcraft_edit::list_added(&cos2)[0].content else { panic!("expected added image") };
+    assert_eq!(ai2.rotation, 0, "quarter turn counter-clockwise restores ai.rotation = 0");
+    assert!((ai2.rect[0] - 100.0).abs() < 1e-4);
+    assert!((ai2.rect[1] - 100.0).abs() < 1e-4);
+    assert!((ai2.rect[2] - 200.0).abs() < 1e-4);
+    assert!((ai2.rect[3] - 150.0).abs() < 1e-4);
+
+    // Arbitrary transforms promote the added image, just like RotateBy.
+    let initial_matrix = s.get(id).unwrap().page_images(0)[0].matrix;
+    let rot_45 = pdfcraft_edit::turn_by_degrees([100.0, 100.0, 200.0, 150.0], 45.0).unwrap();
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(rot_45) }).unwrap();
+    let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    assert!(pdfcraft_edit::list_added(&cos).is_empty(), "arbitrary transform promotes the image");
+    assert_eq!(s.get(id).unwrap().page_images(0).len(), 1);
+    let expected = pdfcraft_content::Matrix(initial_matrix).then(&pdfcraft_content::Matrix(rot_45)).0;
+    let actual = s.get(id).unwrap().page_images(0)[0].matrix;
+    assert!(actual.into_iter().zip(expected).all(|(a, b)| (a - b).abs() < 1e-3), "{actual:?} != {expected:?}");
+    s.undo(id).unwrap();
+    let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+    assert_eq!(pdfcraft_edit::list_added(&cos).len(), 1, "undo restores added-image editability");
+    s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform([1.0, 0.5, 0.0, 1.0, 0.0, 0.0]) }).unwrap();
+    assert_eq!(s.get(id).unwrap().page_images(0).len(), 1);
+}
+
+#[test]
+fn test_added_image_transform_reflections_with_rotation() {
+    let make_asymmetric_png = || {
+        let mut px = Vec::with_capacity(20 * 20 * 3);
+        for y in 0..20 {
+            for x in 0..20 {
+                let color = match (x < 10, y < 10) {
+                    (true, true) => [255, 0, 0],     // TL: Red
+                    (false, true) => [0, 255, 0],    // TR: Green
+                    (true, false) => [0, 0, 255],    // BL: Blue
+                    (false, false) => [255, 255, 0], // BR: Yellow
+                };
+                px.extend_from_slice(&color);
+            }
+        }
+        let mut png = Vec::new();
+        {
+            let mut enc = png::Encoder::new(&mut png, 20, 20);
+            enc.set_color(png::ColorType::Rgb);
+            enc.write_header().unwrap().write_image_data(&px).unwrap();
+        }
+        Arc::new(png)
+    };
+
+    let colour_at = |s: &Session, id: DocId, x: u32, y_from_top: u32| -> [u8; 3] {
+        let doc = s.get(id).unwrap();
+        let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), Default::default());
+        let out = r.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+        let i = ((y_from_top * out.width + x) * 4) as usize;
+        [out.rgba[i], out.rgba[i + 1], out.rgba[i + 2]]
+    };
+
+    let is_red = |c: [u8; 3]| c[0] > 200 && c[1] < 50 && c[2] < 50;
+    let is_green = |c: [u8; 3]| c[0] < 50 && c[1] > 200 && c[2] < 50;
+    let is_blue = |c: [u8; 3]| c[0] < 50 && c[1] < 50 && c[2] > 200;
+    let is_yellow = |c: [u8; 3]| c[0] > 200 && c[1] > 200 && c[2] < 50;
+
+    let check_quadrants =
+        |s: &Session, id: DocId, tl: fn([u8; 3]) -> bool, tr: fn([u8; 3]) -> bool, bl: fn([u8; 3]) -> bool, br: fn([u8; 3]) -> bool, label: &str| {
+            let c_tl = colour_at(s, id, 75, 125);
+            let c_tr = colour_at(s, id, 125, 125);
+            let c_bl = colour_at(s, id, 75, 175);
+            let c_br = colour_at(s, id, 125, 175);
+            assert!(tl(c_tl), "{label} TL mismatch: got {:?}", c_tl);
+            assert!(tr(c_tr), "{label} TR mismatch: got {:?}", c_tr);
+            assert!(bl(c_bl), "{label} BL mismatch: got {:?}", c_bl);
+            assert!(br(c_br), "{label} BR mismatch: got {:?}", c_br);
+        };
+
+    // --- CASE 1: 90° clockwise rotation (ImageEdit::Rotate(1), ai.rotation = 3) ---
+    // Unrotated: TL=Red, TR=Green, BL=Blue, BR=Yellow.
+    // After 90° CW: TL=Blue, TR=Red, BL=Yellow, BR=Green.
+    {
+        // 1a: Flip Horizontal after 90° rotation
+        let (mut s, id) = session_with(1);
+        s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+            .unwrap();
+        check_quadrants(&s, id, is_red, is_green, is_blue, is_yellow, "initial");
+
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+        check_quadrants(&s, id, is_blue, is_red, is_yellow, is_green, "90° CW");
+
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: true } }).unwrap();
+        let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+        let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+        assert_eq!(ai.rotation, 3);
+        assert!(!ai.flip_h, "at 90° rotation, horizontal flip toggles flip_v, not flip_h");
+        assert!(ai.flip_v, "at 90° rotation, horizontal flip toggles flip_v");
+        // Flipping horizontally on screen swaps left & right columns: TL=Red, TR=Blue, BL=Green, BR=Yellow
+        check_quadrants(&s, id, is_red, is_blue, is_green, is_yellow, "90° CW + flip horizontal");
+    }
+
+    {
+        // 1b: Flip Vertical after 90° rotation
+        let (mut s, id) = session_with(1);
+        s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+            .unwrap();
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(1) }).unwrap();
+
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: false } }).unwrap();
+        let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+        let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+        assert_eq!(ai.rotation, 3);
+        assert!(ai.flip_h, "at 90° rotation, vertical flip toggles flip_h");
+        assert!(!ai.flip_v, "at 90° rotation, vertical flip toggles flip_h, not flip_v");
+        // Flipping vertically on screen swaps top & bottom rows: TL=Yellow, TR=Green, BL=Blue, BR=Red
+        check_quadrants(&s, id, is_yellow, is_green, is_blue, is_red, "90° CW + flip vertical");
+    }
+
+    // --- CASE 2: 270° clockwise rotation (ImageEdit::Rotate(3), ai.rotation = 1) ---
+    // Unrotated: TL=Red, TR=Green, BL=Blue, BR=Yellow.
+    // After 270° CW: TL=Green, TR=Yellow, BL=Red, BR=Blue.
+    {
+        // 2a: Flip Horizontal after 270° rotation
+        let (mut s, id) = session_with(1);
+        s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+            .unwrap();
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(3) }).unwrap();
+        check_quadrants(&s, id, is_green, is_yellow, is_red, is_blue, "270° CW");
+
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: true } }).unwrap();
+        let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+        let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+        assert_eq!(ai.rotation, 1);
+        assert!(!ai.flip_h, "at 270° rotation, horizontal flip toggles flip_v, not flip_h");
+        assert!(ai.flip_v, "at 270° rotation, horizontal flip toggles flip_v");
+        // Flipping horizontally on screen swaps left & right columns: TL=Yellow, TR=Green, BL=Blue, BR=Red
+        check_quadrants(&s, id, is_yellow, is_green, is_blue, is_red, "270° CW + flip horizontal");
+    }
+
+    {
+        // 2b: Flip Vertical after 270° rotation
+        let (mut s, id) = session_with(1);
+        s.apply(id, Edit::AddImage { page: 0, rect: Some([50.0, 100.0, 150.0, 200.0]), name: "img.png".into(), bytes: make_asymmetric_png() })
+            .unwrap();
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Rotate(3) }).unwrap();
+
+        s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Flip { horizontal: false } }).unwrap();
+        let cos = pdfcraft_cos::Document::open(s.get(id).unwrap().bytes.clone()).unwrap();
+        let AddedContent::Image(ai) = &pdfcraft_edit::list_added(&cos)[0].content else { panic!() };
+        assert_eq!(ai.rotation, 1);
+        assert!(ai.flip_h, "at 270° rotation, vertical flip toggles flip_h");
+        assert!(!ai.flip_v, "at 270° rotation, vertical flip toggles flip_h, not flip_v");
+        // Flipping vertically on screen swaps top & bottom rows: TL=Red, TR=Blue, BL=Green, BR=Yellow
+        check_quadrants(&s, id, is_red, is_blue, is_green, is_yellow, "270° CW + flip vertical");
+    }
+}
+
 /// ISO 32000-2 Table 192, 12.7.5.2.3 and Table 228 (Comb): a check box, a push button, a comb
 /// field the file leaves to the viewer. The page as displayed and printed as an image shows the
 /// check box's caption symbol in its text colour, the button's grey face and the comb's cells in
@@ -9588,3 +10100,94 @@ fn repeated_backdrop_artwork_survives_background_undo_redo_and_both_save_modes()
     s.apply(rewritten, Edit::RemoveMarks { kind: MarkKind::Background }).unwrap();
     black(&s, rewritten);
 }
+
+fn contains(haystack: &[u8], needle: &[u8]) -> bool {
+    haystack.windows(needle.len()).any(|w| w == needle)
+}
+
+#[test]
+fn saving_after_deleting_pages_rewrites_the_file_without_them() {
+    let (mut s, id) = session_with(6);
+    let original = s.save_bytes(id).unwrap();
+    s.apply(id, Edit::DeletePages { pages: vec![1, 2, 3, 4] }).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.len() < original.len(), "the file shrank: {} -> {}", original.len(), saved.len());
+    assert!(!saved.starts_with(original.as_slice()), "a full rewrite, not an update appended to the old file");
+    assert!(!contains(&saved, b"Page 3"), "a deleted page's text is not left in an earlier revision");
+    let mut again = Session::new();
+    let id2 = again.open("saved.pdf", None, saved, None).unwrap();
+    assert_eq!(page_texts(&again, id2), ["Page 1", "Page 6"]);
+}
+
+#[test]
+fn saving_after_deleting_pages_from_a_signed_file_stays_incremental() {
+    let p12 = std::fs::read(concat!(env!("CARGO_MANIFEST_DIR"), "/../sign/tests/data/ec-p256.p12")).unwrap();
+    let digital_id = sign::pkcs12::open(&p12, "test").unwrap();
+    let mut s = Session::new().with_clock(|| 1_800_000_000);
+    let id = s.open("fixture.pdf", None, Arc::new(fixture(3)), None).unwrap();
+    let opts = SignOptions { page: 0, rect: Some([20.0, 20.0, 160.0, 50.0]), ..SignOptions::default() };
+    let signed = s.sign(id, &digital_id, opts).unwrap();
+    s.mark_signed(id, signed.clone(), None).unwrap();
+    s.apply(id, Edit::DeletePages { pages: vec![2] }).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.starts_with(signed.as_ref()), "the signed bytes stay an incremental update");
+    assert!(s.get(id).unwrap().is_signed());
+}
+
+#[test]
+fn saving_after_a_batch_that_deletes_pages_rewrites_the_file() {
+    let (mut s, id) = session_with(6);
+    let original = s.save_bytes(id).unwrap();
+    let batch = Edit::Batch {
+        label: "Delete and rotate".into(),
+        edits: vec![
+            Edit::Batch { label: "Delete pages".into(), edits: vec![Edit::DeletePages { pages: vec![1, 2, 3, 4] }] },
+            Edit::RotatePages { pages: vec![0], degrees: 90 },
+        ],
+    };
+    s.apply(id, batch).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(!saved.starts_with(original.as_slice()), "a full rewrite, not an update appended to the old file");
+    assert!(!contains(&saved, b"Page 3"), "a deleted page's text is not left in an earlier revision");
+}
+
+#[test]
+fn saving_without_deleting_pages_stays_incremental() {
+    let (mut s, id) = session_with(3);
+    let original = s.save_bytes(id).unwrap();
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    let saved = s.save_bytes(id).unwrap();
+    assert!(saved.starts_with(original.as_slice()), "an edit that deletes nothing is still appended");
+}
+
+#[test]
+fn original_image_edit_does_not_match_an_added_sibling_of_the_same_xobject() {
+    let mut document = pdfcraft_cos::Document::open(Arc::new(jpeg_cover_pdf(650))).unwrap();
+    let original = pdfcraft_edit::page_images(&document, 0).unwrap()[0].clone();
+    let added = AddedImage::new([20.0, 30.0, 80.0, 90.0], original.object.unwrap());
+    pdfcraft_edit::add_content(&mut document, 0, &AddedContent::Image(added.clone())).unwrap();
+    let bytes = pdfcraft_cos::write_full(&document, &pdfcraft_cos::SaveOptions::default()).unwrap();
+    let mut session = Session::new();
+    let id = session.open("shared-image.pdf", None, Arc::new(bytes), None).unwrap();
+    let before_added = session.get(id).unwrap().added()[0].content.clone();
+    session.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Move([40.0, 50.0, 140.0, 150.0]) }).unwrap();
+    let doc = session.get(id).unwrap();
+    assert_eq!(doc.added()[0].content, before_added, "matching an original Do must not select the added sibling's metadata");
+    assert_eq!(doc.page_images(0)[0].rect, [40.0, 50.0, 140.0, 150.0]);
+}
+
+#[test]
+fn image_transform_engine_refuses_singular_matrices_without_mutation() {
+    let mut png = Vec::new();
+    let mut enc = png::Encoder::new(&mut png, 1, 1);
+    enc.set_color(png::ColorType::Rgb);
+    enc.write_header().unwrap().write_image_data(&[100, 150, 200]).unwrap();
+    let mut s = Session::new();
+    let bytes = s.create_from_images(&[("pixel.png".into(), png)]).unwrap();
+    let id = s.open("image.pdf", None, bytes, None).unwrap();
+    for matrix in [[0.0, 0.0, 0.0, 1.0, 0.0, 0.0], [1.0, 1.0, 1.0, 1.0 + 1e-12, 0.0, 0.0], [1e308, 0.0, 0.0, 1e308, 0.0, 0.0]] {
+        let before = s.get(id).unwrap().bytes.clone();
+        assert!(s.apply(id, Edit::EditPageImage { page: 0, index: 0, change: ImageEdit::Transform(matrix) }).is_err());
+        assert_eq!(s.get(id).unwrap().bytes, before);
+    }
+}
diff --git a/crates/engine/src/text_fonts.rs b/crates/engine/src/text_fonts.rs
index 859bc1a6f8..e2b413d88d 100644
--- a/crates/engine/src/text_fonts.rs
+++ b/crates/engine/src/text_fonts.rs
@@ -32,17 +32,29 @@ pub fn installed_directories() -> Vec<PathBuf> {
     }
 }
 
-/// Bounded, symlink-free scan. Only standalone, openly licensed, embeddable faces are listed.
+/// Bounded scan with resolved roots and no descendant symlinks.
+/// Only standalone, openly licensed, embeddable faces are listed.
 /// The caller controls roots (automation resolves confinement before calling this).
 pub fn discover(roots: &[PathBuf]) -> Vec<FontFile> {
+    discover_budgeted(roots, 64u64 << 20)
+}
+
+/// Bounded scan with resolved roots and no descendant symlinks. `budget` caps the total
+/// size of the fonts listed: a rejected file (unreadable, not openly licensed, a duplicate)
+/// does not spend it. Every file read
+/// counts against four times the budget, so a folder of unusable fonts cannot stall the scan.
+pub fn discover_budgeted(roots: &[PathBuf], mut budget: u64) -> Vec<FontFile> {
     use std::io::Read;
-    let mut pending: Vec<_> = roots.iter().take(16).map(|r| (r.clone(), 0usize)).collect();
+    // User font directories themselves are often links. Resolve only the explicitly
+    // supplied roots; links found below them must not escape an automation read root.
+    let mut pending: Vec<_> = roots.iter().take(16).filter_map(|r| r.canonicalize().ok()).map(|r| (r, 0usize)).collect();
     let mut files = Vec::new();
     let mut entries = 0usize;
-    let mut budget = 64u64 << 20;
+    let mut read_allowance = budget.saturating_mul(4);
     let mut seen = std::collections::HashSet::new();
+    let mut seen_face_content = std::collections::HashSet::new();
     while let Some((path, depth)) = pending.pop() {
-        if entries >= 4096 || budget == 0 {
+        if entries >= 4096 || budget == 0 || read_allowance == 0 {
             break;
         }
         entries += 1;
@@ -53,26 +65,194 @@ pub fn discover(roots: &[PathBuf]) -> Vec<FontFile> {
         if meta.is_dir() && depth < 4 {
             if let Ok(children) = std::fs::read_dir(&path) {
                 let remaining = 4096usize.saturating_sub(entries.saturating_add(pending.len()));
-                pending.extend(children.take(remaining).filter_map(Result::ok).map(|p| (p.path(), depth + 1)));
+                // Best effort: unreadable entries are skipped and do not count against the entry allowance.
+                let mut sorted_children: Vec<_> = children.filter_map(Result::ok).take(remaining).map(|p| p.path()).collect();
+                sorted_children.sort();
+                pending.extend(sorted_children.into_iter().rev().map(|p| (p, depth + 1)));
             }
         } else if meta.is_file() && meta.len() <= (16 << 20) && font_extension(&path) {
-            if meta.len() > budget {
+            if meta.len() > budget || meta.len() > read_allowance {
                 continue;
             }
-            budget = budget.saturating_sub(meta.len());
+            read_allowance = read_allowance.saturating_sub(meta.len());
             let mut bytes = Vec::new();
-            let read = std::fs::File::open(&path).and_then(|f| f.take((16 << 20) + 1).read_to_end(&mut bytes));
-            if read.is_err() || pdfcraft_fonts::embedding::validate_document_input(&bytes).is_err() {
+            let read = std::fs::File::open(&path).and_then(|f| f.take(meta.len().saturating_add(1)).read_to_end(&mut bytes));
+            if read.is_err() || bytes.len() != meta.len() as usize {
+                continue;
+            }
+            if pdfcraft_fonts::embedding::validate_document_input(&bytes).is_err() {
                 continue;
             }
             if let Ok((family, face)) = pdfcraft_fonts::embedding::names(&bytes) {
-                files.push(FontFile { path, family, face });
+                let key = font_content_key(&bytes);
+                if seen_face_content.insert((face.clone(), key)) {
+                    budget = budget.saturating_sub(meta.len());
+                    files.push(FontFile { path, family, face });
+                }
             }
         }
     }
     files.sort_by(|a, b| a.face.cmp(&b.face).then(a.path.cmp(&b.path)));
     files
 }
+
+fn font_content_key(bytes: &[u8]) -> (usize, u64) {
+    use std::hash::{DefaultHasher, Hasher};
+    let mut h = DefaultHasher::new();
+    h.write(bytes);
+    (bytes.len(), h.finish())
+}
 fn font_extension(path: &Path) -> bool {
     path.extension().and_then(std::ffi::OsStr::to_str).is_some_and(|e| e.eq_ignore_ascii_case("ttf") || e.eq_ignore_ascii_case("otf"))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[cfg(unix)]
+    #[test]
+    fn a_linked_font_root_is_scanned_but_descendant_links_are_not() {
+        let root = std::env::temp_dir().join(format!("pdfcraft-font-links-{}", std::process::id()));
+        let real = root.join("real");
+        std::fs::create_dir_all(&real).unwrap();
+        let source = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Regular.ttf");
+        std::fs::copy(&source, real.join("regular.ttf")).unwrap();
+        let link = root.join("linked");
+        std::os::unix::fs::symlink(&real, &link).unwrap();
+        std::os::unix::fs::symlink(&real, real.join("cycle")).unwrap();
+        std::os::unix::fs::symlink(source.with_file_name("Inter-Medium.ttf"), real.join("escape.ttf")).unwrap();
+        let found = discover(&[link]);
+        let expected = real.canonicalize().unwrap().join("regular.ttf");
+        std::fs::remove_dir_all(&root).unwrap();
+        assert_eq!(found.len(), 1);
+        assert_eq!(found.first().unwrap().face, "Inter-Regular");
+        assert_eq!(found.first().unwrap().path, expected);
+    }
+
+    #[test]
+    fn discovery_keeps_all_valid_faces_within_its_scan_budget() {
+        let root = std::env::temp_dir().join(format!("pdfcraft-font-count-{}", std::process::id()));
+        std::fs::create_dir_all(&root).unwrap();
+        let source = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Regular.ttf");
+        let bytes = std::fs::read(source).unwrap();
+        for id in 0..501u32 {
+            let mut font = bytes.clone();
+            // Valid standalone fonts with distinct bytes: an unreferenced trailer
+            // does not change their tables or embedding licence.
+            font.extend_from_slice(&id.to_le_bytes());
+            std::fs::write(root.join(format!("font-{id:03}.ttf")), font).unwrap();
+        }
+        let found = discover_budgeted(std::slice::from_ref(&root), (bytes.len() as u64 + 4) * 501);
+        std::fs::remove_dir_all(&root).unwrap();
+        assert_eq!(found.len(), 501, "do not silently discard accepted fonts after sorting");
+    }
+
+    #[test]
+    fn test_installed_directories() {
+        let dirs = installed_directories();
+        assert!(!dirs.is_empty());
+    }
+
+    #[test]
+    fn test_font_extension() {
+        assert!(font_extension(Path::new("Arial.ttf")));
+        assert!(font_extension(Path::new("Noto.otf")));
+        assert!(font_extension(Path::new("CUSTOM.TTF")));
+        assert!(font_extension(Path::new("ROBOTO.OTF")));
+        assert!(!font_extension(Path::new("document.pdf")));
+        assert!(!font_extension(Path::new("font.woff")));
+        assert!(!font_extension(Path::new("font.woff2")));
+        assert!(!font_extension(Path::new("no_extension")));
+    }
+
+    #[test]
+    fn test_font_content_key() {
+        let empty = font_content_key(&[]);
+        assert_eq!(empty.0, 0);
+
+        let a = font_content_key(b"TrueType font sample data bytes");
+        let b = font_content_key(b"TrueType font sample data bytes");
+        let c = font_content_key(b"Different font sample data bytes");
+
+        assert_eq!(a, b, "identical bytes must produce identical keys");
+        assert_ne!(a, c, "differing bytes must produce distinct keys");
+        assert_eq!(a.0, b"TrueType font sample data bytes".len());
+    }
+
+    #[test]
+    fn test_discover_empty_and_nonexistent_roots() {
+        let empty = discover(&[]);
+        assert!(empty.is_empty());
+
+        let nonexistent = discover(&[PathBuf::from("Z:\\nonexistent_font_path_xyz_12345")]);
+        assert!(nonexistent.is_empty());
+    }
+
+    #[test]
+    fn test_discover_deduplicates_non_adjacent_same_content() {
+        let root = std::env::temp_dir().join(format!("pdfcraft-font-dedup-test-{}", std::process::id()));
+        let dir_a = root.join("a");
+        let dir_b = root.join("b");
+        let dir_c = root.join("c");
+        let _ = std::fs::create_dir_all(&dir_a);
+        let _ = std::fs::create_dir_all(&dir_b);
+        let _ = std::fs::create_dir_all(&dir_c);
+
+        let inter_reg = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Regular.ttf");
+        let inter_med = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts/Inter-Medium.ttf");
+
+        if inter_reg.exists() && inter_med.exists() {
+            let _ = std::fs::copy(&inter_reg, dir_a.join("FontA.ttf"));
+            let _ = std::fs::copy(&inter_med, dir_b.join("FontB.ttf"));
+            let _ = std::fs::copy(&inter_reg, dir_c.join("FontC.ttf"));
+
+            let discovered = discover(std::slice::from_ref(&root));
+            let _ = std::fs::remove_dir_all(&root);
+
+            assert_eq!(discovered.len(), 2, "identical content in non-adjacent paths is deduplicated");
+            let faces: Vec<&str> = discovered.iter().map(|f| f.face.as_str()).collect();
+            assert!(faces.contains(&"Inter-Regular"));
+            assert!(faces.contains(&"Inter-Medium"));
+        } else {
+            let _ = std::fs::remove_dir_all(&root);
+        }
+    }
+
+    #[test]
+    fn rejected_fonts_do_not_spend_the_budget_and_the_order_is_deterministic() {
+        let root = std::env::temp_dir().join(format!("pdfcraft-font-budget-test-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&root);
+        std::fs::create_dir_all(&root).unwrap();
+
+        let fonts = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../assets/fonts");
+        let reg_len = std::fs::metadata(fonts.join("Inter-Regular.ttf")).unwrap().len();
+        let med_len = std::fs::metadata(fonts.join("Inter-Medium.ttf")).unwrap().len();
+
+        // An unusable candidate, scanned first (sorted before the real fonts).
+        std::fs::write(root.join("00_candidate_invalid.ttf"), vec![0u8; 400_000]).unwrap();
+        std::fs::copy(fonts.join("Inter-Regular.ttf"), root.join("01_Inter-Regular.ttf")).unwrap();
+
+        // The budget fits Inter-Regular alone; the rejected file must not use it up first.
+        let run1 = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+        let run2 = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+        let faces = |run: &[FontFile]| run.iter().map(|f| (f.face.clone(), f.path.clone())).collect::<Vec<_>>();
+        assert_eq!(run1.iter().map(|f| f.face.as_str()).collect::<Vec<_>>(), ["Inter-Regular"], "a rejected file spends no budget");
+        assert_eq!(faces(&run1), faces(&run2));
+
+        // Accepted fonts do spend it: Inter-Medium no longer fits after Inter-Regular.
+        std::fs::copy(fonts.join("Inter-Medium.ttf"), root.join("02_Inter-Medium.ttf")).unwrap();
+        let one = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+        assert_eq!(one.iter().map(|f| f.face.as_str()).collect::<Vec<_>>(), ["Inter-Regular"]);
+        let both = discover_budgeted(std::slice::from_ref(&root), reg_len + med_len);
+        assert_eq!(both.len(), 2);
+
+        // Reading stops at four times the budget, whatever was rejected.
+        for i in 0..4 {
+            std::fs::write(root.join(format!("00_unusable_{i}.ttf")), vec![0u8; reg_len as usize]).unwrap();
+        }
+        let capped = discover_budgeted(std::slice::from_ref(&root), reg_len + 10);
+        let _ = std::fs::remove_dir_all(&root);
+        assert!(capped.is_empty(), "the read allowance ends the scan before the real fonts");
+    }
+}
diff --git a/crates/engine/src/text_script.rs b/crates/engine/src/text_script.rs
new file mode 100644
index 0000000000..04866eda60
--- /dev/null
+++ b/crates/engine/src/text_script.rs
@@ -0,0 +1,272 @@
+//! Superscript and subscript as Unicode characters (Edit a PDF ▸ Format text): `2` ↔ `²` and
+//! `2` ↔ `₂`.
+//!
+//! The text keeps its font, size and baseline; its characters change to the forms Unicode encodes
+//! for raised and lowered text, so the font must have those glyphs, and extracted text contains
+//! them. Characters Unicode has no such form for are left as they are.
+//!
+//! A selection mixing plain and target-script characters is normalized: `H₂2` becomes `H₂₂`,
+//! then `H22` on the next subscript toggle; superscript follows the same policy. Two toggles
+//! restore uniformly plain or uniformly scripted input, but do not reconstruct an original
+//! mixture. Restoring that exact prior text requires the caller's edit history (Undo).
+
+use std::ops::Range;
+
+/// Raised or lowered text.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum Script {
+    Super,
+    Sub,
+}
+
+/// Each character Unicode raises, and its superscript form.
+const SUPERSCRIPT: &[(char, char)] = &[
+    ('0', '⁰'),
+    ('1', '¹'),
+    ('2', '²'),
+    ('3', '³'),
+    ('4', '⁴'),
+    ('5', '⁵'),
+    ('6', '⁶'),
+    ('7', '⁷'),
+    ('8', '⁸'),
+    ('9', '⁹'),
+    ('+', '⁺'),
+    ('−', '⁻'),
+    ('=', '⁼'),
+    ('(', '⁽'),
+    (')', '⁾'),
+    ('a', 'ᵃ'),
+    ('b', 'ᵇ'),
+    ('c', 'ᶜ'),
+    ('d', 'ᵈ'),
+    ('e', 'ᵉ'),
+    ('f', 'ᶠ'),
+    ('g', 'ᵍ'),
+    ('h', 'ʰ'),
+    ('i', 'ⁱ'),
+    ('j', 'ʲ'),
+    ('k', 'ᵏ'),
+    ('l', 'ˡ'),
+    ('m', 'ᵐ'),
+    ('n', 'ⁿ'),
+    ('o', 'ᵒ'),
+    ('p', 'ᵖ'),
+    ('r', 'ʳ'),
+    ('s', 'ˢ'),
+    ('t', 'ᵗ'),
+    ('u', 'ᵘ'),
+    ('v', 'ᵛ'),
+    ('w', 'ʷ'),
+    ('x', 'ˣ'),
+    ('y', 'ʸ'),
+    ('z', 'ᶻ'),
+    ('A', 'ᴬ'),
+    ('B', 'ᴮ'),
+    ('D', 'ᴰ'),
+    ('E', 'ᴱ'),
+    ('G', 'ᴳ'),
+    ('H', 'ᴴ'),
+    ('I', 'ᴵ'),
+    ('J', 'ᴶ'),
+    ('K', 'ᴷ'),
+    ('L', 'ᴸ'),
+    ('M', 'ᴹ'),
+    ('N', 'ᴺ'),
+    ('O', 'ᴼ'),
+    ('P', 'ᴾ'),
+    ('R', 'ᴿ'),
+    ('T', 'ᵀ'),
+    ('U', 'ᵁ'),
+    ('V', 'ⱽ'),
+    ('W', 'ᵂ'),
+];
+
+/// Each character Unicode lowers, and its subscript form.
+const SUBSCRIPT: &[(char, char)] = &[
+    ('0', '₀'),
+    ('1', '₁'),
+    ('2', '₂'),
+    ('3', '₃'),
+    ('4', '₄'),
+    ('5', '₅'),
+    ('6', '₆'),
+    ('7', '₇'),
+    ('8', '₈'),
+    ('9', '₉'),
+    ('+', '₊'),
+    ('−', '₋'),
+    ('=', '₌'),
+    ('(', '₍'),
+    (')', '₎'),
+    ('a', 'ₐ'),
+    ('e', 'ₑ'),
+    ('h', 'ₕ'),
+    ('i', 'ᵢ'),
+    ('j', 'ⱼ'),
+    ('k', 'ₖ'),
+    ('l', 'ₗ'),
+    ('m', 'ₘ'),
+    ('n', 'ₙ'),
+    ('o', 'ₒ'),
+    ('p', 'ₚ'),
+    ('r', 'ᵣ'),
+    ('s', 'ₛ'),
+    ('t', 'ₜ'),
+    ('u', 'ᵤ'),
+    ('v', 'ᵥ'),
+    ('x', 'ₓ'),
+];
+
+impl Script {
+    fn pairs(self) -> &'static [(char, char)] {
+        match self {
+            Script::Super => SUPERSCRIPT,
+            Script::Sub => SUBSCRIPT,
+        }
+    }
+
+    /// `c` raised or lowered, or `None` when Unicode has no distinct reversible form for it.
+    /// Mathematical minus U+2212 has a form; ASCII hyphen-minus stays unchanged to avoid a lossy collision.
+    pub fn form(self, c: char) -> Option<char> {
+        self.pairs().iter().find(|(plain, _)| *plain == c).map(|&(_, form)| form)
+    }
+
+    /// The character `c` is the raised or lowered form of, or `None` when it is no such form.
+    pub fn plain(self, c: char) -> Option<char> {
+        self.pairs().iter().find(|(_, form)| *form == c).map(|&(plain, _)| plain)
+    }
+}
+
+/// `range` (UTF-8 bytes of `text`) clamped to it and widened to whole characters, or all of `text`
+/// when there is none.
+fn span(text: &str, range: Option<&Range<usize>>) -> Range<usize> {
+    let Some(range) = range else { return 0..text.len() };
+    let mut start = range.start.min(text.len());
+    while !text.is_char_boundary(start) {
+        start = start.saturating_sub(1);
+    }
+    let mut end = range.end.min(text.len());
+    while !text.is_char_boundary(end) {
+        end = end.saturating_add(1);
+    }
+    start..end
+}
+
+/// Whether the characters of `text` in `range` (UTF-8 bytes; all of it when `None`) are already in
+/// `script`: at least one of them is, and none of the others could be. Characters Unicode has no
+/// form for (a space, a `q`) don't count toward that state.
+pub fn is_in(text: &str, range: Option<&Range<usize>>, script: Script) -> bool {
+    let target = text.get(span(text, range)).unwrap_or_default();
+    target.chars().any(|c| script.plain(c).is_some()) && target.chars().all(|c| script.plain(c).is_some() || script.form(c).is_none())
+}
+
+/// Superscript or Subscript on the characters of `text` in `range` (UTF-8 bytes; all of it when
+/// `None`): back to plain characters when they are already in `script` ([`is_in`]), and otherwise
+/// each character that has a form takes it. Returns the new text and the range the converted
+/// characters now take, or `None` when nothing changes.
+///
+/// Mixed plain/scripted input normalizes to the target script and then to plain text; for
+/// example, `H₂2` → `H₂₂` → `H22`. This stateless conversion does not remember the original
+/// mixture. Use edit history to restore it, rather than treating a second toggle as Undo.
+pub fn toggle(text: &str, range: Option<&Range<usize>>, script: Script) -> Option<(String, Range<usize>)> {
+    let span = span(text, range);
+    let target = text.get(span.clone()).filter(|t| !t.is_empty())?;
+    let converted: String = if is_in(text, Some(&span), script) {
+        target.chars().map(|c| script.plain(c).unwrap_or(c)).collect()
+    } else {
+        target.chars().map(|c| script.form(c).unwrap_or(c)).collect()
+    };
+    if converted == target {
+        return None;
+    }
+    let mut out = String::with_capacity(text.len().saturating_add(converted.len()));
+    out.push_str(text.get(..span.start).unwrap_or_default());
+    out.push_str(&converted);
+    out.push_str(text.get(span.end..).unwrap_or_default());
+    let end = span.start.saturating_add(converted.len());
+    Some((out, span.start..end))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_form_toggles_back_to_its_character() {
+        for script in [Script::Super, Script::Sub] {
+            for &(plain, form) in script.pairs() {
+                let s = plain.to_string();
+                let (raised, range) = toggle(&s, None, script).unwrap();
+                assert_eq!(raised, form.to_string());
+                assert_eq!(range, 0..raised.len());
+                assert_eq!(toggle(&raised, None, script).unwrap().0, s, "{script:?} {plain}");
+            }
+        }
+        assert_eq!(toggle("-", None, Script::Super), None);
+        assert_eq!(toggle("-", None, Script::Sub), None);
+    }
+
+    #[test]
+    fn review_script_round_trips_preserve_both_minus_characters() {
+        for script in [Script::Super, Script::Sub] {
+            let text = "−2 -3";
+            let once = toggle(text, None, script).unwrap().0;
+            assert_eq!(toggle(&once, None, script).unwrap().0, text);
+        }
+    }
+
+    #[test]
+    fn text_with_characters_unicode_cannot_raise_toggles_back() {
+        // q has no superscript form and Q no subscript one; the space neither.
+        for (script, text, toggled) in [(Script::Super, "x2 q", "ˣ² q"), (Script::Sub, "CO2 Q", "CO₂ Q")] {
+            let (once, _) = toggle(text, None, script).unwrap();
+            assert_eq!(once, toggled);
+            assert!(is_in(&once, None, script));
+            assert_eq!(toggle(&once, None, script).unwrap().0, text, "{script:?}");
+        }
+        // Nothing to raise: nothing changes.
+        assert_eq!(toggle("q Q", None, Script::Super), None);
+        assert!(!is_in("q Q", None, Script::Super));
+    }
+
+    #[test]
+    fn a_range_converts_only_its_characters_and_follows_them() {
+        let (text, range) = toggle("E = mc2", Some(&(6..7)), Script::Super).unwrap();
+        assert_eq!((text.as_str(), range.clone()), ("E = mc²", 6..8));
+        assert_eq!(toggle(&text, Some(&range), Script::Super).unwrap(), ("E = mc2".to_string(), 6..7));
+        // A mixed range takes the form throughout.
+        assert_eq!(toggle("H₂2", None, Script::Sub).unwrap().0, "H₂₂");
+        assert!(!is_in("H₂2", None, Script::Sub));
+    }
+
+    #[test]
+    fn mixed_plain_and_scripted_text_normalizes_instead_of_round_tripping() {
+        for (script, mixed, uniform, plain) in [(Script::Super, "Q²2", "Q²²", "Q22"), (Script::Sub, "H₂2", "H₂₂", "H22")] {
+            assert!(!is_in(mixed, None, script));
+            let (once, range) = toggle(mixed, None, script).unwrap();
+            assert_eq!(once, uniform);
+            assert_eq!(range, 0..uniform.len());
+            assert!(is_in(&once, None, script));
+            let (twice, range) = toggle(&once, None, script).unwrap();
+            assert_eq!(twice, plain);
+            assert_eq!(range, 0..plain.len());
+            assert_ne!(twice, mixed, "a second toggle normalizes the original mixture");
+            assert_eq!(toggle(&twice, None, script).unwrap().0, uniform);
+        }
+    }
+
+    #[test]
+    fn hostile_ranges_are_clamped_to_whole_characters() {
+        // Byte 1 is inside ²: widened to the whole character on each side.
+        assert_eq!(toggle("²x", Some(&(1..1)), Script::Super).unwrap(), ("2x".to_string(), 0..1));
+        assert_eq!(toggle("²x", Some(&(2..2)), Script::Super), None);
+        assert_eq!(toggle("x2", Some(&(1..usize::MAX)), Script::Super).unwrap(), ("x²".to_string(), 1..3));
+        assert_eq!(toggle("x2", Some(&(5..9)), Script::Super), None);
+        #[allow(clippy::reversed_empty_ranges)]
+        let backwards = 2..1;
+        assert_eq!(toggle("x2", Some(&backwards), Script::Super), None);
+        assert_eq!(toggle("", None, Script::Sub), None);
+        assert!(!is_in("", None, Script::Sub));
+    }
+}
diff --git a/crates/optimize/src/images.rs b/crates/optimize/src/images.rs
index ebdad5396f..9cec3be367 100644
--- a/crates/optimize/src/images.rs
+++ b/crates/optimize/src/images.rs
@@ -635,13 +635,29 @@ fn jpeg_samples(data: &[u8], w: usize, h: usize, n: usize, ycc: bool) -> Option<
 }
 
 pub(crate) fn resample(px: &[u8], n: usize, w: u32, h: u32, nw: u32, nh: u32) -> Option<Vec<u8>> {
-    use image::imageops::{FilterType, resize};
     Some(match n {
-        1 => resize(&image::GrayImage::from_raw(w, h, px.to_vec())?, nw, nh, FilterType::CatmullRom).into_raw(),
-        _ => resize(&image::RgbImage::from_raw(w, h, px.to_vec())?, nw, nh, FilterType::CatmullRom).into_raw(),
+        1 => scaled(&image::GrayImage::from_raw(w, h, px.to_vec())?, nw, nh).into_raw(),
+        _ => scaled(&image::RgbImage::from_raw(w, h, px.to_vec())?, nw, nh).into_raw(),
     })
 }
 
+/// `img` scaled to `w` × `h`. Scaling goes down first, through a buffer of `img`'s width by `h` at
+/// 16 bytes a pixel, which a soft mask of other proportions than its image can make larger than
+/// any machine: 1,000,000 × 1 resampled to 4 × 100,000 asks for 1.6 TB, and that aborts the
+/// process. Such a one is scaled across first, which holds no more pixels than one of the two has.
+/// Past a quarter over the larger of them, so that rounding leaves a picture of the same shape as
+/// it was.
+fn scaled<P: image::Pixel<Subpixel = u8> + 'static>(img: &image::ImageBuffer<P, Vec<u8>>, w: u32, h: u32) -> image::ImageBuffer<P, Vec<u8>> {
+    use image::imageops::{FilterType, resize};
+    let (iw, ih) = (u64::from(img.width()), u64::from(img.height()));
+    let largest = (iw * ih).max(u64::from(w) * u64::from(h));
+    if (iw * u64::from(h)).saturating_mul(4) > largest.saturating_mul(5) {
+        resize(&resize(img, w, img.height(), FilterType::CatmullRom), w, h, FilterType::CatmullRom)
+    } else {
+        resize(img, w, h, FilterType::CatmullRom)
+    }
+}
+
 fn jpeg(px: &[u8], n: usize, w: u32, h: u32, quality: u8) -> Option<Vec<u8>> {
     let mut out = Vec::new();
     let mut enc = image::codecs::jpeg::JpegEncoder::new_with_quality(&mut out, quality.clamp(1, 100));
@@ -1654,6 +1670,66 @@ mod dimension_tests {
         assert_eq!(DECODED_PIXELS.with(|c| c.get()), 0, "pixels decoded");
         assert_eq!(pixels(&Document::new_empty(), &stream(1000, 1000), 1, &mut ImageBudget::with_work(u64::MAX)).map(|p| p.len()), Some(1000 * 1000));
     }
+
+    /// Resampling goes through no more than one of the two sizes holds, whatever their proportions:
+    /// the first three shapes asked for 160 GB and more on the way, and that aborted the process.
+    /// The last two would ask for 10 GB and 30 GB if they went across first, which is why the way
+    /// round depends on the shapes. A flat picture stays flat, and pictures of ordinary proportions
+    /// resample as they always did.
+    #[test]
+    fn resampling_across_proportions_takes_the_memory_of_neither_product() {
+        let shapes = [
+            (100_000u32, 1u32, 1u32, 100_000u32, 1usize),
+            (1_000_000, 1, 4, 100_000, 1),
+            (100_000, 1, 1, 100_000, 3),
+            (1, 100_000, 100_000, 1, 1),
+            (1, 100_000, 100_000, 1, 3),
+        ];
+        for (w, h, nw, nh, n) in shapes {
+            let px = vec![0x60; (w * h) as usize * n];
+            let out = resample(&px, n, w, h, nw, nh).unwrap();
+            assert_eq!(out.len(), (nw * nh) as usize * n);
+            assert!(out.iter().all(|v| v.abs_diff(0x60) <= 1), "{w} × {h} to {nw} × {nh}");
+        }
+        let (w, h, nw, nh) = (40u32, 30u32, 20u32, 15u32);
+        let px: Vec<u8> = (0..w * h).map(|i| (i * 7 % 251) as u8).collect();
+        let image = image::GrayImage::from_raw(w, h, px.clone()).unwrap();
+        let direct = image::imageops::resize(&image, nw, nh, image::imageops::FilterType::CatmullRom).into_raw();
+        assert_eq!(resample(&px, 1, w, h, nw, nh).unwrap(), direct, "as it was");
+    }
+
+    /// The long way round is for proportions far apart: up to a quarter over the larger picture the
+    /// buffer is no danger, and that scales as it always did, to the byte. Noise, as a flat picture comes
+    /// out the same either way.
+    #[test]
+    fn proportions_up_to_the_limit_resample_as_they_did() {
+        let noise = |w: u32, h: u32| -> Vec<u8> {
+            let mut seed = 0x2545_F491_4F6C_DD1Du64;
+            (0..w * h)
+                .map(|_| {
+                    seed ^= seed << 13;
+                    seed ^= seed >> 7;
+                    seed ^= seed << 17;
+                    seed as u8
+                })
+                .collect()
+        };
+        let direct = |px: &[u8], w, h, nw, nh| {
+            let image = image::GrayImage::from_raw(w, h, px.to_vec()).unwrap();
+            image::imageops::resize(&image, nw, nh, image::imageops::FilterType::CatmullRom).into_raw()
+        };
+        // Each exactly a quarter over the larger: the source's size, then the target's.
+        for (w, h, nw, nh) in [(25, 16, 10, 20), (20, 5, 16, 25)] {
+            let px = noise(w, h);
+            assert_eq!(resample(&px, 1, w, h, nw, nh).unwrap(), direct(&px, w, h, nw, nh), "{w} × {h} to {nw} × {nh}");
+        }
+        // A step past it goes the long way, which is how to tell.
+        let px = noise(25, 15);
+        assert_ne!(resample(&px, 1, 25, 15, 10, 20).unwrap(), direct(&px, 25, 15, 10, 20));
+        // A picture of the size asked for comes through as it is.
+        let px = noise(20, 10);
+        assert_eq!(resample(&px, 1, 20, 10, 20, 10).unwrap(), px);
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index 0254d64a34..8eec68c841 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -1775,7 +1775,8 @@ fn monochrome_images_keep_what_they_should() {
     optimize(&mut doc, &Settings::default()).unwrap();
     assert_eq!([alone, deep].map(|r| raw(&doc, r)), before, "a Group 4 halftone alone, and sixteen-bit grey");
     assert_eq!(filters(&doc, wrapped), 1, "a wrapped Group 4 halftone is stored again alone by default");
-    assert_eq!(stream(&doc, scan).dict.name(b"Filter"), Some(&b"CCITTFaxDecode"[..]), "the scan: Group 4 is smaller");
+    assert!(matches!(stream(&doc, scan).filters().as_slice(), [(Filter::CcittFax | Filter::Flate, _)]), "the scan: Group 4 or Flate");
+    assert_eq!(doc.decoded_image(&stream(&doc, scan)).unwrap(), ragged, "the scan preserves every sample");
     assert_eq!((stream(&doc, fax).dict.name(b"Filter"), filters(&doc, fax)), (Some(&b"CCITTFaxDecode"[..]), 1), "the busy fax image");
 
     let (mut doc, [_, wrapped, scan, _, _]) = build();
diff --git a/crates/render/src/raster/tests.rs b/crates/render/src/raster/tests.rs
index 31e062d12f..7a426db076 100644
--- a/crates/render/src/raster/tests.rs
+++ b/crates/render/src/raster/tests.rs
@@ -802,6 +802,472 @@ fn indexed_palettes_over_lab_keep_their_colours() {
     }
     assert!(indexed[0] > 180, "the palette red must not render near black: {indexed:?}");
 }
+
+/// A Pattern space's underlying space is any other, named or by reference as well as a direct array
+/// (ISO 32000-2 §8.7.3.3). It was skipped when it was a name or a reference, so an uncoloured tiling
+/// pattern took its components as RGB: a CMYK cyan drew red, and a grey of 0.5 dark red. Each is
+/// compared with the same colour painted without the pattern.
+#[test]
+fn an_uncoloured_pattern_uses_its_underlying_space_in_every_form() {
+    use super::*;
+    let render = |space: &str, content: &str| -> [u8; 4] {
+        let pattern = "0 0 10 10 re f";
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /C {space} >> /Pattern << /P 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /Type /Pattern /PatternType 1 /PaintType 2 /TilingType 1 /BBox [0 0 10 10] /XStep 10 /YStep 10 /Resources << >> /Length {} >> stream\n{pattern}\nendstream endobj\n\
+                 6 0 obj /DeviceCMYK endobj\n\
+                 7 0 obj /DeviceGray endobj\n\
+                 8 0 obj [/Indexed /DeviceRGB 1 <00FF00FF0000>] endobj\n\
+                 9 0 obj [/Pattern /DeviceCMYK] endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len(),
+            pattern.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{space}: {:?}", page.error);
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+    let fill = "0 0 200 200 re f";
+    let cyan = render("/DeviceCMYK", &format!("/DeviceCMYK cs 1 0 0 0 sc {fill}"));
+    let grey = render("/DeviceGray", &format!("/DeviceGray cs 0.5 sc {fill}"));
+    let green = render("8 0 R", &format!("/C cs 0 sc {fill}"));
+    assert_ne!(cyan[0], 255, "cyan has no red");
+    for (space, colour, want) in [
+        ("[/Pattern /DeviceCMYK]", "1 0 0 0", cyan),
+        ("[/Pattern 6 0 R]", "1 0 0 0", cyan),
+        ("9 0 R", "1 0 0 0", cyan),
+        ("[/Pattern /DeviceGray]", ".5", grey),
+        ("[/Pattern 7 0 R]", ".5", grey),
+        ("[/Pattern 8 0 R]", "0", green),
+        ("[/Pattern [/Indexed /DeviceRGB 1 <00FF00FF0000>]]", "0", green),
+    ] {
+        assert_eq!(render(space, &format!("/C cs {colour} /P scn {fill}")), want, "{space}");
+    }
+}
+
+/// A colour space's parts can refer back to the space, now that a Pattern's underlying space is
+/// followed as an Indexed space's base always was. A file made so ends as a space that can't be
+/// read, and the page draws what it can.
+#[test]
+fn a_colour_space_that_refers_to_itself_ends() {
+    use super::*;
+    let content = "1 0 0 rg 0 0 100 100 re f /C cs 0 sc 100 100 100 100 re f";
+    for (space, objects) in [
+        ("5 0 R", "5 0 obj [/Pattern 5 0 R] endobj"),
+        ("5 0 R", "5 0 obj [/Pattern 6 0 R] endobj 6 0 obj [/Pattern 5 0 R] endobj"),
+        ("5 0 R", "5 0 obj [/Pattern 6 0 R] endobj 6 0 obj [/Indexed 5 0 R 1 <0011>] endobj"),
+        ("5 0 R", "5 0 obj [/Indexed 5 0 R 1 <0011>] endobj"),
+    ] {
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /C {space} >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 {objects}\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{objects}: {:?}", page.error);
+        let start = ((150 * page.width as usize) + 50) * 4;
+        assert_eq!(page.rgba.get(start..start + 4), Some(&[255, 0, 0, 255][..]), "{objects}: what comes before it drew");
+    }
+}
+
+/// A chain of colour spaces repeats no object, so what ends a cycle lets it through. Each way one
+/// space names another ends, at a depth that leaves room on the stack, and the page draws what it
+/// can.
+#[test]
+fn a_chain_of_colour_spaces_ends() {
+    use super::*;
+    const LINKS: u32 = 20_000;
+    let content = "1 0 0 rg 0 0 100 100 re f /C cs 0 sc 100 100 100 100 re f";
+    let link: [(&str, &dyn Fn(u32) -> String); 5] = [
+        ("[/Pattern 10 0 R]", &|next| format!("[/Pattern {next} 0 R]")),
+        ("10 0 R", &|next| format!("[/Indexed {next} 0 R 1 <0011>]")),
+        ("10 0 R", &|next| format!("[/Separation /A {next} 0 R 5 0 R]")),
+        ("10 0 R", &|next| format!("[/DeviceN [/A] {next} 0 R 5 0 R]")),
+        ("[/ICCBased 10 0 R]", &|next| format!("<< /N 1 /Alternate [/ICCBased {next} 0 R] /Length 1 >> stream\nx\nendstream")),
+    ];
+    for (space, link) in link {
+        let objects: String = (0..LINKS).map(|i| format!("{} 0 obj {} endobj\n", 10 + i, link(11 + i))).collect();
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /C {space} >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /FunctionType 2 /Domain [0 1] /N 1 /C0 [0] /C1 [1] >> endobj\n\
+                 {objects}{} 0 obj /DeviceGray endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len(),
+            10 + LINKS
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{}: {:?}", link(11), page.error);
+        let start = ((150 * page.width as usize) + 50) * 4;
+        assert_eq!(page.rgba.get(start..start + 4), Some(&[255, 0, 0, 255][..]), "{}: what comes before it drew", link(11));
+    }
+}
+
+/// A file nests colour spaces five levels at most, and the limit is well past that: 31 spaces over
+/// a device space are read and draw their colour, and with one more the space isn't read.
+#[test]
+fn colour_spaces_are_read_to_the_limit_of_their_nesting() {
+    use super::*;
+    let content = "/C cs 1 scn 0 0 200 200 re f";
+    let green = |levels: u32| {
+        let objects: String = (0..levels - 1).map(|i| format!("{} 0 obj [/Separation /A {} 0 R 5 0 R] endobj\n", 10 + i, 11 + i)).collect();
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /C 10 0 R >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /FunctionType 2 /Domain [0 1] /N 1 /C0 [0] /C1 [1] >> endobj\n\
+                 6 0 obj << /FunctionType 2 /Domain [0 1] /N 1 /C0 [1 1 1] /C1 [0 1 0] >> endobj\n\
+                 {objects}{} 0 obj [/Separation /A /DeviceRGB 6 0 R] endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len(),
+            10 + levels - 1
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{levels}: {:?}", page.error);
+        page.rgba.get(..4) == Some(&[0, 255, 0, 255][..])
+    };
+    assert!(green(1), "a space on its own");
+    assert!(green(5), "as deep as a legal file goes");
+    assert!(green(31), "the deepest that is read");
+    assert!(!green(32), "one past it");
+}
+
+/// A page with the colour space resources `spaces` and the other objects `objects`, drawn with
+/// `content`. Objects 5 and 6 are tint transforms: the tint itself, and paper to green.
+fn page_with_colour_spaces(spaces: &str, objects: &str, content: &str) -> super::RenderedPage {
+    use super::*;
+    let bytes = format!(
+        "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << {spaces} >> >> /Contents 4 0 R >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             5 0 obj << /FunctionType 2 /Domain [0 1] /N 1 /C0 [0] /C1 [1] >> endobj\n\
+             6 0 obj << /FunctionType 2 /Domain [0 1] /N 1 /C0 [1 1 1] /C1 [0 1 0] >> endobj\n\
+             {objects}\n\
+             trailer << /Root 1 0 R >>\n%%EOF",
+        content.len()
+    )
+    .into_bytes();
+    PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+        page: 0,
+        kind: RequestKind::Pixels,
+        tile: None,
+        scale: 1.0,
+        tag: 0,
+        preview: false,
+    })
+}
+
+/// What an ICC profile reads as is kept. If what it falls back to were kept with it, a page
+/// selecting the last of a chain first would build each space on the one before, and no read
+/// would be deep: 20,000 levels past the limit, for whatever walks the space to paint with it.
+#[test]
+fn a_chain_built_on_spaces_already_read_ends() {
+    const LINKS: u32 = 20_000;
+    let selected: String = (0..LINKS).rev().map(|i| format!("/C{i} cs\n")).collect();
+    let content = format!("1 0 0 rg 0 0 100 100 re f\n{selected}0 sc 100 100 100 100 re f");
+    let spaces: String = (0..LINKS).map(|i| format!("/C{i} [/ICCBased {} 0 R] ", 10 + i)).collect();
+    let around: [&dyn Fn(&str) -> String; 4] = [
+        &|next| format!("[/Pattern {next}]"),
+        &|next| format!("[/Indexed {next} 1 <0011>]"),
+        &|next| format!("[/Separation /A {next} 5 0 R]"),
+        &|next| format!("[/DeviceN [/A] {next} 5 0 R]"),
+    ];
+    for around in around {
+        let mut objects: String = (0..LINKS)
+            .map(|i| {
+                let alternate = around(&format!("[/ICCBased {} 0 R]", 11 + i));
+                format!("{} 0 obj << /N 1 /Alternate {alternate} /Length 1 >> stream\nx\nendstream endobj\n", 10 + i)
+            })
+            .collect();
+        objects.push_str(&format!("{} 0 obj << /N 1 /Length 1 >> stream\nx\nendstream endobj\n", 10 + LINKS));
+        let page = page_with_colour_spaces(&spaces, &objects, &content);
+        assert!(page.error.is_none(), "{}: {:?}", around("next"), page.error);
+        let start = ((150 * page.width as usize) + 50) * 4;
+        assert_eq!(page.rgba.get(start..start + 4), Some(&[255, 0, 0, 255][..]), "{}: what comes before it drew", around("next"));
+    }
+}
+
+/// A profile met at the limit can't read its alternate there, which says nothing of a read nearer
+/// the top: the space kept from the first read isn't what the second gets.
+#[test]
+fn a_profile_read_at_the_limit_keeps_its_alternate_for_a_read_nearer_the_top() {
+    let chain: String = (0..31).map(|i| format!("{} 0 obj [/Separation /A {} 0 R 5 0 R] endobj\n", 10 + i, 11 + i)).collect();
+    let objects = format!(
+        "{chain}41 0 obj [/ICCBased 7 0 R] endobj\n\
+         7 0 obj << /N 1 /Alternate [/Separation /A /DeviceRGB 6 0 R] /Length 1 >> stream\nx\nendstream endobj\n"
+    );
+    let page = page_with_colour_spaces("/Deep 10 0 R /Near 41 0 R", &objects, "/Deep cs /Near cs 1 scn 0 0 200 200 re f");
+    assert!(page.error.is_none(), "{:?}", page.error);
+    assert_eq!(page.rgba.get(..4), Some(&[0, 255, 0, 255][..]));
+}
+
+/// An image's `/Decode` pairs can have a reference at the start of a pair. Its read took that for
+/// the whole pair, found no pair there, and ended the array, so the image didn't draw at all.
+#[test]
+fn a_decode_array_with_references_in_it_is_read() {
+    use super::*;
+    let render = |width_of: &str, decode: &str, space: &str, data: &str| -> [u8; 4] {
+        let content = "1 0 0 rg 0 0 200 200 re f q 200 0 0 200 0 0 cm /Im Do Q";
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /XObject << /Im 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /Type /XObject /Subtype /Image /Width {width_of} /Height 1 /BitsPerComponent 8 /ColorSpace {space} /Decode {decode} /Filter /ASCIIHexDecode /Length {} >> stream\n{data}\nendstream endobj\n\
+                 6 0 obj 1 endobj\n\
+                 7 0 obj 0 endobj\n\
+                 8 0 obj 8 0 R endobj\n\
+                 9 0 obj 10 0 R endobj\n\
+                 10 0 obj 9 0 R endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len(),
+            data.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{decode}: {:?}", page.error);
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+    let grey = render("1", "[1 0]", "/DeviceGray", "40>");
+    assert_eq!(grey, [191, 191, 191, 255], "the direct form inverts the sample");
+    for decode in ["[6 0 R 0]", "[1 7 0 R]", "[6 0 R 7 0 R]"] {
+        assert_eq!(render("1", decode, "/DeviceGray", "40>"), grey, "{decode}");
+    }
+    let rgb = render("1", "[1 0 1 0 1 0]", "/DeviceRGB", "204060>");
+    for decode in ["[6 0 R 0 1 0 1 0]", "[1 0 6 0 R 0 1 0]", "[1 0 1 0 6 0 R 0]", "[6 0 R 7 0 R 6 0 R 7 0 R 6 0 R 7 0 R]"] {
+        assert_eq!(render("1", decode, "/DeviceRGB", "204060>"), rgb, "{decode}");
+    }
+    // A reference that only leads back to itself holds no number, and reads as one that names
+    // nothing does.
+    let missing = render("1", "[99 0 R 0]", "/DeviceGray", "40>");
+    for decode in ["[8 0 R 0]", "[1 8 0 R]", "[9 0 R 0]", "[1 9 0 R]", "[8 0 R 9 0 R]"] {
+        assert_eq!(render("1", decode, "/DeviceGray", "40>"), missing, "{decode}");
+    }
+}
+
+/// An object that holds only a reference stands for what that names, stored on its own or in an
+/// object stream. Read as a number it was the reference's own object number: here 8 names 7, 7
+/// names 6 and 6 holds 1, and that read as 7, which drew white. A chain past the limit, and so a
+/// cycle, reads as a missing object does.
+#[test]
+fn a_reference_to_a_reference_is_what_it_names() {
+    use super::*;
+    let file = |decode: &str, objects: &str| -> Vec<u8> {
+        let content = "1 0 0 rg 0 0 200 200 re f q 200 0 0 200 0 0 cm /Im Do Q";
+        format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /XObject << /Im 5 0 R >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace /DeviceGray /Decode {decode} /Filter /ASCIIHexDecode /Length 3 >> stream\n40>\nendstream endobj\n\
+                 {objects}\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes()
+    };
+    let draw = |bytes: Vec<u8>| -> [u8; 4] {
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+    let grey = draw(file("[1 0]", ""));
+    assert_eq!(grey, [191, 191, 191, 255]);
+
+    let chain = "6 0 obj 1 endobj 7 0 obj 6 0 R endobj 8 0 obj 7 0 R endobj";
+    assert_eq!(draw(file("[8 0 R 0]", chain)), grey, "stored on their own");
+    let doc = pdfcraft_cos::Document::open(Arc::new(file("[8 0 R 0]", chain))).unwrap();
+    let packed = pdfcraft_cos::write_full(&doc, &pdfcraft_cos::SaveOptions::default()).unwrap();
+    assert!(packed.windows(7).any(|w| w == b"/ObjStm"), "the save packs them");
+    assert_eq!(draw(packed), grey, "stored in an object stream");
+    assert_eq!(draw(file("9 0 R", "9 0 obj 10 0 R endobj 10 0 obj [1 0] endobj")), grey, "not only numbers");
+    let commented = "6 0 obj 1 endobj 7 0 obj 6 %c\n0 R endobj 8 0 obj 7 0 %c\nR endobj";
+    assert_eq!(draw(file("[8 %c\n0 R 0]", commented)), grey, "a comment counts as white space");
+
+    let links = |n: usize| -> String {
+        let links: String = (0..n).map(|i| format!("{} 0 obj {} 0 R endobj\n", 10 + i, 11 + i)).collect();
+        format!("{links}{} 0 obj 1 endobj", 10 + n)
+    };
+    let missing = draw(file("[99 0 R 0]", ""));
+    assert_ne!(missing, grey);
+    assert_eq!(draw(file("[10 0 R 0]", &links(32))), grey, "32 references are followed");
+    assert_eq!(draw(file("[10 0 R 0]", &links(33))), missing, "33 aren't");
+    assert_eq!(draw(file("[6 0 R 0]", "6 0 obj 6 0 R endobj")), missing, "nor is a cycle");
+}
+
+/// A function's `/Encode`, `/Decode`, `/Domain` and `/Range` are read a pair at a time too, so they
+/// lost a reference at the start of a pair the same way, and the array with it. Each form is compared
+/// with the direct one, which differs from the identity so the array is shown to count.
+#[test]
+fn a_functions_arrays_can_start_with_a_reference() {
+    use super::*;
+    let render = |function: String| -> [u8; 4] {
+        let content = "/C cs 0.25 sc 0 0 200 200 re f";
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /C [/Separation /X /DeviceRGB 9 0 R] >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj 1 endobj\n6 0 obj 0 endobj\n\
+                 7 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0 0 0] /C1 [1 0 0] /N 1 >> endobj\n\
+                 8 0 obj << /FunctionType 2 /Domain [0 1] /C0 [0 1 0] /C1 [0 0 1] /N 1 >> endobj\n\
+                 9 0 obj {function} endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{function}: {:?}", page.error);
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+    let sampled = |encode: &str| {
+        format!(
+            "<< /FunctionType 0 /Size [2] /BitsPerSample 8 /Domain [0 1] /Range [0 1 0 1 0 1] /Encode {encode} /Filter /ASCIIHexDecode /Length 13 >> stream\n000000FF8040>\nendstream"
+        )
+    };
+    let stitched = |encode: &str| format!("<< /FunctionType 3 /Domain [0 1] /Functions [7 0 R 8 0 R] /Bounds [.5] /Encode {encode} >>");
+    assert_ne!(render(sampled("[1 0]")), render(sampled("[0 1]")), "/Encode counts");
+    assert_eq!(render(sampled("[5 0 R 0]")), render(sampled("[1 0]")), "a sampled function");
+    assert_ne!(render(stitched("[1 0 0 1]")), render(stitched("[0 1 0 1]")), "/Encode counts");
+    assert_eq!(render(stitched("[5 0 R 0 0 1]")), render(stitched("[1 0 0 1]")), "a stitching function");
+}
+
+/// The lookup table of an `/Indexed` space is a string or a stream, and any part of the space can
+/// be indirect (ISO 32000-2 §8.6.6.3, §7.3.10). A table in an indirect string was lost: reading it
+/// as a stream used up the reference, so the space couldn't be read and drew in grey.
+#[test]
+fn an_indexed_lookup_table_is_read_in_every_legal_form() {
+    use super::*;
+    let render = |space: &str, content: &str, extra: &str| -> [u8; 4] {
+        let bytes = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] /Resources << /ColorSpace << /I {space} >> /XObject << /Im 9 0 R >> >> /Contents 4 0 R >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj <000000FF0000> endobj\n\
+                 6 0 obj << /Filter /ASCIIHexDecode /Length 13 >> stream\n000000FF0000>\nendstream endobj\n\
+                 7 0 obj /DeviceRGB endobj\n\
+                 8 0 obj 1 endobj\n\
+                 {extra}\n\
+                 trailer << /Root 1 0 R >>\n%%EOF",
+            content.len()
+        )
+        .into_bytes();
+        let page = PageRenderer::new(Arc::new(bytes), RenderConfig::default()).render(RenderRequest {
+            page: 0,
+            kind: RequestKind::Pixels,
+            tile: None,
+            scale: 1.0,
+            tag: 0,
+            preview: false,
+        });
+        assert!(page.error.is_none(), "{space}: {:?}", page.error);
+        let start = (100 * page.width as usize + 100) * 4;
+        let mut pixel = [0; 4];
+        pixel.copy_from_slice(page.rgba.get(start..start + 4).expect("centre pixel"));
+        pixel
+    };
+    let paint = "/I cs 1 sc 0 0 200 200 re f";
+    // One byte of index 1, as an image in the same space: the image path reads it too.
+    let image = "9 0 obj << /Type /XObject /Subtype /Image /Width 1 /Height 1 /BitsPerComponent 8 /ColorSpace [/Indexed /DeviceRGB 1 5 0 R] /Filter /ASCIIHexDecode /Length 3 >> stream\n01>\nendstream endobj";
+    for space in [
+        "[/Indexed /DeviceRGB 1 <000000FF0000>]",
+        "[/Indexed /DeviceRGB 1 5 0 R]",
+        "[/Indexed /DeviceRGB 1 6 0 R]",
+        "[/Indexed 7 0 R 8 0 R 5 0 R]",
+        "[/I /DeviceRGB 1 5 0 R]",
+    ] {
+        assert_eq!(render(space, paint, ""), [255, 0, 0, 255], "{space}");
+    }
+    let indirect = "10 0 obj [/Indexed /DeviceRGB 1 5 0 R] endobj";
+    assert_eq!(render("10 0 R", paint, indirect), [255, 0, 0, 255], "the whole space by reference");
+    assert_eq!(render("/DeviceRGB", "q 200 0 0 200 0 0 cm /Im Do Q", image), [255, 0, 0, 255], "an image's table by reference");
+    // What's neither table form leaves the space unreadable, as a missing table does.
+    for space in ["[/Indexed /DeviceRGB 1 8 0 R]", "[/Indexed /DeviceRGB 1 99 0 R]", "[/Indexed /DeviceRGB 1]"] {
+        let _ = render(space, paint, "");
+    }
+    // So does a table that only leads back to itself, and the read of it ends.
+    let cycle = "11 0 obj 11 0 R endobj 12 0 obj 13 0 R endobj 13 0 obj 12 0 R endobj";
+    for space in ["[/Indexed /DeviceRGB 1 11 0 R]", "[/Indexed /DeviceRGB 1 12 0 R]"] {
+        let _ = render(space, paint, cycle);
+    }
+}
 #[test]
 fn watchdog_skips_a_stuck_page_and_keeps_rendering() {
     use super::*;
@@ -4671,6 +5137,86 @@ fn jbig2_symbol_dictionaries_that_never_advance_terminate() {
     }
 }
 
+/// A JBIG2 stream can put a region, a reference or a symbol at the very end of what an `i32` holds,
+/// where adding to it overflowed: a panic wherever overflow is checked, a build's own tests included.
+/// A region or a symbol out there is off the page, so nothing draws. Vendored hayro-jbig2 patch: the arithmetic wraps, as
+/// a release build's did, or in `Bitmap::combine` saturates, which comes to the same. Three of the text
+/// streams are arithmetic-coded: one symbol on a strip of -2^31 + 1, with its bottom left as the corner
+/// placed, one on a strip of -2^31, and one refined by an offset of `i32::MIN`, which reads nothing of
+/// the old symbol and still draws. Two are Huffman-coded, each with its first S at an offset of
+/// 0x7FFFFFFF on a table's 32-bit range line, past what an `i32` holds, and are refused further on.
+#[test]
+fn jbig2_placements_at_the_end_of_an_i32_draw_nothing() {
+    const FAR_CORNER: &str = "0000000030000100000013000000100000000c0000000000000000420000000000010000010000001e000003fffdff02fefefe00000001000000014fdc3ce0205df55c36bfffac00000002062001010000001f000000100000000c000000000000000004000000000001969747cbe88bffac";
+    const STRIP: &str = "0000000030000100000013000000100000000c0000000000000000420000000000010000010000001e000003fffdff02fefefe00000001000000014fdda25e46956d3e0d3fffac00000002062001010000001f000000100000000c000000000000000004001000000001969747cbe5dbffac";
+    const UPPER_LINE: &str = "0000000030000100000013000000100000000c0000000000000000420000000000010000010000001d000003fffdff02fefefe00000001000000014fdaea38c99641e0c8ffac000000020620010100000038000000100000000c00000000000000000400110000000000010100000000000000000000000000000000003f7fffffff0000000000000000";
+    const LOWER_LINE: &str = "0000000030000100000013000000100000000c0000000000000000420000000000010000010000001d000003fffdff02fefefe00000001000000014fdaea38c99641e0c8ffac000000020620010100000038000000100000000c00000000000000000400110000000000010100000000000000000000000000000000003e7fffffff0000000000000000";
+    const OFFSET: &str = "0000000030000100000013000000100000000c0000000000000000420000000000010000010000001e000003fffdff02fefefe00000001000000014fdda9172f614a037ddfffac0000000206200101000000260000000800000006000000000000000004801200000001a9695690b3e5f44a2f105e30d3ffac";
+    let segment = |number: u32, kind: u8, data: &[u8]| {
+        let mut out = number.to_be_bytes().to_vec();
+        out.extend_from_slice(&[kind, 0, 1]);
+        out.extend_from_slice(&u32::try_from(data.len()).unwrap().to_be_bytes());
+        out.extend_from_slice(data);
+        out
+    };
+    let side = 8u32.to_be_bytes();
+    let page = |width: u32| {
+        let mut page = [width.to_be_bytes(), side].concat();
+        page.extend_from_slice(&[0; 8]); // resolution
+        page.extend_from_slice(&[0, 0, 0]); // flags, striping
+        segment(0, 48, &page)
+    };
+    let region = |width: u32, kind: u8, x: u32, y: u32, header: &[u8]| {
+        let mut region = [width.to_be_bytes(), side, x.to_be_bytes(), y.to_be_bytes()].concat();
+        region.push(0); // combination operator
+        region.extend_from_slice(header);
+        region.extend_from_slice(&[0x5a; 64]);
+        [page(width), segment(1, kind, &region)].concat()
+    };
+    let generic = |x, y| region(8, 38, x, y, &[0, 3, 0xff, 0xfd, 0xff, 2, 0xfe, 0xfe, 0xfe]); // template 0, AT pixels
+    // Immediate refinements of the page: template 0 with its usual AT pixels, with others, with typical
+    // prediction, and template 1.
+    let refined = |width, x, y, form: usize| {
+        region(width, 42, x, y, [&[0, 0xff, 0xff, 0xff, 0xff][..], &[0, 0xff, 0xff, 127, 127], &[2, 0xff, 0xff, 0xff, 0xff], &[1]][form])
+    };
+    let hex = |text: &str| (0..text.len() / 2).map(|i| u8::from_str_radix(&text[i * 2..i * 2 + 2], 16).unwrap()).collect::<Vec<u8>>();
+    let ink = |jbig2: Vec<u8>, width: u32, height: u32| {
+        let content = b"q 20 0 0 20 5 5 cm /Im1 Do Q";
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R /Resources << /XObject << /Im1 5 0 R >> >> >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Length {} >> stream\n", content.len()).as_bytes());
+        pdf.extend_from_slice(content);
+        pdf.extend_from_slice(b"\nendstream endobj\n");
+        pdf.extend_from_slice(
+            format!("5 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height {height} /BitsPerComponent 1 /ColorSpace /DeviceGray /Filter /JBIG2Decode /Length {} >> stream\n", jbig2.len())
+                .as_bytes(),
+        );
+        pdf.extend_from_slice(&jbig2);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        page.rgba.as_chunks::<4>().0.iter().filter(|p| p[0] < 128).count()
+    };
+    assert!(ink(generic(2, 0), 8, 8) > 0, "a region on the page draws");
+    for form in 0..4 {
+        assert!(ink(refined(8, 0, 0, form), 8, 8) > 0, "a refinement on the page draws: {form}");
+    }
+    let end = 0x7FFF_FFFFu32;
+    for (x, y) in [(end, 0), (0, end), (end - 7, 0), (0, end - 7), (end - 129, 0), (0, end - 129)] {
+        assert_eq!(ink(generic(x, y), 8, 8), 0, "generic at {x:#x}, {y:#x}");
+        for form in 0..4 {
+            assert_eq!(ink(refined(8, x, y, form), 8, 8), 0, "refinement {form} at {x:#x}, {y:#x}");
+        }
+    }
+    // Past a 32-bit word of the row, where the reference is read again.
+    assert_eq!(ink(refined(64, 0, end, 0), 64, 8), 0, "a wide refinement");
+    assert_eq!(ink(hex(FAR_CORNER), 16, 12), 0, "a symbol's far side past the end");
+    assert_eq!(ink(hex(STRIP), 16, 12), 0, "a strip of -2^31");
+    assert!(ink(hex(OFFSET), 16, 12) > 0, "a symbol refined by an offset of i32::MIN");
+    assert_eq!(ink(hex(UPPER_LINE), 16, 12), 0, "an upper range line past an i32");
+    assert_eq!(ink(hex(LOWER_LINE), 16, 12), 0, "a lower range line past an i32");
+}
+
 /// Item 1 of storytold/pdfcraft#623: a page's content used to be cut at `MAX_DECODED_STREAM`,
 /// so everything after the cut was lost (the text and the title block of the A1 sample). Content
 /// that expands by a few times over is read to its end, however large it is.
diff --git a/crates/sign/src/der.rs b/crates/sign/src/der.rs
index 6248c1e9e1..0cac252c33 100644
--- a/crates/sign/src/der.rs
+++ b/crates/sign/src/der.rs
@@ -465,7 +465,12 @@ pub fn oid(dotted: &str) -> Vec<u8> {
 /// Encode a dotted OID supplied by a caller. Unlike [`oid`], this validates every arc and
 /// never panics on malformed input.
 pub fn try_oid(dotted: &str) -> Result<Vec<u8>, SignError> {
-    let mut arcs = dotted.split('.').map(|a| a.parse::<u64>().map_err(|_| bad("invalid OID arc")));
+    let mut arcs = dotted.split('.').map(|a| {
+        if a.is_empty() || !a.bytes().all(|c| c.is_ascii_digit()) {
+            return Err(bad("invalid OID arc"));
+        }
+        a.parse::<u64>().map_err(|_| bad("invalid OID arc"))
+    });
     let first = arcs.next().ok_or_else(|| bad("empty OID"))??;
     let second = arcs.next().ok_or_else(|| bad("OID needs two arcs"))??;
     if first > 2 || (first < 2 && second >= 40) {
@@ -549,6 +554,14 @@ pub fn algorithm(oid_s: &str, params: Option<&[u8]>) -> Vec<u8> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn try_oid_rejects_signs_and_empty_arcs() {
+        for bad in ["+1.2.840", "1.+2", "1.2.-3", "1..2"] {
+            assert!(try_oid(bad).is_err(), "accepted {bad}");
+        }
+        assert_eq!(try_oid("1.2.840.113549").unwrap(), oid("1.2.840.113549"));
+    }
+
     #[test]
     fn round_trips() {
         let o = oid("1.2.840.113549.1.7.2");
diff --git a/crates/ui-egui/Cargo.toml b/crates/ui-egui/Cargo.toml
index 804b5ea22a..7f164991d5 100644
--- a/crates/ui-egui/Cargo.toml
+++ b/crates/ui-egui/Cargo.toml
@@ -20,6 +20,7 @@ craft-quit = { workspace = true, features = ["egui"] }
 pdfcraft-fonts = { workspace = true }
 pdfcraft-engine = { workspace = true }
 pdfcraft-cos = { workspace = true }
+pdfcraft-content = { workspace = true }
 pdfcraft-render = { workspace = true }
 pdfcraft-model = { workspace = true }
 pdfcraft-platform = { workspace = true }
@@ -96,6 +97,7 @@ egui = { workspace = true, features = ["default_fonts", "monochrome_emoji_fonts"
 image = { version = "0.25", default-features = false, features = ["png"] }
 # Glyph-coverage test of the interface fonts; the same skrifa pdfcraft-fonts already uses.
 skrifa = "0.44"
+proptest = { workspace = true }
 
 [build-dependencies]
 serde_json = { workspace = true }
diff --git a/crates/ui-egui/src/app.rs b/crates/ui-egui/src/app.rs
index 425c2e26ce..4de70f3d9e 100644
--- a/crates/ui-egui/src/app.rs
+++ b/crates/ui-egui/src/app.rs
@@ -73,6 +73,7 @@ impl PdfCraftApp {
             default_mode: Mode::AllTools,
             view_defaults: Default::default(),
             units: Default::default(),
+            blank_paper: crate::paper::Paper::system(),
             date_format_draft: None,
             mode_override: None,
             left: LeftPanel::AllTools,
@@ -91,6 +92,7 @@ impl PdfCraftApp {
             // A fresh install follows the desktop's appearance (#1248); saved settings override.
             theme_preference: ThemePreference::System,
             reading_colors: Default::default(),
+            show_page_edge_shadows: true,
             #[cfg(target_os = "linux")]
             desktop_theme: None,
             #[cfg(target_os = "linux")]
@@ -117,6 +119,7 @@ impl PdfCraftApp {
             all_tools_query: String::new(),
             all_tools_tab: (None, false),
             recent: Vec::new(),
+            recent_limit: crate::RECENT_FILES_DEFAULT,
             reopen_last_session: false,
             restore_last_view: true,
             last_views: Vec::new(),
@@ -133,9 +136,15 @@ impl PdfCraftApp {
             pending_opens: Vec::new(),
             #[cfg(not(target_arch = "wasm32"))]
             next_open_token: 0,
+            #[cfg(not(target_arch = "wasm32"))]
+            launch_layout: None,
+            #[cfg(not(target_arch = "wasm32"))]
+            launch_display_target: None,
             #[cfg(all(test, not(target_arch = "wasm32")))]
             open_prepare_gate: None,
             pinned: Default::default(),
+            pinned_tools: Vec::new(),
+            pin_tool_search: String::new(),
             toast: None,
             toast_script: None,
             script_messages: std::collections::VecDeque::new(),
@@ -223,7 +232,6 @@ impl PdfCraftApp {
             last_copied_file: None,
             system_clipboard: true,
             clipboard_override: None,
-            v_pressed: false,
             attach_override: None,
             duplicate_draft: None,
             page_props_draft: None,
@@ -353,6 +361,46 @@ impl PdfCraftApp {
     pub fn render_pending(&self) -> bool {
         self.views.iter().any(|v| v.render_pending())
     }
+
+    /// Check whether a tool group is pinned to Home.
+    pub fn is_tool_pinned(&self, id: &str) -> bool {
+        self.pinned_tools.iter().any(|t| t == id)
+    }
+
+    /// Pin a tool group to Home. Returns true if newly pinned.
+    pub fn pin_tool(&mut self, id: &str) -> bool {
+        if pdfcraft_engine::catalog::group(id).is_none() {
+            return false;
+        }
+        if !self.is_tool_pinned(id) {
+            self.pinned_tools.push(id.to_string());
+            if let Some(g) = pdfcraft_engine::catalog::group(id) {
+                self.notify_fmt("Pinned {tool} to Home", &[("tool", tl!(g.label))]);
+            }
+            return true;
+        }
+        false
+    }
+
+    /// Unpin a tool group from Home.
+    pub fn unpin_tool(&mut self, id: &str) {
+        if let Some(pos) = self.pinned_tools.iter().position(|t| t == id) {
+            self.pinned_tools.remove(pos);
+            if let Some(g) = pdfcraft_engine::catalog::group(id) {
+                self.notify_fmt("Unpinned {tool} from Home", &[("tool", tl!(g.label))]);
+            }
+        }
+    }
+
+    /// Toggle a tool group's pinned state on Home. Returns whether it is now pinned.
+    pub fn toggle_pin_tool(&mut self, id: &str) -> bool {
+        if self.is_tool_pinned(id) {
+            self.unpin_tool(id);
+            false
+        } else {
+            self.pin_tool(id)
+        }
+    }
 }
 
 impl eframe::App for PdfCraftApp {
@@ -362,6 +410,10 @@ impl eframe::App for PdfCraftApp {
     fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
         // The button's release a window move or resize kept from egui.
         window_controls::release_after_desktop_grab(ctx, raw);
+        // The wheel after Alt+Tab back, before the mouse has moved (#1518).
+        let known = ctx.input(|i| i.pointer.latest_pos().is_some());
+        let size = ctx.input(|i| i.viewport().inner_rect).map_or(egui::Vec2::ZERO, |r| r.size());
+        drag_pointer::locate_wheel(raw, known, size, || drag_pointer::in_window(ctx));
         self.prepare_raw_input(ctx, raw);
         if raw.hovered_files.is_empty() && raw.dropped_files.is_empty() {
             return;
diff --git a/crates/ui-egui/src/app/clipboard.rs b/crates/ui-egui/src/app/clipboard.rs
index 6641d93a86..9319368d29 100644
--- a/crates/ui-egui/src/app/clipboard.rs
+++ b/crates/ui-egui/src/app/clipboard.rs
@@ -10,6 +10,11 @@ pub(crate) fn print_refused() -> &'static str {
     tl!("The document's security settings don't allow printing")
 }
 
+enum ClipboardPaste {
+    Text,
+    Image(std::sync::Arc<egui::ColorImage>),
+}
+
 impl PdfCraftApp {
     /// Whether text and images may be copied out of document `id`; says why not when they may
     /// not. Reading aloud and accessibility tools don't ask (assistive technology may read
@@ -22,14 +27,83 @@ impl PdfCraftApp {
         false
     }
 
-    /// ⌘C copies the selected text, unless a text field has the keyboard (it copies its own).
-    pub(super) fn copy_key(&mut self, i: usize, ctx: &egui::Context) {
-        // ⌘C arrives as a Copy event on most platforms.
-        let copy = ctx.input(|input| input.events.iter().any(|e| matches!(e, egui::Event::Copy)));
-        if !copy || ctx.egui_wants_keyboard_input() {
+    /// ⌘C / ⌘X / ⌘V copy, cut and paste text or images on canvas (unless a text field has focus).
+    pub(super) fn clipboard_keys(&mut self, i: usize, ctx: &egui::Context) {
+        use egui::{Key, KeyboardShortcut, Modifiers};
+        let pastes: Vec<_> = ctx.input(|input| {
+            input
+                .events
+                .iter()
+                .filter_map(|event| match event {
+                    egui::Event::Paste(_) => Some(ClipboardPaste::Text),
+                    egui::Event::PasteImage(image) => Some(ClipboardPaste::Image(image.clone())),
+                    _ => None,
+                })
+                .collect()
+        });
+        let free = self.dialog.is_none() && !self.palette_open && !ctx.egui_wants_keyboard_input() && !self.is_preparing();
+        if !free || self.views.get(i).is_some_and(|v| v.forms.focus.is_some() || v.organize) {
+            self.receive_pastes(i, pastes, false);
             return;
         }
-        self.copy_selected_text(i, ctx);
+        let copy = ctx.input(|input| input.events.iter().any(|e| matches!(e, egui::Event::Copy)))
+            || ctx.input_mut(|input| input.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, Key::C)));
+        let cut = ctx.input(|input| input.events.iter().any(|e| matches!(e, egui::Event::Cut)))
+            || ctx.input_mut(|input| input.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, Key::X)));
+        let paste = ctx.input_mut(|input| input.consume_shortcut(&KeyboardShortcut::new(Modifiers::COMMAND, Key::V)));
+
+        if copy
+            && !self.copy_selected_text(i, ctx)
+            && let Some(sel) = self.views.get(i).and_then(|v| v.image_selection.clone())
+            && let Some(id) = self.views.get(i).map(|v| v.id)
+            && self.may_copy(id)
+        {
+            self.copy_page_image(sel.page, sel.index);
+        }
+        if cut
+            && let Some(sel) = self.views.get(i).and_then(|v| v.image_selection.clone())
+            && let Some(id) = self.views.get(i).map(|v| v.id)
+            && self.may_copy(id)
+        {
+            self.cut_page_image(sel.page, sel.index);
+        }
+        if !pastes.is_empty() {
+            self.receive_pastes(i, pastes, true);
+            return;
+        }
+        if paste {
+            let has_override_image = matches!(self.clipboard_override, Some(crate::create_ui::Clip::Image { .. }));
+            #[cfg(not(target_arch = "wasm32"))]
+            let system_has_text = if !has_override_image && self.system_clipboard { crate::os_clipboard::has_text() } else { false };
+            #[cfg(target_arch = "wasm32")]
+            let system_has_text = false;
+
+            if !has_override_image && system_has_text {
+                self.last_copied_image = None;
+                self.last_copied_file = None;
+                return;
+            }
+
+            let page = self.views.get(i).map_or(0, |v| v.current);
+            self.paste_image(page, None);
+        }
+    }
+
+    fn receive_pastes(&mut self, view: usize, pastes: Vec<ClipboardPaste>, images_allowed: bool) {
+        let page = self.views.get(view).map_or(0, |view| view.current);
+        for paste in pastes {
+            match paste {
+                ClipboardPaste::Text => {
+                    // Text fields may own the paste; the canvas cache still observes its contents.
+                    self.last_copied_image = None;
+                    self.last_copied_file = None;
+                }
+                ClipboardPaste::Image(image) if images_allowed => {
+                    self.paste_received_image(page, &image);
+                }
+                ClipboardPaste::Image(_) => {}
+            }
+        }
     }
 
     /// Shared permission gate for copying selected page text from menus and keyboard events.
@@ -79,3 +153,222 @@ impl PdfCraftApp {
         }
     }
 }
+
+#[cfg(test)]
+mod review_tests {
+    use super::*;
+    fn delivered() -> egui::Event {
+        egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([1, 1], egui::Color32::GREEN)))
+    }
+
+    fn key(pressed: bool, modifiers: egui::Modifiers) -> egui::Event {
+        egui::Event::Key { key: egui::Key::V, physical_key: None, pressed, repeat: false, modifiers }
+    }
+
+    fn image_app() -> PdfCraftApp {
+        let mut app = PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        app.clipboard_override = Some(crate::create_ui::Clip::Image { width: 1, height: 1, rgba: vec![255, 0, 0, 255] });
+        app
+    }
+
+    fn frame(app: &mut PdfCraftApp, ctx: &egui::Context, time: f64, events: Vec<egui::Event>) -> usize {
+        ctx.run_ui(egui::RawInput { time: Some(time), events, ..Default::default() }, |ui| app.clipboard_keys(0, ui.ctx()))
+            .drop_without_applying_deltas();
+        app.session.get(app.views[0].id).unwrap().page_images(0).len()
+    }
+
+    #[test]
+    fn delivered_image_pastes_for_either_modifier_release_order() {
+        for command_first in [true, false] {
+            let mut app = image_app();
+            let ctx = egui::Context::default();
+            frame(&mut app, &ctx, 1.0, vec![egui::Event::ModifiersChanged(egui::Modifiers::COMMAND)]);
+            let releases = if command_first {
+                vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE), key(false, egui::Modifiers::NONE)]
+            } else {
+                vec![key(false, egui::Modifiers::COMMAND), egui::Event::ModifiersChanged(egui::Modifiers::NONE)]
+            };
+            assert_eq!(frame(&mut app, &ctx, 1.1, releases), 0, "key release is not a delivered paste");
+            assert_eq!(frame(&mut app, &ctx, 1.2, vec![delivered()]), 1, "asynchronous pixels identify the actual paste");
+            assert_eq!(frame(&mut app, &ctx, 1.25, vec![key(false, egui::Modifiers::NONE)]), 1);
+        }
+    }
+
+    #[test]
+    fn clipboard_history_after_a_completed_paste_does_not_paste_on_open() {
+        for explicit_press in [false, true] {
+            let mut app = image_app();
+            let ctx = egui::Context::default();
+            let mut first = vec![egui::Event::ModifiersChanged(egui::Modifiers::COMMAND), delivered()];
+            if explicit_press {
+                first.push(key(true, egui::Modifiers::COMMAND));
+            }
+            first.push(key(false, egui::Modifiers::COMMAND));
+            assert_eq!(frame(&mut app, &ctx, 1.0, first), 1);
+            // The integration drops Windows-key identity; Win+V can leave only this release.
+            assert_eq!(
+                frame(&mut app, &ctx, 1.1, vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE), key(false, egui::Modifiers::NONE)]),
+                1,
+                "opening history must not paste"
+            );
+            assert_eq!(
+                frame(&mut app, &ctx, 1.2, vec![delivered(), key(true, egui::Modifiers::COMMAND), key(false, egui::Modifiers::COMMAND)]),
+                2,
+                "choosing an item produces exactly one intentional paste"
+            );
+        }
+    }
+
+    #[test]
+    fn clipboard_history_and_plain_v_after_an_unrelated_shortcut_do_nothing() {
+        let mut app = image_app();
+        let ctx = egui::Context::default();
+        let copy = egui::Event::Key { key: egui::Key::C, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND };
+        frame(&mut app, &ctx, 1.0, vec![egui::Event::ModifiersChanged(egui::Modifiers::COMMAND), copy]);
+        assert_eq!(frame(&mut app, &ctx, 1.1, vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE), key(false, egui::Modifiers::NONE)]), 0);
+        assert_eq!(frame(&mut app, &ctx, 1.2, vec![key(true, egui::Modifiers::NONE), key(false, egui::Modifiers::NONE)]), 0);
+        assert_eq!(frame(&mut app, &ctx, 10.0, vec![key(false, egui::Modifiers::NONE)]), 0);
+    }
+
+    #[test]
+    fn delivered_image_is_authoritative_and_not_duplicated_by_keys() {
+        let mut app = image_app();
+        app.system_clipboard = true;
+        app.clipboard_override = Some(crate::create_ui::Clip::Text("newer OS contents".into()));
+        let ctx = egui::Context::default();
+        assert_eq!(frame(&mut app, &ctx, 1.0, vec![delivered(), key(true, egui::Modifiers::COMMAND), key(false, egui::Modifiers::COMMAND)]), 1);
+        assert_eq!(app.last_copied_image.as_ref().unwrap().2, vec![0, 255, 0, 255]);
+    }
+
+    #[test]
+    fn text_then_image_batch_pastes_image_and_keeps_its_cache() {
+        let mut app = image_app();
+        let ctx = egui::Context::default();
+        assert_eq!(frame(&mut app, &ctx, 1.0, vec![egui::Event::Paste("text".into()), delivered()]), 1);
+        assert_eq!(app.last_copied_image.unwrap().2, vec![0, 255, 0, 255]);
+    }
+
+    #[test]
+    fn image_then_text_batch_pastes_image_and_leaves_text_authoritative() {
+        let mut app = image_app();
+        let ctx = egui::Context::default();
+        assert_eq!(frame(&mut app, &ctx, 1.0, vec![delivered(), egui::Event::Paste("text".into())]), 1);
+        assert!(app.last_copied_image.is_none());
+        assert!(app.last_copied_file.is_none());
+    }
+
+    #[test]
+    fn separate_delivered_images_in_one_batch_each_paste_once() {
+        let mut app = image_app();
+        let ctx = egui::Context::default();
+        assert_eq!(
+            frame(&mut app, &ctx, 1.0, vec![delivered(), delivered(), key(true, egui::Modifiers::COMMAND), key(false, egui::Modifiers::COMMAND)]),
+            2
+        );
+    }
+
+    #[test]
+    fn explicit_control_shortcut_still_pastes_once_without_an_image_event() {
+        let mut app = image_app();
+        let ctx = egui::Context::default();
+        assert_eq!(frame(&mut app, &ctx, 1.0, vec![key(true, egui::Modifiers::COMMAND)]), 1);
+        assert_eq!(frame(&mut app, &ctx, 1.1, vec![key(false, egui::Modifiers::COMMAND)]), 1);
+    }
+
+    #[test]
+    fn delivered_image_obeys_focus_modal_and_permission_guards() {
+        let ctx = egui::Context::default();
+        let mut app = image_app();
+        app.palette_open = true;
+        assert_eq!(frame(&mut app, &ctx, 1.0, vec![delivered()]), 0);
+        app.palette_open = false;
+        app.views[0].organize = true;
+        assert_eq!(frame(&mut app, &ctx, 2.0, vec![delivered()]), 0);
+        app.views[0].organize = false;
+        app.apply_edit(pdfcraft_engine::Edit::Protect(pdfcraft_engine::Protection {
+            permissions_password: Some("owner".into()),
+            ..Default::default()
+        }));
+        let bytes = app.session.save_bytes(app.views[0].id).unwrap();
+        let mut restricted = PdfCraftApp::new();
+        restricted.open_bytes("restricted.pdf", None, bytes.as_ref().clone()).unwrap();
+        assert!(!restricted.session.get(restricted.views[0].id).unwrap().allows_modification());
+        assert_eq!(frame(&mut restricted, &ctx, 3.0, vec![delivered()]), 0);
+    }
+
+    #[test]
+    fn review_an_image_less_release_is_silent_but_explicit_paste_explains() {
+        let mut app = PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        app.toast = None;
+        let ctx = egui::Context::default();
+        ctx.run_ui(
+            egui::RawInput {
+                events: vec![egui::Event::Key {
+                    key: egui::Key::V,
+                    physical_key: None,
+                    pressed: false,
+                    repeat: false,
+                    modifiers: egui::Modifiers::NONE,
+                }],
+                ..Default::default()
+            },
+            |ui| app.clipboard_keys(0, ui.ctx()),
+        )
+        .drop_without_applying_deltas();
+        assert!(app.toast.is_none());
+        assert!(!app.paste_image(0, None));
+        assert!(app.toast.is_some(), "an explicit menu action still explains why there is no image");
+    }
+
+    #[test]
+    fn review_text_paste_release_is_silent_and_later_image_paste_still_works() {
+        let mut app = PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        app.last_copied_image = Some((1, 1, vec![255, 0, 0, 255]));
+        app.palette_open = true; // A text field owns the first event.
+        let ctx = egui::Context::default();
+        ctx.run_ui(egui::RawInput { events: vec![egui::Event::Paste("text".into())], ..Default::default() }, |ui| app.clipboard_keys(0, ui.ctx()))
+            .drop_without_applying_deltas();
+        assert!(app.last_copied_image.is_none());
+        app.palette_open = false;
+        app.toast = None;
+        ctx.run_ui(
+            egui::RawInput {
+                events: vec![egui::Event::Key {
+                    key: egui::Key::V,
+                    physical_key: None,
+                    pressed: false,
+                    repeat: false,
+                    modifiers: egui::Modifiers::NONE,
+                }],
+                ..Default::default()
+            },
+            |ui| app.clipboard_keys(0, ui.ctx()),
+        )
+        .drop_without_applying_deltas();
+        assert!(app.toast.is_none(), "the text gesture's key release must be silent");
+        app.clipboard_override = None;
+        let delivered = egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([1, 1], egui::Color32::GREEN)));
+        ctx.run_ui(egui::RawInput { events: vec![delivered], ..Default::default() }, |ui| app.clipboard_keys(0, ui.ctx()))
+            .drop_without_applying_deltas();
+        let id = app.active_ids().unwrap().1;
+        assert_eq!(app.session.get(id).unwrap().page_images(0).len(), 1, "a later real image shortcut still works");
+    }
+
+    #[test]
+    fn review_failed_keyboard_cut_keeps_the_image_selection() {
+        let mut app = PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        app.views[0].image_selection = Some(crate::edit_text_ui::ImageSelection::at(0, 0));
+        let ctx = egui::Context::default();
+        ctx.run_ui(egui::RawInput { events: vec![egui::Event::Cut], ..Default::default() }, |ui| app.clipboard_keys(0, ui.ctx()))
+            .drop_without_applying_deltas();
+        assert!(app.views[0].image_selection.is_some());
+    }
+}
diff --git a/crates/ui-egui/src/app/control.rs b/crates/ui-egui/src/app/control.rs
index 79bd2fa258..26e20f8df5 100644
--- a/crates/ui-egui/src/app/control.rs
+++ b/crates/ui-egui/src/app/control.rs
@@ -32,6 +32,9 @@ impl PdfCraftApp {
                 };
                 self.set_theme_preference(preference);
             }
+            ("show_page_edge_shadows", _) => {
+                self.show_page_edge_shadows = value.parse::<bool>().map_err(|_| "show_page_edge_shadows must be true or false")?;
+            }
             ("scroll_speed", _) => {
                 self.scroll_speed = scroll_speed::ScrollSpeed::parse(value).ok_or("scroll_speed must be slow, normal, or fast")?;
             }
@@ -167,6 +170,12 @@ impl PdfCraftApp {
                     _ => return Err("default-page-gaps must be on or off".into()),
                 };
             }
+            ("recent-files", _) => {
+                let max = crate::RECENT_FILES_MAX;
+                let limit = value.parse().ok().filter(|n| *n <= max).ok_or_else(|| format!("recent-files must be between 0 and {max}"))?;
+                self.recent_limit = limit;
+                self.recent.truncate(limit);
+            }
             ("cover", Some(v)) => {
                 let on = match value {
                     "on" => true,
diff --git a/crates/ui-egui/src/app/files.rs b/crates/ui-egui/src/app/files.rs
index 3c68dc5619..29e6978461 100644
--- a/crates/ui-egui/src/app/files.rs
+++ b/crates/ui-egui/src/app/files.rs
@@ -117,6 +117,7 @@ impl PdfCraftApp {
             after_open: request.after_open,
             recovered: request.recovered,
             then: request.then,
+            display_override: None,
         });
         Ok(token)
     }
@@ -147,6 +148,7 @@ impl PdfCraftApp {
         // earlier waiting replies, without consuming a blocked receiver's result.
         waiting.append(&mut self.pending_opens);
         self.pending_opens = waiting;
+        self.settle_launch_layout();
     }
 
     #[cfg(not(target_arch = "wasm32"))]
@@ -182,6 +184,12 @@ impl PdfCraftApp {
                         if let Some(destination) = pending.after_open {
                             self.apply_remote_destination(destination);
                         }
+                        if let Some((layout, continuous)) = pending.display_override
+                            && let Some(view) = self.views.iter_mut().find(|view| view.id == id)
+                        {
+                            view.set_display(layout, continuous);
+                            self.launch_display_target = Some(id);
+                        }
                         if let Some(meta) = &pending.recovered {
                             self.finish_recovery(meta);
                         }
@@ -205,6 +213,7 @@ impl PdfCraftApp {
                         recovered: pending.recovered,
                         then: pending.then,
                         after_open: pending.after_open,
+                        display_override: pending.display_override,
                     });
                 }
                 Err(error) => self.notify_fmt("Couldn't open {name}: {e}", &[("name", &pending.name), ("e", &error.to_string())]),
@@ -239,6 +248,7 @@ impl PdfCraftApp {
                     recovered: None,
                     then: None,
                     after_open: None,
+                    display_override: None,
                 });
                 return Ok(());
             }
@@ -323,7 +333,7 @@ impl PdfCraftApp {
             macos_association::repair(std::path::Path::new(&p));
             self.recent.retain(|r| r.path != p);
             self.recent.insert(0, RecentFile { name: name.to_string(), path: p, pages, size });
-            self.recent.truncate(12);
+            self.recent.truncate(self.recent_limit);
         }
         // What the form's scripts said while it opened (messages, errors) shows now, not with
         // the next edit.
@@ -416,6 +426,8 @@ impl PdfCraftApp {
             if let Some(meta) = p.recovered {
                 self.recoverable.push(meta);
             }
+            #[cfg(not(target_arch = "wasm32"))]
+            self.settle_launch_layout();
             return;
         };
         #[cfg(not(target_arch = "wasm32"))]
@@ -431,6 +443,11 @@ impl PdfCraftApp {
                 recovered: p.recovered.clone(),
                 then: p.then,
             });
+            if let Ok(token) = &result
+                && let Some(pending) = self.pending_opens.iter_mut().find(|pending| pending.token == *token)
+            {
+                pending.display_override = p.display_override;
+            }
             if let Err(error) = result {
                 let mut prompt = p;
                 prompt.error = Some(error);
@@ -458,6 +475,15 @@ impl PdfCraftApp {
                 if let Some(destination) = after_open {
                     self.apply_remote_destination(destination);
                 }
+                if let Some((layout, continuous)) = p.display_override
+                    && let Some(view) = self.views.last_mut()
+                {
+                    view.set_display(layout, continuous);
+                    #[cfg(not(target_arch = "wasm32"))]
+                    {
+                        self.launch_display_target = Some(view.id);
+                    }
+                }
                 if let Some(meta) = &p.recovered {
                     self.finish_recovery(meta);
                 }
@@ -472,9 +498,12 @@ impl PdfCraftApp {
                     prompt.recovered = p.recovered;
                     prompt.then = p.then;
                     prompt.after_open = after_open;
+                    prompt.display_override = p.display_override;
                 }
             }
         }
+        #[cfg(not(target_arch = "wasm32"))]
+        self.settle_launch_layout();
     }
 
     /// Ask for the active document's permissions password, then run `then` (if any).
@@ -533,17 +562,37 @@ impl PdfCraftApp {
     /// the file opened, focused its tab, was handed to the background worker, or failed.
     #[cfg(not(target_arch = "wasm32"))]
     pub(crate) fn open_path_then(&mut self, path: &str, then: Option<&'static str>) -> OpenOutcome {
+        self.open_path_request(path, then, None)
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn open_path_request(&mut self, path: &str, then: Option<&'static str>, display_override: Option<(canvas::PageLayout, bool)>) -> OpenOutcome {
         // One file, one tab (#2166): a file that is open already comes to the front instead,
         // and the tool it was opened for runs on it. One still being opened is left to that.
         if let Some(i) = self.tab_showing(path) {
             self.startup_superseded = true;
             self.active = Some(i);
+            if let Some((layout, continuous)) = display_override
+                && let Some(view) = self.views.get_mut(i)
+            {
+                view.set_display(layout, continuous);
+                self.launch_display_target = Some(view.id);
+            }
             if let Some(command) = then {
                 self.execute(command);
             }
             return OpenOutcome::Focused;
         }
-        if self.pending_opens.iter().any(|p| p.path.as_deref().is_some_and(|p| same_file(p, path))) {
+        if let Some(pending) = self.pending_opens.iter_mut().find(|p| p.path.as_deref().is_some_and(|p| same_file(p, path))) {
+            if display_override.is_some() {
+                pending.display_override = display_override;
+            }
+            return OpenOutcome::Pending;
+        }
+        if display_override.is_some()
+            && let Some(prompt) = self.password_prompt.as_mut().filter(|p| p.path.as_deref().is_some_and(|p| same_file(p, path)))
+        {
+            prompt.display_override = display_override;
             return OpenOutcome::Pending;
         }
         let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string());
@@ -552,18 +601,29 @@ impl PdfCraftApp {
         // Before the first frame there is no interaction to keep responsive; this also preserves
         // deterministic inline startup and test flows. Once live, reading and preparation use
         // the bounded worker and commit on the UI thread.
-        if self.ctx.is_none() || self.run_inline {
+        // Keep flagged launch files behind an existing password prompt or picker.
+        if (self.ctx.is_none() || self.run_inline) && !(display_override.is_some() && (self.modal_open() || self.pickers.pending())) {
             match std::fs::read(path) {
                 Ok(bytes) => {
                     let before = self.views.len();
+                    let previous_prompt = self.password_prompt.as_ref().map(|p| p.bytes.clone());
                     if let Err(error) = self.open_bytes(&name, Some(path.to_string()), bytes) {
                         self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
                         return OpenOutcome::Failed;
                     }
-                    if let Some(prompt) = self.password_prompt.as_mut().filter(|p| p.path.as_deref() == Some(path)) {
+                    if let Some(prompt) = self.password_prompt.as_mut().filter(|p| {
+                        p.path.as_deref() == Some(path) && previous_prompt.as_ref().is_none_or(|bytes| !std::sync::Arc::ptr_eq(bytes, &p.bytes))
+                    }) {
                         // Encrypted: the tool runs once the password is in.
                         prompt.then = then;
+                        prompt.display_override = display_override;
                     } else if self.views.len() > before {
+                        if let Some((layout, continuous)) = display_override
+                            && let Some(view) = self.views.last_mut()
+                        {
+                            view.set_display(layout, continuous);
+                            self.launch_display_target = Some(view.id);
+                        }
                         if let Some(doc) = self.views.last().map(|view| view.id) {
                             self.watch.known_as(doc, stamp);
                         }
@@ -595,7 +655,12 @@ impl PdfCraftApp {
                 recovered: None,
                 then,
             }) {
-                Ok(_) => OpenOutcome::Pending,
+                Ok(token) => {
+                    if let Some(pending) = self.pending_opens.iter_mut().find(|pending| pending.token == token) {
+                        pending.display_override = display_override;
+                    }
+                    OpenOutcome::Pending
+                }
                 Err(error) => {
                     self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &error)]);
                     OpenOutcome::Failed
@@ -604,6 +669,38 @@ impl PdfCraftApp {
         }
     }
 
+    /// Apply an explicit launch layout after the command-line display overrides settle.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn set_launch_layout(&mut self, value: &str) -> Result<(), String> {
+        let (layout, continuous) = canvas::parse_display_token(value).ok_or("layout must be single, continuous, two-up or two-page")?;
+        self.launch_layout = Some((layout, continuous));
+        self.settle_launch_layout();
+        Ok(())
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    fn settle_launch_layout(&mut self) {
+        if self.pending_opens.iter().any(|open| open.display_override.is_some())
+            || self.password_prompt.as_ref().is_some_and(|prompt| prompt.display_override.is_some())
+        {
+            return;
+        }
+        // Follow the existing completion/activation order, not a guessed tab index or path.
+        // Failed or cancelled opens cannot cause the layout to land on a restored document.
+        if let Some((layout, continuous)) = self.launch_layout.take()
+            && let Some(id) = self.launch_display_target
+            && let Some(view) = self.views.iter_mut().find(|view| view.id == id)
+        {
+            view.set_display(layout, continuous);
+        }
+    }
+
+    /// Open one native file with a transient display override, including after a password prompt.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub fn open_path_with_display(&mut self, path: &str, layout: canvas::PageLayout, continuous: bool) {
+        self.open_path_request(path, None, Some((layout, continuous)));
+    }
+
     /// The File ▸ Open picker: PDFs, and images and text that become PDFs.
     #[cfg(not(target_arch = "wasm32"))]
     pub(super) fn open_picker() -> rfd::AsyncFileDialog {
diff --git a/crates/ui-egui/src/app/keys.rs b/crates/ui-egui/src/app/keys.rs
index 6021af64d8..c014453806 100644
--- a/crates/ui-egui/src/app/keys.rs
+++ b/crates/ui-egui/src/app/keys.rs
@@ -3,7 +3,6 @@ use super::*;
 impl PdfCraftApp {
     pub(super) fn shortcuts(&mut self, ctx: &egui::Context) {
         use egui::Key;
-        let pasted = self.paste_key_released(ctx);
         // "Save changes?" is modal: its keys are its own (⌘D is Don't save there, not Document
         // properties; Escape cancels it rather than clearing a selection), and nothing may run
         // underneath it. They are read here, before the canvas can consume them.
@@ -78,8 +77,7 @@ impl PdfCraftApp {
                 prepare::nudge_keys(ctx, &mut self.views[i], doc);
             }
             canvas::shortcuts(&mut self.views[i], ctx, self.scroll_speed);
-            self.copy_key(i, ctx);
-            self.paste_image_key(i, ctx, pasted);
+            self.clipboard_keys(i, ctx);
             self.image_pick_keys(i, ctx);
         }
     }
diff --git a/crates/ui-egui/src/app/prefs.rs b/crates/ui-egui/src/app/prefs.rs
index e5eaae5863..c2a7de31dc 100644
--- a/crates/ui-egui/src/app/prefs.rs
+++ b/crates/ui-egui/src/app/prefs.rs
@@ -78,7 +78,7 @@ impl PdfCraftApp {
         let mut v = serde_json::json!({
             "side_panels": self.side_panels.to_json(self.left_open),
             "docking_right": self.right,
-            "recent": self.recent,
+            "recent": self.recent.iter().take(self.recent_limit).collect::<Vec<_>>(),
             "reopen_last_session": self.reopen_last_session,
             "restore_last_view": self.restore_last_view,
             "last_views": self.last_views_to_save(),
@@ -139,10 +139,13 @@ impl PdfCraftApp {
         });
         // Set apart: one more key inside the macro above passes serde_json's recursion limit.
         v["default_page_gaps"] = serde_json::Value::Bool(self.view_defaults.show_page_gaps);
+        v["recent_limit"] = serde_json::json!(self.recent_limit);
         v["fill_text_color"] = serde_json::json!(self.fill_text_color);
         v["redact_prefs"] = self.redact_defaults.to_json();
+        v["pinned_tools"] = serde_json::json!(self.pinned_tools);
         // Set outside json! above, which is at serde_json's macro recursion limit.
         v["hide_empty_highlight_hover"] = serde_json::Value::Bool(self.comment_prefs.hide_empty_highlight_hover);
+        v["show_page_edge_shadows"] = self.show_page_edge_shadows.into();
         v["comment_tool_pinned"] = serde_json::Value::Bool(self.comment_prefs.pinned);
         v["show_secured_notice"] = serde_json::Value::Bool(self.show_secured_notice);
         v["organize_zoom"] = serde_json::json!(self.organize_zoom);
@@ -179,6 +182,11 @@ impl PdfCraftApp {
             let r: Vec<RecentFile> = r.into_iter().filter(|f| std::path::Path::new(&f.path).exists()).collect();
             self.recent = r;
         }
+        // Nonsense keeps the limit it had; settings from before the limit have none.
+        if let Some(limit) = v["recent_limit"].as_u64() {
+            self.recent_limit = usize::try_from(limit).map_or(crate::RECENT_FILES_MAX, |n| n.min(crate::RECENT_FILES_MAX));
+        }
+        self.recent.truncate(self.recent_limit);
         self.restore_layout_prefs(&v);
         self.restore_behavior_prefs(&v);
         self.restore_view_prefs(&v);
@@ -206,6 +214,18 @@ impl PdfCraftApp {
             self.show_secured_notice = on;
         }
         self.pinned.restore(&v["pinned_folders"]);
+        if let Some(items) = v.get("pinned_tools").and_then(serde_json::Value::as_array) {
+            let mut tools = Vec::new();
+            for item in items {
+                if let Some(id) = item.as_str()
+                    && pdfcraft_engine::catalog::group(id).is_some()
+                    && !tools.iter().any(|t| t == id)
+                {
+                    tools.push(id.to_string());
+                }
+            }
+            self.pinned_tools = tools;
+        }
         if let Ok(preference) = serde_json::from_value::<ThemePreference>(v["theme"].clone()) {
             self.set_theme_preference(preference);
         }
@@ -267,6 +287,9 @@ impl PdfCraftApp {
         {
             self.fill_text_color = color;
         }
+        if let Some(show) = v["show_page_edge_shadows"].as_bool() {
+            self.show_page_edge_shadows = show;
+        }
         if let Some(prefs) = RedactPrefs::from_json(&v["redact_prefs"]) {
             self.redact_prefs = prefs.clone();
             self.redact_defaults = prefs;
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index 8b280ba75d..7a0976644b 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -84,6 +84,175 @@ pub enum Fit {
     None,
 }
 
+use crate::edit_text_ui::ImageHandle;
+
+/// Extension trait on `egui::Painter` to draw polygons.
+pub trait PainterExt {
+    fn polygon(&self, points: Vec<Pos2>, fill: Color32, stroke: Stroke) -> egui::layers::ShapeIdx;
+}
+
+impl PainterExt for egui::Painter {
+    fn polygon(&self, points: Vec<Pos2>, fill: Color32, stroke: Stroke) -> egui::layers::ShapeIdx {
+        self.add(egui::Shape::convex_polygon(points, fill, stroke))
+    }
+}
+
+/// User-space selectable bounding box for an image object.
+/// If the image object has an active clipping path applied to it (the crop box),
+/// this is the mathematical intersection of the full CTM-derived rect and the clipping path's rect.
+pub fn image_selectable_bounds(im: &pdfcraft_engine::PageImage) -> [f64; 4] {
+    if let Some(clip) = im.clip_rect {
+        let r = [im.rect[0].max(clip[0]), im.rect[1].max(clip[1]), im.rect[2].min(clip[2]), im.rect[3].min(clip[3])];
+        if r.iter().all(|v| v.is_finite()) && r[2] > r[0] && r[3] > r[1] {
+            return r;
+        }
+    }
+    im.visible_rect.unwrap_or(im.rect)
+}
+
+/// Screen-space selectable bounding box for an image object.
+/// If the image object has an active clipping path applied to it (the crop box),
+/// the final selectable `egui::Rect` is the mathematical intersection of the image's
+/// full CTM-derived rect and the clipping path's rect.
+pub fn image_screen_rect(im: &pdfcraft_engine::PageImage, xf: &PageXform, info: &DocInfo, page: usize) -> Rect {
+    let full = xf.user_rect_f64(info, page, im.rect);
+    if let Some(clip) = im.clip_rect {
+        let clip_r = xf.user_rect_f64(info, page, clip);
+        let inter = full.intersect(clip_r);
+        if inter.is_positive() {
+            return inter;
+        }
+    }
+    if let Some(vr) = im.visible_rect {
+        let r = xf.user_rect_f64(info, page, vr);
+        if r.is_positive() {
+            return r;
+        }
+    }
+    full
+}
+
+/// An Oriented Bounding Box (OBB) representing a rotated rectangle in screen space,
+/// with 8 resize handles and rotated local axes.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct ImageObb {
+    pub s00: Pos2,
+    pub s10: Pos2,
+    pub s11: Pos2,
+    pub s01: Pos2,
+    pub s_bc: Pos2,
+    pub s_rc: Pos2,
+    pub s_tc: Pos2,
+    pub s_lc: Pos2,
+    pub s_rot: Pos2,
+    pub screen_center: Pos2,
+    pub u_axis: (f64, f64),
+    pub v_axis: (f64, f64),
+    pub is_rotated: bool,
+}
+
+impl ImageObb {
+    pub(crate) fn handle_cursor(&self, handle: ImageHandle) -> egui::CursorIcon {
+        let direction = self.handle_pos(handle) - self.screen_center;
+        match handle {
+            ImageHandle::TopLeft | ImageHandle::TopRight | ImageHandle::BottomLeft | ImageHandle::BottomRight => {
+                if direction.x * direction.y > 0.0 {
+                    egui::CursorIcon::ResizeNwSe
+                } else {
+                    egui::CursorIcon::ResizeNeSw
+                }
+            }
+            _ if direction.x.abs() > direction.y.abs() => egui::CursorIcon::ResizeHorizontal,
+            _ => egui::CursorIcon::ResizeVertical,
+        }
+    }
+
+    pub(crate) fn contains(&self, visible: Rect, p: Pos2) -> bool {
+        (visible.is_positive() && visible.contains(p)) || crate::edit_text_ui::quad_contains(self.corners(), p)
+    }
+
+    pub fn from_matrix(matrix: [f64; 6], xf: &PageXform, info: &DocInfo, page: usize) -> Self {
+        let m = crate::edit_text_ui::Matrix(matrix);
+        let p00 = m.apply(0.0, 0.0);
+        let p10 = m.apply(1.0, 0.0);
+        let p11 = m.apply(1.0, 1.0);
+        let p01 = m.apply(0.0, 1.0);
+
+        let s00 = crate::edit_text_ui::user_to_screen(xf, info, page, p00.0, p00.1);
+        let s10 = crate::edit_text_ui::user_to_screen(xf, info, page, p10.0, p10.1);
+        let s11 = crate::edit_text_ui::user_to_screen(xf, info, page, p11.0, p11.1);
+        let s01 = crate::edit_text_ui::user_to_screen(xf, info, page, p01.0, p01.1);
+
+        let s_bc = Pos2::new((s00.x + s10.x) * 0.5, (s00.y + s10.y) * 0.5);
+        let s_rc = Pos2::new((s10.x + s11.x) * 0.5, (s10.y + s11.y) * 0.5);
+        let s_tc = Pos2::new((s01.x + s11.x) * 0.5, (s01.y + s11.y) * 0.5);
+        let s_lc = Pos2::new((s00.x + s01.x) * 0.5, (s00.y + s01.y) * 0.5);
+
+        let screen_center = Pos2::new((s00.x + s10.x + s11.x + s01.x) * 0.25, (s00.y + s10.y + s11.y + s01.y) * 0.25);
+        let out_dir = s_tc - screen_center;
+        let out_len = out_dir.length().max(1e-4);
+        let out_norm = out_dir / out_len;
+        let s_rot = s_tc + out_norm * 24.0;
+
+        let [a, b, c, d, ..] = matrix;
+        let w_u = (a * a + b * b).sqrt().max(1e-6);
+        let h_v = (c * c + d * d).sqrt().max(1e-6);
+        let u_axis = (a / w_u, b / w_u);
+        let v_axis = (c / h_v, d / h_v);
+        // The fast rectangle path interprets labels in screen space. Use matrix
+        // resizing whenever the image's user-space axes are turned or reflected
+        // on screen, including page /Rotate and View > Rotate View.
+        let u = s10 - s00;
+        let v = s01 - s00;
+        let is_rotated = u.y.abs() > 1e-4 || v.x.abs() > 1e-4 || u.x < 0.0 || v.y > 0.0;
+
+        Self { s00, s10, s11, s01, s_bc, s_rc, s_tc, s_lc, s_rot, screen_center, u_axis, v_axis, is_rotated }
+    }
+
+    pub fn from_image(im: &pdfcraft_engine::PageImage, xf: &PageXform, info: &DocInfo, page: usize) -> Self {
+        let [a, b, c, d, ..] = im.matrix;
+        let is_rot = b.abs() > 1e-4 || c.abs() > 1e-4 || a < 0.0 || d < 0.0;
+        let bounds = image_selectable_bounds(im);
+        let matrix = if !is_rot && bounds[2] > bounds[0] && bounds[3] > bounds[1] {
+            [bounds[2] - bounds[0], 0.0, 0.0, bounds[3] - bounds[1], bounds[0], bounds[1]]
+        } else {
+            im.matrix
+        };
+        Self::from_matrix(matrix, xf, info, page)
+    }
+
+    pub fn handles(&self) -> [(ImageHandle, Pos2); 8] {
+        [
+            ImageHandle::TopLeft,
+            ImageHandle::TopCenter,
+            ImageHandle::TopRight,
+            ImageHandle::RightCenter,
+            ImageHandle::BottomRight,
+            ImageHandle::BottomCenter,
+            ImageHandle::BottomLeft,
+            ImageHandle::LeftCenter,
+        ]
+        .map(|h| (h, self.handle_pos(h)))
+    }
+
+    pub fn handle_pos(&self, handle: ImageHandle) -> Pos2 {
+        match handle {
+            ImageHandle::TopLeft => self.s01,
+            ImageHandle::TopCenter => self.s_tc,
+            ImageHandle::TopRight => self.s11,
+            ImageHandle::RightCenter => self.s_rc,
+            ImageHandle::BottomRight => self.s10,
+            ImageHandle::BottomCenter => self.s_bc,
+            ImageHandle::BottomLeft => self.s00,
+            ImageHandle::LeftCenter => self.s_lc,
+        }
+    }
+
+    pub fn corners(&self) -> [Pos2; 4] {
+        [self.s00, self.s10, self.s11, self.s01]
+    }
+}
+
 /// The page display as it was before full screen, put back on leaving it
 /// ([`DocView::enter_presentation`]).
 #[derive(Clone, Copy, Debug, PartialEq)]
@@ -569,6 +738,104 @@ pub enum ViewAction {
     CameraNext(&'static str),
 }
 
+/// Default page right-click menu actions.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum PageMenuAction {
+    RotateCCW,
+    RotateCW,
+    Print,
+    SelectTool,
+    HandTool,
+    MarqueeZoom,
+    Copy,
+    Paste(usize, [f64; 2]),
+    AddComment(usize, [f64; 2]),
+    AddBookmark,
+    TakeSnapshot,
+    EditPdf,
+    AddText,
+    AddImage,
+    DeletePage(usize),
+    ExportPdf,
+    Find,
+    DocProperties,
+    FlattenComments,
+}
+
+pub(crate) struct PageMenuPerms {
+    pub can_modify: bool,
+    pub can_assemble: bool,
+    pub can_annotate: bool,
+    pub can_print: bool,
+    pub can_copy: bool,
+    pub can_copy_items: bool,
+    pub can_paste: bool,
+    pub has_annotations: bool,
+}
+
+pub(crate) fn default_page_context_menu(ui: &mut egui::Ui, page: usize, at: [f64; 2], perms: PageMenuPerms, action: &mut Option<PageMenuAction>) {
+    use PageMenuAction as A;
+    // Takes `choice` when `entry` was clicked, and closes the menu.
+    let mut pick = |entry: egui::Response, ui: &mut egui::Ui, choice: PageMenuAction| {
+        if entry.clicked() {
+            *action = Some(choice);
+            ui.close();
+        }
+    };
+    let icon = |ui: &mut egui::Ui, name: &str, tip: &str| crate::icons::button(ui, name, 24.0, false, tip);
+    // Top horizontal icon bar: Rotate CCW, Print, Select tool, Hand tool, Marquee Zoom
+    ui.horizontal(|ui| {
+        ui.spacing_mut().item_spacing.x = 4.0;
+        pick(icon(ui, "rotate-ccw", tl!("Rotate view counterclockwise")), ui, A::RotateCCW);
+        ui.add_enabled_ui(perms.can_print, |ui| pick(icon(ui, "printer", tl!("Print")), ui, A::Print));
+        pick(icon(ui, "mouse-pointer-2", tl!("Select Tool")), ui, A::SelectTool);
+        pick(icon(ui, "hand", tl!("Hand Tool")), ui, A::HandTool);
+        pick(icon(ui, "zoom-in", tl!("Marquee Zoom")), ui, A::MarqueeZoom);
+    });
+
+    ui.separator();
+
+    pick(
+        ui.add_enabled(
+            perms.can_copy_items,
+            egui::Button::new(tl!("Copy")).shortcut_text(crate::commands::shortcut_label(ui.ctx(), crate::commands::COPY)),
+        ),
+        ui,
+        A::Copy,
+    );
+    pick(
+        ui.add_enabled(
+            perms.can_paste,
+            egui::Button::new(tl!("Paste")).shortcut_text(crate::commands::shortcut_label(ui.ctx(), pdfcraft_engine::commands::Shortcut::cmd("V"))),
+        ),
+        ui,
+        A::Paste(page, at),
+    );
+
+    ui.separator();
+
+    pick(ui.add_enabled(perms.can_annotate, egui::Button::new(tl!("Add comment"))), ui, A::AddComment(page, at));
+    if perms.has_annotations {
+        pick(ui.add_enabled(perms.can_modify, egui::Button::new(tl!("Flatten comments"))), ui, A::FlattenComments);
+    }
+    pick(ui.add_enabled(perms.can_assemble, egui::Button::new(tl!("Add bookmark"))), ui, A::AddBookmark);
+    pick(ui.add_enabled(perms.can_copy, egui::Button::new(tl!("Take a snapshot"))), ui, A::TakeSnapshot);
+
+    ui.separator();
+
+    pick(ui.add_enabled(perms.can_modify, egui::Button::new(egui::RichText::new(tl!("Edit this PDF")).strong())), ui, A::EditPdf);
+    pick(ui.add_enabled(perms.can_modify, egui::Button::new(tl!("Add text"))), ui, A::AddText);
+    pick(ui.add_enabled(perms.can_modify, egui::Button::new(tl!("Add image"))), ui, A::AddImage);
+    pick(ui.add_enabled(perms.can_assemble, egui::Button::new(tl!("Delete page"))), ui, A::DeletePage(page));
+    pick(ui.add_enabled(perms.can_copy, egui::Button::new(tl!("Export this PDF"))), ui, A::ExportPdf);
+
+    ui.separator();
+
+    pick(ui.button(tl!("Find text or tools")), ui, A::Find);
+    pick(ui.button(tl!("Rotate view clockwise")), ui, A::RotateCW);
+    pick(ui.button(tl!("Document properties…")), ui, A::DocProperties);
+}
+
 impl DocView {
     /// Whether a middle-button scrolling gesture is active (tests and automation).
     pub fn auto_scrolling(&self) -> bool {
@@ -862,6 +1129,7 @@ struct PageEnv<'a> {
     modal: bool,
     navigation_enabled: bool,
     paper: Color32,
+    show_page_edge_shadows: bool,
     ppp: f32,
     precise_scroll: Vec2,
     prefs: &'a comments::CommentPrefs,
@@ -885,6 +1153,7 @@ struct PageEnv<'a> {
     fill_text_size: f64,
     fill_text_color: [f64; 3],
     today: (i64, u32, u32),
+    can_paste_image: bool,
 }
 
 /// What the page-scroll closure produces for the rest of the frame.
@@ -902,6 +1171,7 @@ struct PageOut {
     open_initials: bool,
     open_signature: bool,
     open_table: Option<(usize, [f64; 4])>,
+    page_action: Option<PageMenuAction>,
     primary_down: bool,
     refused: Option<String>,
     stamp_placed: bool,
@@ -945,6 +1215,70 @@ struct PageSlot {
 
 /// Paints the page's paper, shadow and raster (or why it can't be shown), and asks for the renders
 /// it wants.
+#[allow(clippy::too_many_arguments)]
+fn paint_image_suppressed(
+    xf: &PageXform,
+    painter: &egui::Painter,
+    tex: egui::TextureId,
+    u0: f32,
+    v0: f32,
+    u1: f32,
+    v1: f32,
+    suppress: Option<[f32; 4]>,
+    is_full_page_tex: bool,
+) {
+    let Some([su0, sv0, su1, sv1]) = suppress else {
+        if is_full_page_tex {
+            xf.paint_page_texture_rect(painter, tex, u0, v0, u1, v1);
+        } else {
+            xf.paint_image(painter, tex, u0, v0, u1, v1);
+        }
+        return;
+    };
+    let iu0 = u0.max(su0);
+    let iu1 = u1.min(su1);
+    let iv0 = v0.max(sv0);
+    let iv1 = v1.min(sv1);
+    if iu0 >= iu1 || iv0 >= iv1 {
+        if is_full_page_tex {
+            xf.paint_page_texture_rect(painter, tex, u0, v0, u1, v1);
+        } else {
+            xf.paint_image(painter, tex, u0, v0, u1, v1);
+        }
+        return;
+    }
+    let map_uv = |pu: f32, pv: f32| -> (f32, f32) {
+        if is_full_page_tex {
+            (pu, pv)
+        } else {
+            let du = (u1 - u0).max(1e-6);
+            let dv = (v1 - v0).max(1e-6);
+            ((pu - u0) / du, (pv - v0) / dv)
+        }
+    };
+    let draw_strip = |pu0: f32, pv0: f32, pu1: f32, pv1: f32| {
+        if pu1 <= pu0 || pv1 <= pv0 {
+            return;
+        }
+        let (tu0, tv0) = map_uv(pu0, pv0);
+        let (tu1, tv1) = map_uv(pu1, pv1);
+        xf.paint_image_region(painter, tex, pu0, pv0, pu1, pv1, tu0, tv0, tu1, tv1);
+    };
+
+    if iv0 > v0 {
+        draw_strip(u0, v0, u1, iv0);
+    }
+    if v1 > iv1 {
+        draw_strip(u0, iv1, u1, v1);
+    }
+    if iu0 > u0 {
+        draw_strip(u0, iv0, iu0, iv1);
+    }
+    if u1 > iu1 {
+        draw_strip(iu1, iv0, u1, iv1);
+    }
+}
+
 fn paint_page_surface(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, slot: &PageSlot) {
     let PageEnv { paper, ppp, scale, t, tag, .. } = frame.env;
     let PageSlot { i, r, xf } = *slot;
@@ -952,7 +1286,7 @@ fn paint_page_surface(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFra
     let info = frame.env.info;
     let painter = ui.painter();
     // Shadows would darken the preceding page when pages touch.
-    if view.show_page_gaps {
+    if view.show_page_gaps && frame.env.show_page_edge_shadows {
         painter.add(egui::epaint::Shadow { offset: [0, 3], blur: 14, spread: 0, color: t.page_shadow }.as_shape(r, CornerRadius::ZERO));
     }
     painter.rect_filled(r, CornerRadius::ZERO, paper);
@@ -987,13 +1321,33 @@ fn paint_page_surface(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFra
             Some(p) => frame.wanted.push((i, tag_scale(p.tag), p.tag, None)),
             None => frame.wanted.push((i, want_scale, want_tag, None)),
         }
+        let doc = frame.env.doc;
+        let active_drag_suppress = if let Some(sel) = view.image_selection.clone()
+            && sel.page == i
+            && sel.drag.is_some()
+        {
+            let images = cached_edit_images(view, doc, i);
+            if let Some(img) = images.get(sel.index) {
+                let obb = ImageObb::from_image(img, &xf, info, i);
+                let uvs = obb.corners().map(|c| xf.screen_to_norm(c));
+                let u0 = uvs.iter().map(|(u, _)| *u).fold(1.0f32, f32::min).clamp(0.0, 1.0);
+                let u1 = uvs.iter().map(|(u, _)| *u).fold(0.0f32, f32::max).clamp(0.0, 1.0);
+                let v0 = uvs.iter().map(|(_, v)| *v).fold(1.0f32, f32::min).clamp(0.0, 1.0);
+                let v1 = uvs.iter().map(|(_, v)| *v).fold(0.0f32, f32::max).clamp(0.0, 1.0);
+                if u1 > u0 && v1 > v0 { Some([u0, v0, u1, v1]) } else { None }
+            } else {
+                None
+            }
+        } else {
+            None
+        };
         match view.pages.get(&i) {
             Some(p) => {
                 if !tiled && p.tag == want_tag {
-                    xf.texel_aligned(p.tex.size(), ppp).paint_image(painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0);
+                    paint_image_suppressed(&xf.texel_aligned(p.tex.size(), ppp), painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0, active_drag_suppress, true);
                 } else {
                     // A backdrop, or a raster at an older scale until the new one arrives.
-                    xf.paint_image(painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0);
+                    paint_image_suppressed(&xf, painter, p.tex.id(), 0.0, 0.0, 1.0, 1.0, active_drag_suppress, true);
                 }
             }
             None => {
@@ -1004,14 +1358,21 @@ fn paint_page_surface(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFra
             }
         }
         if tiled && r.intersects(visible) {
-            paint_page_tiles(ui, view, frame, slot, (pw_pt, ph_pt, max_side));
+            paint_page_tiles(ui, view, frame, slot, (pw_pt, ph_pt, max_side), active_drag_suppress);
         }
     }
 }
 
 /// Paints the tiles of a page too big to draw whole: the tiles of earlier zooms first, stretched,
 /// then the visible tiles of this one, nearest the viewport centre first, asking for those missing.
-fn paint_page_tiles(ui: &egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>, slot: &PageSlot, (pw_pt, ph_pt, max_side): (f32, f32, f32)) {
+fn paint_page_tiles(
+    ui: &egui::Ui,
+    view: &mut DocView,
+    frame: &mut PageFrame<'_>,
+    slot: &PageSlot,
+    (pw_pt, ph_pt, max_side): (f32, f32, f32),
+    active_drag_suppress: Option<[f32; 4]>,
+) {
     let PageEnv { ppp, scale, tag, .. } = frame.env;
     let PageSlot { i, r, xf } = *slot;
     let visible = frame.visible;
@@ -1040,7 +1401,7 @@ fn paint_page_tiles(ui: &egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>
         let (ow, oh) = (device_pixels(pw_pt, s) as f32, device_pixels(ph_pt, s) as f32);
         let [w, h] = tex.size();
         let (x, y) = (ox as f32, oy as f32);
-        xf.paint_image(painter, tex.id(), x / ow, y / oh, (x + w as f32) / ow, (y + h as f32) / oh);
+        paint_image_suppressed(&xf, painter, tex.id(), x / ow, y / oh, (x + w as f32) / ow, (y + h as f32) / oh, active_drag_suppress, false);
     }
     // Visible tiles, nearest the viewport centre first: each tile costs a full
     // page interpret, so the workers sharpen what is looked at before the edges.
@@ -1065,13 +1426,16 @@ fn paint_page_tiles(ui: &egui::Ui, view: &mut DocView, frame: &mut PageFrame<'_>
         frame.wanted.push((i, scale, tag, Some(Tile { x, y, w, h })));
         if let Some(tex) = view.tiles.get(&(i, tag, x, y)) {
             let (fw, fh) = (dw as f32, dh as f32);
-            xf.texel_aligned([dw as usize, dh as usize], ppp).paint_image(
+            paint_image_suppressed(
+                &xf.texel_aligned([dw as usize, dh as usize], ppp),
                 painter,
                 tex.id(),
                 x as f32 / fw,
                 y as f32 / fh,
                 (x + w) as f32 / fw,
                 (y + h) as f32 / fh,
+                active_drag_suppress,
+                false,
             );
         }
     }
@@ -1326,9 +1690,18 @@ fn page_tool_input(ui: &mut egui::Ui, view: &mut DocView, frame: &mut PageFrame<
             info,
             allow_interaction: !others_own_pointer && (matches!(view.router.owner(i), Some(crate::page_router::Owner::Picture { .. })) || !text_used),
         };
-        let image_used = crate::edit_text_ui::image_input(&image_cx, &images, view, &mut frame.out.image_action);
+        let image_used = crate::edit_text_ui::image_input(&image_cx, &images, view);
         !others_own_pointer && (text_used || image_used)
     };
+    if tool == QuickTool::EditText {
+        if others_own_pointer {
+            if ptr.pressed().is_some() || resp.clicked() || resp.secondary_clicked() {
+                view.image_selection = None;
+            }
+        } else {
+            crate::content_ui::sync_image_selection(view, i, &images, added);
+        }
+    }
     let on_link = tool == QuickTool::Link && can_modify && crate::link_ui::page_input(cx, doc_links, view);
     if tool == QuickTool::Select
         && resp.secondary_clicked()
@@ -1366,17 +1739,20 @@ fn edit_inventory(
             l
         }
     };
-    let images = match view.edit_images.get(&i) {
-        Some((g, l)) if *g == generation => l.clone(),
-        _ => {
-            let l = doc.page_images(i);
-            view.edit_images.insert(i, (generation, l.clone()));
-            l
-        }
-    };
+    let images = cached_edit_images(view, doc, i).to_vec();
     (lines, images)
 }
 
+/// Images parsed once per page and document edit generation, shared by painting and menus.
+fn cached_edit_images<'a>(view: &'a mut DocView, doc: &pdfcraft_engine::Document, page: usize) -> &'a [pdfcraft_engine::PageImage] {
+    let generation = doc.edit_generation();
+    let entry = view.edit_images.entry(page).or_insert_with(|| (generation, doc.page_images(page)));
+    if entry.0 != generation {
+        *entry = (generation, doc.page_images(page));
+    }
+    &entry.1
+}
+
 /// What the page modules have under a point on one page, for the page router.
 struct PageHits<'a> {
     page: usize,
@@ -1425,6 +1801,19 @@ impl PageHits<'_> {
             images,
             clip,
         } = *self;
+        // Crop mode owns presses on its page, including the controls beside its
+        // frame. Underlying paragraphs and the empty-page marquee must not take
+        // a crop button's press before the image module receives it.
+        if tool == QuickTool::EditText
+            && can_modify
+            && let Some(selection) = view.image_selection.as_ref().filter(|s| s.page == page && s.crop.is_some())
+        {
+            return vec![crate::page_router::Hit::new(
+                crate::page_router::Owner::Picture { index: selection.index, part: crate::page_router::PicturePart::Body },
+                crate::page_cursor::Layer::Handle,
+                egui::CursorIcon::Default,
+            )];
+        }
         let fields = if preparing {
             crate::prepare::hit(xf, info, page, form, field_tool, prepare_allowed, &view.prepare, p)
         } else if tool == QuickTool::Select {
@@ -1934,6 +2323,7 @@ fn cancel_on_escape(ctx: &egui::Context, view: &mut DocView, ptr: &PagePointer)
     }
 }
 
+#[allow(clippy::cognitive_complexity)]
 fn draw_pages(
     ui: &mut egui::Ui,
     viewport: Rect,
@@ -1967,6 +2357,8 @@ fn draw_pages(
         prefs,
         preparing,
         selection_wheel,
+        ppp,
+        rects,
         single_paging,
         tool,
         unobstructed,
@@ -2033,6 +2425,38 @@ fn draw_pages(
     if resp.secondary_clicked() {
         // Set again below when the right-click lands on a link.
         view.links.context = None;
+        let mut over_image = false;
+        if tool == QuickTool::EditText {
+            let pointer_pos = ptr.pos;
+            if let Some(p) = pointer_pos {
+                for &page_idx in visible_pages {
+                    let r = snap_to_pixels(rects[page_idx].translate(origin.to_vec2()), ppp);
+                    if !r.intersects(visible) {
+                        continue;
+                    }
+                    let xf =
+                        PageXform { rect: r, rot: view.rotation, pw: info.pages[page_idx].width.max(1.0), ph: info.pages[page_idx].height.max(1.0) };
+                    let images = cached_edit_images(view, doc, page_idx).to_vec();
+                    for (idx, img) in images.iter().enumerate().rev() {
+                        let obb = ImageObb::from_image(img, &xf, info, page_idx);
+                        let b = image_screen_rect(img, &xf, info, page_idx);
+                        if obb.contains(b, p) {
+                            over_image = true;
+                            if view.image_selection.as_ref().is_none_or(|s| s.page != page_idx || s.index != idx) {
+                                view.image_selection = Some(crate::edit_text_ui::ImageSelection::at(page_idx, idx));
+                            }
+                            break;
+                        }
+                    }
+                    if over_image {
+                        break;
+                    }
+                }
+            }
+        }
+        if !over_image && tool == QuickTool::EditText {
+            view.image_selection = None;
+        }
     }
     let mut frame = PageFrame {
         env: *env,
@@ -2062,20 +2486,22 @@ fn draw_pages(
     let PageOut {
         mut canvas_action,
         clicked_link,
-        mut copy_selected,
+        copy_selected,
         mut field_menu,
         field_placed,
         field_props,
         hover_text: _,
-        image_action,
+        mut image_action,
         open_boxes,
         open_initials,
         open_signature,
         open_table,
+        page_action: _,
         primary_down: _,
         refused,
         stamp_placed,
     } = page_out;
+    let mut page_action: Option<PageMenuAction> = None;
     let painter = ui.painter();
     if calc_order {
         view.calc_order.set_hover_page(calc_hover);
@@ -2195,20 +2621,33 @@ fn draw_pages(
             }
             return;
         }
-        if view.comments.selected.is_none() {
-            let selected = view.selected_text().is_some_and(|t| !t.is_empty());
-            let key = crate::commands::shortcut_label(ui.ctx(), crate::commands::COPY);
-            if ui.add_enabled(can_copy && selected, egui::Button::new(tl!("Copy")).shortcut_text(key)).clicked() {
-                copy_selected = true;
-                ui.close();
-            }
-            ui.separator();
+        let can_paste_image = env.can_paste_image;
+        let is_image_menu = tool == QuickTool::EditText
+            && (ui.ctx().data_mut(|d| d.get_temp::<bool>(crate::edit_text_ui::image_menu_id())).unwrap_or(false)
+                || view.image_selection.clone().is_some_and(|sel| {
+                    let pointer_pos = ptr.pos;
+                    let Some(p) = pointer_pos else { return false };
+                    let Some((_, xf)) = view.screen_xforms.iter().find(|(page_idx, _)| *page_idx == sel.page).cloned() else { return false };
+                    let images = cached_edit_images(view, doc, sel.page).to_vec();
+                    let Some(img) = images.get(sel.index) else { return false };
+                    let obb = ImageObb::from_image(img, &xf, info, sel.page);
+                    let b = image_screen_rect(img, &xf, info, sel.page);
+                    obb.contains(b, p)
+                }));
+        if is_image_menu && let Some(sel) = view.image_selection.clone() {
+            let images = cached_edit_images(view, doc, sel.page).to_vec();
+            let at = view.comments.context_at.map(|(_, at)| at);
+            let rotation = (view.rotation % 360 + info.pages.get(sel.page).map_or(0, |p| p.rotation % 360)) % 360;
+            crate::edit_text_ui::image_context_menu(ui, view, &images, sel.page, sel.index, can_paste_image, &mut image_action, at, rotation);
+            return;
+        }
+        if view.comments.selected.is_some() {
+            canvas_action = comments::context_menu(ui, view, info, &|page, index| doc.annotation_deletable(page, index), prefs, allowed, can_modify);
+            return;
         }
         // Over a picture (and no comment): Copy Image, as in Acrobat's page menu.
         let mut copy_image = None;
-        if view.comments.selected.is_none()
-            && let Some((page, at)) = view.comments.context_at
-        {
+        if let Some((page, at)) = view.comments.context_at {
             // The page's content is parsed once per right-click, not on every frame the menu is open.
             let key = egui::Id::unique("copy-image-under-menu");
             let cached = ui.data(|d| d.get_temp::<(usize, [f64; 2], Option<usize>)>(key)).filter(|c| c.0 == page && c.1 == at);
@@ -2232,9 +2671,28 @@ fn draw_pages(
                 ui.separator();
             }
         }
-        canvas_action =
-            comments::context_menu(ui, view, info, &|page, index| doc.annotation_deletable(page, index), prefs, allowed, can_modify).or(copy_image);
+        let has_copy_image = copy_image.is_some();
+        if copy_image.is_some() {
+            canvas_action = copy_image;
+        }
+        let (page, at) = view.comments.context_at.unwrap_or((view.current, [0.0, 0.0]));
+        let can_copy_items = can_copy && (view.image_selection.is_some() || view.selected_text().is_some() || has_copy_image);
+        let can_paste = can_paste_image && can_modify;
+        let perms = PageMenuPerms {
+            can_modify,
+            can_assemble: doc.allows_assembly(),
+            can_annotate: allowed,
+            can_print: doc.allows_printing(),
+            can_copy,
+            can_copy_items,
+            can_paste,
+            has_annotations: !info.annotations.is_empty(),
+        };
+        default_page_context_menu(ui, page, at, perms, &mut page_action);
     });
+    if !resp.context_menu_opened() {
+        ui.ctx().data_mut(|d| d.insert_temp(crate::edit_text_ui::image_menu_id(), false));
+    }
     *out = PageOut {
         canvas_action,
         clicked_link,
@@ -2248,6 +2706,7 @@ fn draw_pages(
         open_initials,
         open_signature,
         open_table,
+        page_action,
         primary_down: ptr.primary_down,
         refused,
         stamp_placed,
@@ -2358,6 +2817,7 @@ fn read_wheel(ui: &mut egui::Ui, view: &mut DocView, avail: Rect, single_paging:
         // The turn leaves egui's eased copy of the notch to decay for a few frames; it must not
         // scroll the page just shown away from its top (or bottom).
         view.precise_scroll_until = now + 0.25;
+        view.fling.stop();
     }
     // Paging owns the vertical axis in single-page view; leave it to the pager.
     // The rest of a gesture that turned the page is swallowed too, or it would pan the new page
@@ -2991,6 +3451,14 @@ fn refine_goto_point(mut scroll: egui::ScrollArea, view: &mut DocView, geometry:
 /// scroll area with this frame's zoom, scrolling, tool input, overlays and render requests.
 pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
+    let can_paste_key = egui::Id::unique("can-paste-image");
+    let can_paste_image = if ui.input(|i| i.pointer.secondary_pressed()) {
+        let can = app.can_paste_image();
+        ui.data_mut(|d| d.insert_temp(can_paste_key, can));
+        can
+    } else {
+        ui.data(|d| d.get_temp(can_paste_key)).unwrap_or(false)
+    };
     // Keyboard scrolling applies to this frame's page view only, never later.
     let key_scroll = std::mem::take(&mut app.views[index].key_scroll);
     if key_scroll != 0.0 {
@@ -3049,7 +3517,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     if view.organize {
         // One remembered grid size for every document, kept in the settings.
         view.set_grid_zoom(organize_zoom);
-        organize_grid(view, info, doc.allows_assembly(), doc.dirty, unobstructed, ui, &t);
+        organize_grid(view, doc, unobstructed, app.show_page_edge_shadows, ui, &t);
         app.organize_zoom = view.grid_zoom();
         return;
     }
@@ -3204,6 +3672,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         modal,
         navigation_enabled,
         paper,
+        show_page_edge_shadows: app.show_page_edge_shadows,
         ppp,
         precise_scroll,
         prefs,
@@ -3227,9 +3696,10 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         fill_text_size: app.fill_text_size,
         fill_text_color: app.fill_text_color,
         today,
+        can_paste_image,
     };
     let mut page_out = PageOut::default();
-    let out = page_scroll(ui, scroll, egui::Id::unique(("page-view-scope", view.id)), |ui, viewport| {
+    let out = page_scroll(ui, scroll, egui::Id::unique(("page-view-scope", view.id)), app.show_page_edge_shadows, |ui, viewport| {
         draw_pages(ui, viewport, view, &env, &mut page_out, &mut app.signature_preview)
     });
     let PageOut {
@@ -3245,6 +3715,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         open_initials,
         open_signature,
         open_table,
+        page_action,
         primary_down,
         mut refused,
         stamp_placed,
@@ -3284,8 +3755,12 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     if preparing {
         crate::prepare::keys(ui.ctx(), view);
     }
+    if tool != QuickTool::EditText {
+        view.image_selection = None;
+        crate::content_ui::release_image_selection(view, &added);
+    }
     if editing_content {
-        crate::content_ui::keys(ui.ctx(), view);
+        crate::content_ui::keys(ui.ctx(), view, tool == QuickTool::EditText);
     }
     if tool == QuickTool::Link {
         crate::link_ui::keys(ui.ctx(), view);
@@ -3331,6 +3806,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         field_props,
         field_menu,
         image_action,
+        page_action,
         refused,
         open_signature,
         open_initials,
@@ -3352,6 +3828,7 @@ struct FrameRequests {
     field_props: Option<(String, usize)>,
     field_menu: Option<FieldMenu>,
     image_action: Option<crate::edit_text_ui::ImageAction>,
+    page_action: Option<PageMenuAction>,
     refused: Option<String>,
     open_signature: bool,
     open_initials: bool,
@@ -3366,12 +3843,14 @@ struct FrameRequests {
 }
 
 /// Opens the dialogs and runs the app commands the frame asked for.
+#[allow(clippy::cognitive_complexity)]
 fn apply_frame_requests(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui, requests: FrameRequests) {
     let FrameRequests {
         open_props,
         field_props,
         field_menu,
         image_action,
+        page_action,
         refused,
         open_signature,
         open_initials,
@@ -3435,12 +3914,109 @@ fn apply_frame_requests(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui,
         }
         Some(crate::edit_text_ui::ImageAction::CopyFile(page, index)) => app.copy_page_image_file(page, index),
         Some(crate::edit_text_ui::ImageAction::Cut(page, image)) => {
-            app.views[index].image_selection = None;
             app.cut_page_image(page, image);
         }
+        Some(crate::edit_text_ui::ImageAction::Paste(page, at)) => {
+            if let Some(pt) = at {
+                app.paste_image_at(page, pt);
+            } else {
+                app.paste_image(page, None);
+            }
+        }
+        Some(crate::edit_text_ui::ImageAction::DrawFreehand) => {
+            app.quick_tool = crate::QuickTool::Comment(crate::comments::CommentTool::Ink);
+        }
         Some(crate::edit_text_ui::ImageAction::Redact(page, index)) => app.redact_page_image(page, index),
         Some(crate::edit_text_ui::ImageAction::Link(page, index)) => app.link_page_image(page, index),
         Some(crate::edit_text_ui::ImageAction::Recognize(page)) => app.recognize_text_on_page(page),
+        Some(crate::edit_text_ui::ImageAction::AddComment(page, i)) => {
+            if let Some(d) = app.session.get(app.views[index].id) {
+                let images = d.page_images(page);
+                if let Some(img) = images.get(i) {
+                    let r = img.visible_rect.unwrap_or(img.rect);
+                    let center = [(r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0];
+                    app.views[index].comments.context_at = Some((page, center));
+                    app.views[index].comments.composer = Some(crate::comments::Composer {
+                        page,
+                        at: center,
+                        kind: crate::comments::ComposerKind::Note,
+                        text: String::new(),
+                        focus: true,
+                    });
+                }
+            }
+        }
+        None => {}
+    }
+    match page_action {
+        Some(PageMenuAction::Copy) => {
+            if let Some(sel) = app.views[index].image_selection.clone() {
+                app.copy_page_image(sel.page, sel.index);
+            } else if app.views[index].selected_text().is_some() {
+                app.execute("edit.copy");
+            } else if let Some((page, at)) = app.views[index].comments.context_at
+                && let Some(doc) = app.session.get(app.views[index].id)
+                && let Some(image) = doc.page_image_at(page, at)
+            {
+                app.copy_page_image(page, image);
+            }
+        }
+        Some(PageMenuAction::Paste(page, at)) => {
+            app.paste_image_at(page, at);
+        }
+        Some(PageMenuAction::RotateCCW) => {
+            app.views[index].rotate_view(false);
+        }
+        Some(PageMenuAction::RotateCW) => {
+            app.views[index].rotate_view(true);
+        }
+        Some(PageMenuAction::Print) => {
+            app.open_print();
+        }
+        Some(PageMenuAction::SelectTool) => {
+            app.quick_tool = QuickTool::Select;
+        }
+        Some(PageMenuAction::HandTool) => {
+            app.quick_tool = QuickTool::Hand;
+        }
+        Some(PageMenuAction::MarqueeZoom) => {
+            app.quick_tool = QuickTool::MarqueeZoom;
+        }
+        Some(PageMenuAction::AddComment(page, at)) => {
+            app.views[index].comments.composer =
+                Some(crate::comments::Composer { page, at, kind: crate::comments::ComposerKind::Note, text: String::new(), focus: true });
+        }
+        Some(PageMenuAction::FlattenComments) => {
+            app.views[index].comments.selected = None;
+            app.views[index].pending_edit = Some(pdfcraft_engine::Edit::Flatten { comments: true, fields: false });
+        }
+        Some(PageMenuAction::AddBookmark) => {
+            app.bookmark_action(crate::panels::BmAction::New);
+        }
+        Some(PageMenuAction::TakeSnapshot) => {
+            app.quick_tool = QuickTool::Snapshot;
+        }
+        Some(PageMenuAction::EditPdf) => {
+            app.quick_tool = QuickTool::EditText;
+        }
+        Some(PageMenuAction::AddText) => {
+            app.quick_tool = QuickTool::AddText;
+        }
+        Some(PageMenuAction::AddImage) => {
+            app.add_image_dialog();
+        }
+        Some(PageMenuAction::DeletePage(page)) => {
+            app.views[index].pending_edit = Some(pdfcraft_engine::Edit::DeletePages { pages: vec![page] });
+        }
+        Some(PageMenuAction::ExportPdf) => {
+            app.select_tool("export");
+        }
+        Some(PageMenuAction::Find) => {
+            app.views[index].open_find();
+        }
+        Some(PageMenuAction::DocProperties) => {
+            app.dialog = Some(crate::Dialog::Properties(crate::PropsTab::Description));
+        }
         None => {}
     }
     if let Some(why) = refused {
diff --git a/crates/ui-egui/src/canvas/area.rs b/crates/ui-egui/src/canvas/area.rs
index 068661ea5f..0d934dc8c9 100644
--- a/crates/ui-egui/src/canvas/area.rs
+++ b/crates/ui-egui/src/canvas/area.rs
@@ -32,14 +32,22 @@ pub(super) const SUPPRESS_SECS: f64 = 0.25;
 /// Short rolling extension while egui still has an unprocessed wheel tail.
 pub(super) const SUPPRESS_TAIL_SECS: f64 = 0.05;
 
-// Keep the viewer's scroll identity tied to the document instead of its parent UI.
+// Keep the viewer's scroll identity tied to the document instead of its parent UI. Without
+// `fades` (Show Page Edge Shadows off) the viewport-edge gradients are off for this area only.
 pub(super) fn page_scroll<R>(
     ui: &mut egui::Ui,
     scroll: egui::ScrollArea,
     id: egui::Id,
+    fades: bool,
     draw: impl FnOnce(&mut egui::Ui, egui::Rect) -> R,
 ) -> egui::scroll_area::ScrollAreaOutput<R> {
-    ui.scope_builder(egui::UiBuilder::new().scope_id(id), |ui| scroll.show_viewport(ui, draw)).inner
+    let strength = ui.spacing().scroll.fade.strength;
+    if !fades {
+        ui.spacing_mut().scroll.fade.strength = 0.0;
+    }
+    let out = ui.scope_builder(egui::UiBuilder::new().scope_id(id), |ui| scroll.show_viewport(ui, draw)).inner;
+    ui.spacing_mut().scroll.fade.strength = strength;
+    out
 }
 
 /// Run a push button's action (the ones that need no JavaScript engine).
diff --git a/crates/ui-egui/src/canvas/cache.rs b/crates/ui-egui/src/canvas/cache.rs
index a0ad8fb335..4b6f6c2e42 100644
--- a/crates/ui-egui/src/canvas/cache.rs
+++ b/crates/ui-egui/src/canvas/cache.rs
@@ -239,6 +239,12 @@ impl DocView {
         self.texts.get(&page).cloned()
     }
 
+    /// Whether `page`'s text layer has arrived from the renderer. Selecting text, the I-beam and
+    /// find matches on a page all wait for it (tests and automation).
+    pub fn has_page_text(&self, page: usize) -> bool {
+        self.texts.contains_key(&page)
+    }
+
     pub fn thumb(&self, page: usize) -> Option<&TextureHandle> {
         self.thumbs.get(&page).map(|t| &t.tex)
     }
diff --git a/crates/ui-egui/src/canvas/image_pick.rs b/crates/ui-egui/src/canvas/image_pick.rs
index 403e9836c0..cc938170da 100644
--- a/crates/ui-egui/src/canvas/image_pick.rs
+++ b/crates/ui-egui/src/canvas/image_pick.rs
@@ -46,8 +46,16 @@ pub(crate) fn page_input(
     let u = info_page.view_to_user(vx, vy);
     let at = [f64::from(u[0]), f64::from(u[1])];
     let generation = doc.edit_generation();
-    view.picked_image =
-        doc.page_image_at(page, at).and_then(|index| doc.page_images(page).get(index).map(|i| PickedImage { page, index, rect: i.rect, generation }));
+    view.picked_image = doc.page_image_at(page, at).and_then(|index| {
+        doc.page_images(page).get(index).and_then(|i| {
+            let screen_rect = crate::canvas::image_screen_rect(i, xf, info, page);
+            if screen_rect.is_positive() && screen_rect.contains(p) {
+                Some(PickedImage { page, index, rect: crate::canvas::image_selectable_bounds(i), generation })
+            } else {
+                None
+            }
+        })
+    });
 }
 
 /// Forget the selected picture once the document has been edited since it was picked: Edit text &
@@ -71,7 +79,7 @@ pub(crate) fn paint(painter: &egui::Painter, xf: &PageXform, page: usize, info:
 }
 
 /// A file name without characters file systems refuse.
-fn safe_name(s: &str) -> String {
+pub(crate) fn safe_name(s: &str) -> String {
     let cleaned: String = s.chars().map(|c| if c.is_control() || r#"/\:*?"<>|"#.contains(c) { '_' } else { c }).take(80).collect();
     let cleaned = cleaned.trim().trim_matches('.').to_string();
     if cleaned.is_empty() { "PdfCraft".into() } else { cleaned }
@@ -171,7 +179,8 @@ impl PdfCraftApp {
             return;
         }
         // The document may have changed since the click: the same picture must still be there.
-        let current = self.session.get(self.views[i].id).and_then(|d| d.page_images(picked.page).get(picked.index).map(|im| im.rect));
+        let current =
+            self.session.get(self.views[i].id).and_then(|d| d.page_images(picked.page).get(picked.index).map(crate::canvas::image_selectable_bounds));
         if current == Some(picked.rect) {
             self.copy_page_image_file(picked.page, picked.index);
         } else {
@@ -195,6 +204,7 @@ impl PdfCraftApp {
         let copied = file.and_then(|(ext, bytes)| {
             let name = format!("{stem} p{} img{}.{ext}", page.saturating_add(1), index.saturating_add(1));
             self.put_file_on_clipboard(&name, &bytes)?;
+            self.last_copied_image = None;
             self.last_copied_file = Some((name, bytes));
             Ok(ext)
         });
@@ -213,7 +223,7 @@ impl PdfCraftApp {
         }
         let dir = clipboard_dir().ok_or("there is no folder for the copied file")?;
         let path = write_clipboard_file(&dir, name, bytes)?;
-        arboard::Clipboard::new().and_then(|mut c| c.set().file_list(&[path])).map_err(|e| e.to_string())
+        crate::os_clipboard::with(|c| c.set().file_list(&[path])).map_err(|e| e.to_string())
     }
 
     #[cfg(target_arch = "wasm32")]
diff --git a/crates/ui-egui/src/canvas/organize.rs b/crates/ui-egui/src/canvas/organize.rs
index 7f333b3e46..48c7e82d8f 100644
--- a/crates/ui-egui/src/canvas/organize.rs
+++ b/crates/ui-egui/src/canvas/organize.rs
@@ -267,7 +267,17 @@ fn request_sharper(
     }
 }
 
-pub(super) fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
+pub(super) fn organize_grid(
+    view: &mut DocView,
+    doc: &pdfcraft_engine::Document,
+    unobstructed: bool,
+    show_page_edge_shadows: bool,
+    ui: &mut egui::Ui,
+    t: &Tokens,
+) {
+    let info = &doc.info;
+    let editable = doc.allows_assembly();
+    let dirty = doc.dirty;
     let ppp = ui.ctx().pixels_per_point();
     // The page image scales with the zoom; the padding and the page number don't.
     let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 88.0);
@@ -290,6 +300,10 @@ pub(super) fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool,
     let (mut in_view, mut sharper): (Vec<(usize, f32)>, Vec<RenderRequest>) = (Vec::new(), Vec::new());
     // The source cell can scroll out of the virtualized rows during a drag.
     let mut drop = view.org_drag.is_some() && ui.input(|i| i.pointer.primary_released());
+    let fade_strength = ui.spacing().scroll.fade.strength;
+    if !show_page_edge_shadows {
+        ui.spacing_mut().scroll.fade.strength = 0.0;
+    }
     egui::ScrollArea::vertical().auto_shrink([false, false]).show_viewport(ui, |ui, clip| {
         apply_auto_scroll(ui, middle_gesture, auto_delta);
         ui.add_space(20.0);
@@ -329,7 +343,9 @@ pub(super) fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool,
                 if view.selected.contains(&i) {
                     ui.painter().rect_stroke(c.shrink(6.0), CornerRadius::same(8), Stroke::new(1.5, t.accent), egui::StrokeKind::Inside);
                 }
-                ui.painter().rect_filled(pr.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
+                if show_page_edge_shadows {
+                    ui.painter().rect_filled(pr.translate(vec2(0.0, 1.5)), CornerRadius::same(1), t.page_shadow);
+                }
                 ui.painter().rect_filled(pr, CornerRadius::ZERO, Color32::WHITE);
                 // A page drawn larger than its thumbnail gets a render at the size drawn, while
                 // it is in view; until that arrives the thumbnail stands in.
@@ -507,6 +523,7 @@ pub(super) fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool,
             view.org_drag = None;
         }
     });
+    ui.spacing_mut().scroll.fade.strength = fade_strength;
     // Files dragged in from outside go to the gap under the pointer. Some platforms don't say
     // where the pointer is until the files are dropped; then the whole grid is the target.
     let pointer = ui.input(|i| i.pointer.hover_pos()).filter(|p| viewport.contains(*p));
diff --git a/crates/ui-egui/src/canvas/page_pointer.rs b/crates/ui-egui/src/canvas/page_pointer.rs
index f0df1d92f1..02cb2208ed 100644
--- a/crates/ui-egui/src/canvas/page_pointer.rs
+++ b/crates/ui-egui/src/canvas/page_pointer.rs
@@ -56,18 +56,17 @@ impl PagePointer {
         // pointer is outside the window. With a dialog open only a drag counts, up to the frame
         // it stops: on the frame one opens egui still gives the pages a press that lands under
         // it, and its click.
-        let held = resp.dragged() || resp.drag_stopped() || (!modal && resp.interact_pointer_pos().is_some());
-        // `contains_pointer` alone also holds a few points under the edge of an Area over the
-        // pages (egui's interact radius), so the top layer there must be the pages' own. A
-        // dialog covers them from the frame it opens, before egui knows its layer.
         let layer = ui.layer_id();
         let on_top =
             |p: &Pos2| !modal && !dragged_elsewhere(ui, resp) && resp.contains_pointer() && ui.ctx().layer_id_at(*p).is_none_or(|l| l == layer);
+        let press_origin = origin.or_else(|| first_press(&edges));
+        let held =
+            resp.dragged() || resp.drag_stopped() || (!modal && (resp.interact_pointer_pos().is_some() || press_origin.is_some_and(|p| on_top(&p))));
         let pos = at.filter(|p| held || on_top(p));
         if !held {
             return Self { pos, origin: None, edges: Vec::new(), primary_down, any_down };
         }
-        Self { pos, origin: origin.or_else(|| first_press(&edges)), edges, primary_down, any_down }
+        Self { pos, origin: press_origin, edges, primary_down, any_down }
     }
 
     /// Where the pointer is, when it is inside `r`.
diff --git a/crates/ui-egui/src/canvas/page_router.rs b/crates/ui-egui/src/canvas/page_router.rs
index 06d3c48568..8b91cc865c 100644
--- a/crates/ui-egui/src/canvas/page_router.rs
+++ b/crates/ui-egui/src/canvas/page_router.rs
@@ -42,8 +42,7 @@ pub(crate) enum Owner {
 pub(crate) enum PicturePart {
     /// The picture: a click selects it, a drag moves the selected one.
     Body,
-    /// A corner of the selected picture (left top, right top, left bottom, right bottom): a drag
-    /// resizes it.
+    /// A resize grip in `ImageObb::handles` order (four corners and four edge midpoints).
     Corner(usize),
     /// The selected picture's rotate knob: a drag turns it.
     Knob,
diff --git a/crates/ui-egui/src/canvas/tests.rs b/crates/ui-egui/src/canvas/tests.rs
index 634a885111..4761584735 100644
--- a/crates/ui-egui/src/canvas/tests.rs
+++ b/crates/ui-egui/src/canvas/tests.rs
@@ -2002,3 +2002,38 @@ fn a_moved_picture_is_drawn_from_the_fresh_raster_while_a_tile_is_still_stale()
     h.state_mut().views[0].stale_tiles.clear();
     h.state_mut().views[0].tiles.clear();
 }
+
+#[test]
+fn image_handles_account_for_document_and_view_rotation() {
+    for page_rotation in [0, 90, 180, 270] {
+        for view_rotation in [0, 90, 180, 270] {
+            let (width, height) = if page_rotation % 180 == 0 { (300.0, 400.0) } else { (400.0, 300.0) };
+            let info = DocInfo {
+                pages: vec![pdfcraft_render::PageInfo {
+                    width,
+                    height,
+                    label: String::new(),
+                    crop: [0.0, 0.0, 300.0, 400.0],
+                    rotation: page_rotation,
+                }],
+                ..Default::default()
+            };
+            let size = if view_rotation % 180 == 0 { vec2(width, height) } else { vec2(height, width) };
+            let xf = PageXform { rect: Rect::from_min_size(pos2(10.0, 20.0), size), rot: view_rotation, pw: width, ph: height };
+            let obb = ImageObb::from_matrix([100.0, 0.0, 0.0, 50.0, 50.0, 70.0], &xf, &info, 0);
+            let total = (page_rotation + view_rotation) % 360;
+            assert_eq!(obb.is_rotated, total != 0, "page={page_rotation} view={view_rotation}: user-labelled grips need matrix resize when turned");
+            for (handle, point) in obb.handles() {
+                let direction = point - obb.screen_center;
+                let cursor = match handle {
+                    ImageHandle::TopLeft | ImageHandle::TopRight | ImageHandle::BottomLeft | ImageHandle::BottomRight => {
+                        if direction.x * direction.y > 0.0 { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw }
+                    }
+                    _ if direction.x.abs() > direction.y.abs() => egui::CursorIcon::ResizeHorizontal,
+                    _ => egui::CursorIcon::ResizeVertical,
+                };
+                assert_eq!(obb.handle_cursor(handle), cursor, "page={page_rotation} view={view_rotation} handle={handle:?}");
+            }
+        }
+    }
+}
diff --git a/crates/ui-egui/src/canvas/xform.rs b/crates/ui-egui/src/canvas/xform.rs
index 91a3739d62..0f6249c8a8 100644
--- a/crates/ui-egui/src/canvas/xform.rs
+++ b/crates/ui-egui/src/canvas/xform.rs
@@ -17,7 +17,7 @@ impl DocView {
     }
 
     /// Where `page` is drawn this frame, with its coordinate mapping.
-    pub(crate) fn page_xform(&self, page: usize) -> Option<PageXform> {
+    pub fn page_xform(&self, page: usize) -> Option<PageXform> {
         self.screen_xforms.iter().find(|(p, _)| *p == page).map(|(_, xf)| *xf)
     }
 }
@@ -128,6 +128,10 @@ impl PageXform {
         Rect::from_two_pos(self.norm_to_screen(a.0, a.1), self.norm_to_screen(b.0, b.1))
     }
 
+    pub fn user_rect_f64(&self, info: &DocInfo, page: usize, r: [f64; 4]) -> Rect {
+        self.user_rect(info, page, r.map(|v| v as f32))
+    }
+
     /// This transform resized to a raster of `px` device pixels (width, height before the view
     /// rotation), so each of its texels covers one screen pixel. The rectangle's corner must
     /// already be on a whole pixel ([`snap_to_pixels`]).
@@ -148,4 +152,34 @@ impl PageXform {
         mesh.add_triangle(0, 2, 3);
         painter.add(egui::Shape::mesh(mesh));
     }
+
+    /// Draw a sub-rectangle of a whole-page raster texture with specific texture UVs covering the normalised page region.
+    #[allow(clippy::too_many_arguments)]
+    pub fn paint_image_region(
+        &self,
+        painter: &egui::Painter,
+        tex: egui::TextureId,
+        pu0: f32,
+        pv0: f32,
+        pu1: f32,
+        pv1: f32,
+        tu0: f32,
+        tv0: f32,
+        tu1: f32,
+        tv1: f32,
+    ) {
+        let mut mesh = egui::Mesh::with_texture(tex);
+        let corners = [(pu0, pv0, tu0, tv0), (pu1, pv0, tu1, tv0), (pu1, pv1, tu1, tv1), (pu0, pv1, tu0, tv1)];
+        for (u, v, tu, tv) in corners {
+            mesh.vertices.push(egui::epaint::Vertex { pos: self.norm_to_screen(u, v), uv: pos2(tu, tv), color: Color32::WHITE });
+        }
+        mesh.add_triangle(0, 1, 2);
+        mesh.add_triangle(0, 2, 3);
+        painter.add(egui::Shape::mesh(mesh));
+    }
+
+    /// Draw a sub-rectangle of a whole-page raster texture, where UV space matches page normalized space.
+    pub fn paint_page_texture_rect(&self, painter: &egui::Painter, tex: egui::TextureId, u0: f32, v0: f32, u1: f32, v1: f32) {
+        self.paint_image_region(painter, tex, u0, v0, u1, v1, u0, v0, u1, v1);
+    }
 }
diff --git a/crates/ui-egui/src/canvas/zoom_snap.rs b/crates/ui-egui/src/canvas/zoom_snap.rs
index 5a0dcf6733..159adf2b7e 100644
--- a/crates/ui-egui/src/canvas/zoom_snap.rs
+++ b/crates/ui-egui/src/canvas/zoom_snap.rs
@@ -145,7 +145,7 @@ impl PdfCraftApp {
         #[cfg(not(target_arch = "wasm32"))]
         if self.system_clipboard {
             let img = arboard::ImageData { width: w as usize, height: h as usize, bytes: std::borrow::Cow::Borrowed(&out.rgba) };
-            arboard::Clipboard::new().and_then(|mut c| c.set_image(img)).map_err(|e| e.to_string())?;
+            crate::os_clipboard::with(|c| c.set_image(img)).map_err(|e| e.to_string())?;
         }
         self.last_snapshot = Some((w, h, out.rgba));
         Ok((w, h))
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 43c41889e5..c3c730ed68 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -28,6 +28,8 @@
 //!   comments, selecting text, moving comments). `ui.state` reports `pages_on_screen` to aim at.
 //! - `ui.type {text}`, `ui.key {key, modifiers?}`: keyboard input to the focused widget / app.
 //! - `ui.command {id}`: run a registry command (as the menu would). `ui.commands` lists them.
+//! - `ui.set {key: "show_page_edge_shadows", value: "true"|"false"}` controls page
+//!   decoration app-wide; `ui.state.show_page_edge_shadows` reports the saved preference.
 //! - `ui.set {key, value}`: view options (`--page`, `--zoom`, …), plus persistent preferences.
 //!   `select` accepts physical page numbers and ranges such as `1,12,16-18`; blank clears the
 //!   explicit selection. This is the same bounded parser as the Organize Pages field; invalid
diff --git a/crates/ui-egui/src/control/host.rs b/crates/ui-egui/src/control/host.rs
index 1166c0e7ec..64b10b69fb 100644
--- a/crates/ui-egui/src/control/host.rs
+++ b/crates/ui-egui/src/control/host.rs
@@ -141,6 +141,7 @@ impl Host for crate::PdfCraftApp {
             "palette_open": self.palette_open,
             "theme": format!("{:?}", self.theme),
             "theme_preference": self.theme_preference,
+            "show_page_edge_shadows": self.show_page_edge_shadows,
             "language": self.language,
             "notice": self.toast.as_ref().map(|t| t.0.clone()),
             "progress": self.progress_notice.as_ref().map(|p| json!({ "label": p.label, "fraction": p.fraction })),
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index bfb0da686a..42bed83657 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -128,6 +128,7 @@ fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
             Dialog::Print => 820.0,
             Dialog::FieldProps | Dialog::BulkFieldProps => 600.0,
             Dialog::About => 780.0,
+            Dialog::PinTool => 540.0,
             _ => 520.0,
         });
         if dialog_body(ui, app, dialog, &mut req) {
@@ -446,6 +447,11 @@ fn dialog_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, dialog: Dialog, req: &m
                 return false;
             }
         }
+        Dialog::PinTool => {
+            if !dialog_pin_tool(ui, app, req) {
+                return false;
+            }
+        }
     }
     true
 }
@@ -1080,6 +1086,7 @@ fn dialog_rotate_pages(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendi
     use pdfcraft_engine::{PageOrientation as O, PageParity as P};
     let n = app.active_ids().and_then(|(_, id)| app.session.get(id)).map_or(1, |d| d.info.pages.len());
     let d = &mut app.rotate_draft;
+    let mut typing_to = false;
     ui.label(egui::RichText::new(tl!("Rotate Pages")).font(theme::semibold(18.0)));
     ui.add_space(8.0);
     egui::Grid::new("rotate-pages").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
@@ -1101,10 +1108,11 @@ fn dialog_rotate_pages(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendi
             widgets::radio_value(ui, &mut d.which, 0, tl!("All"));
             widgets::radio_value(ui, &mut d.which, 1, tl!("Selection"));
             ui.horizontal(|ui| {
-                widgets::radio_value(ui, &mut d.which, 2, tl!("From"));
-                ui.add_enabled(d.which == 2, egui::DragValue::new(&mut d.from).range(1..=n));
-                ui.label(tl!("to"));
-                ui.add_enabled(d.which == 2, egui::DragValue::new(&mut d.to).range(1..=n));
+                let from_label = widgets::radio_value(ui, &mut d.which, 2, tl!("From"));
+                ui.add_enabled(d.which == 2, egui::DragValue::new(&mut d.from).range(1..=n)).labelled_by(from_label.id);
+                let to_label = ui.label(tl!("to"));
+                typing_to =
+                    widgets::typing_into(&ui.add_enabled(d.which == 2, egui::DragValue::new(&mut d.to).range(1..=n)).labelled_by(to_label.id));
                 ui.label(crate::i18n::fmt(tl!("of {name}"), &[("name", &n.to_string())]));
             });
         });
@@ -1136,10 +1144,12 @@ fn dialog_rotate_pages(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendi
             });
         ui.end_row();
     });
-    d.to = d.to.max(d.from);
+    widgets::keep_range_ordered(d.from, &mut d.to, typing_to);
     ui.add_space(12.0);
     ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
         if widgets::pill_button(ui, tl!("OK"), true).clicked() {
+            // OK while the end is still being typed (a screen reader can press it).
+            widgets::keep_range_ordered(d.from, &mut d.to, false);
             req.rotate_now = true;
             req.close = true;
         }
@@ -1161,17 +1171,21 @@ fn dialog_duplicate_field(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pe
     ui.add_space(8.0);
     ui.label(crate::i18n::fmt(tl!("Duplicate \"{name}\" onto:"), &[("name", &d.name)]));
     widgets::radio_value(ui, &mut d.all, true, tl!("All pages"));
-    ui.horizontal(|ui| {
-        widgets::radio_value(ui, &mut d.all, false, tl!("From"));
-        ui.add_enabled(!d.all, egui::DragValue::new(&mut d.from).range(1..=n));
-        ui.label(tl!("to"));
-        ui.add_enabled(!d.all, egui::DragValue::new(&mut d.to).range(1..=n));
-        ui.label(crate::i18n::fmt(tl!("of {name}"), &[("name", &n.to_string())]));
-    });
-    d.to = d.to.max(d.from);
+    let typing_to = ui
+        .horizontal(|ui| {
+            widgets::radio_value(ui, &mut d.all, false, tl!("From"));
+            ui.add_enabled(!d.all, egui::DragValue::new(&mut d.from).range(1..=n));
+            ui.label(tl!("to"));
+            let typing_to = widgets::typing_into(&ui.add_enabled(!d.all, egui::DragValue::new(&mut d.to).range(1..=n)));
+            ui.label(crate::i18n::fmt(tl!("of {name}"), &[("name", &n.to_string())]));
+            typing_to
+        })
+        .inner;
+    widgets::keep_range_ordered(d.from, &mut d.to, typing_to);
     ui.add_space(12.0);
     ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
         if widgets::pill_button(ui, tl!("OK"), true).clicked() {
+            widgets::keep_range_ordered(d.from, &mut d.to, false);
             let pages: Vec<usize> = if d.all { (0..n).collect() } else { (d.from - 1..d.to.min(n)).collect() };
             req.duplicate_now = Some(Edit::DuplicateField { name: d.name.clone(), pages });
             req.close = true;
@@ -1370,13 +1384,14 @@ fn dialog_number_pages(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendi
     let n = app.session.get(id).map(|d| d.info.pages.len()).unwrap_or(1).max(1);
     let d = &mut app.number_draft;
     d.to = d.to.clamp(1, n);
-    d.from = d.from.clamp(1, d.to);
+    d.from = d.from.clamp(1, n);
+    let mut typing_to = false;
     egui::Grid::new("number_pages").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
         ui.label(tl!("Pages"));
         ui.horizontal(|ui| {
             ui.add(egui::DragValue::new(&mut d.from).range(1..=n));
             ui.label(tl!("to"));
-            ui.add(egui::DragValue::new(&mut d.to).range(1..=n));
+            typing_to = widgets::typing_into(&ui.add(egui::DragValue::new(&mut d.to).range(1..=n)));
             ui.label(egui::RichText::new(crate::i18n::fmt(tl!("of {name}"), &[("name", &n.to_string())])).color(t.text_muted));
         });
         ui.end_row();
@@ -1403,18 +1418,20 @@ fn dialog_number_pages(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pendi
         ui.add(egui::DragValue::new(&mut d.start).range(1..=99_999));
         ui.end_row();
     });
-    d.to = d.to.max(d.from);
+    widgets::keep_range_ordered(d.from, &mut d.to, typing_to);
     let label = |k: u32| format!("{}{}", d.prefix, d.style.format(k));
     ui.add_space(8.0);
-    let preview = if d.from == d.to {
+    // `to` can be below `from` while it is being typed.
+    let preview = if d.to <= d.from {
         label(d.start)
     } else {
-        format!("{}, {} … {}", label(d.start), label(d.start + 1), label(d.start + (d.to - d.from) as u32))
+        format!("{}, {} … {}", label(d.start), label(d.start + 1), label(d.start.saturating_add(u32::try_from(d.to - d.from).unwrap_or(u32::MAX))))
     };
     ui.label(
         egui::RichText::new(crate::i18n::fmt(tl!("Labels: {preview}. Later pages keep their labels."), &[("preview", &preview)])).color(t.text_muted),
     );
-    req.number_now = Some(Edit::NumberPages { from: d.from - 1, to: d.to - 1, style: d.style, prefix: d.prefix.clone(), first: d.start });
+    // Ordered here too: the footer's OK can be pressed while the end is still being typed.
+    req.number_now = Some(Edit::NumberPages { from: d.from - 1, to: d.to.max(d.from) - 1, style: d.style, prefix: d.prefix.clone(), first: d.start });
     true
 }
 
@@ -1553,6 +1570,91 @@ fn dialog_about(ui: &mut egui::Ui, req: &mut Pending) -> bool {
     true
 }
 
+fn dialog_pin_tool(ui: &mut egui::Ui, app: &mut PdfCraftApp, req: &mut Pending) -> bool {
+    let t = Tokens::get(ui.ctx());
+    ui.horizontal(|ui| {
+        ui.label(egui::RichText::new(tl!("Pin tools to Home")).font(theme::semibold(18.0)));
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::ghost_button(ui, "x", tl!("Close")).clicked() {
+                req.close = true;
+            }
+        });
+    });
+    ui.add_space(4.0);
+    ui.label(egui::RichText::new(tl!("Select tools to display on your Home page for quick access.")).color(t.text_muted));
+    ui.add_space(10.0);
+
+    ui.horizontal(|ui| {
+        let (icon_rect, _) = ui.allocate_exact_size(egui::vec2(18.0, 18.0), egui::Sense::hover());
+        crate::icons::paint(ui, icon_rect, "search", 16.0, t.text_muted);
+        let search_resp =
+            ui.add(egui::TextEdit::singleline(&mut app.pin_tool_search).hint_text(tl!("Search tools…")).desired_width(ui.available_width() - 32.0));
+        search_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::TextInput, ui.is_enabled(), tl!("Search tools…")));
+        if !app.pin_tool_search.is_empty() && widgets::ghost_button(ui, "x", tl!("Clear search")).clicked() {
+            app.pin_tool_search.clear();
+        }
+    });
+    ui.add_space(8.0);
+    ui.separator();
+    ui.add_space(6.0);
+
+    let query = app.pin_tool_search.trim().to_lowercase();
+    egui::ScrollArea::vertical().max_height(380.0).auto_shrink([false, true]).show(ui, |ui| {
+        let mut toggle = None;
+        for g in pdfcraft_engine::catalog::TOOL_GROUPS {
+            let label = tl!(g.label);
+            let blurb = g.sections.first().map(|s| s.items.iter().take(4).map(|i| tl!(i.label)).collect::<Vec<_>>().join(" • ")).unwrap_or_default();
+            if !query.is_empty()
+                && !label.to_lowercase().contains(&query)
+                && !blurb.to_lowercase().contains(&query)
+                && !g.id.to_lowercase().contains(&query)
+            {
+                continue;
+            }
+
+            let pinned = app.is_tool_pinned(g.id);
+            let (rect, resp) = ui.allocate_exact_size(egui::vec2(ui.available_width(), 44.0), egui::Sense::click());
+            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, label));
+            let press = theme::Press::track(ui, &resp);
+            press.wash(ui, rect, 6, false);
+            let body = rect.translate(press.offset());
+
+            let color = egui::Color32::from_rgb(g.hue[0], g.hue[1], g.hue[2]);
+            crate::icons::paint(ui, egui::Rect::from_min_size(body.min + egui::vec2(8.0, 11.0), egui::vec2(22.0, 22.0)), g.icon, 20.0, color);
+
+            let btn_w = 78.0;
+            let btn_rect = egui::Rect::from_center_size(body.right_center() - egui::vec2(btn_w / 2.0 + 8.0, 0.0), egui::vec2(btn_w, 26.0));
+            let btn_resp = ui.interact(btn_rect, ui.scope_id().with(("pin_modal_btn", g.id)), egui::Sense::click());
+            let btn_hovered = btn_resp.hovered();
+
+            let (btn_fill, btn_stroke, text_color, btn_label) = if pinned {
+                (t.accent, egui::Stroke::NONE, egui::Color32::WHITE, tl!("Pinned"))
+            } else if btn_hovered {
+                (t.hover, egui::Stroke::new(1.0, t.border), t.text, tl!("Pin"))
+            } else {
+                (egui::Color32::TRANSPARENT, egui::Stroke::new(1.0, t.border), t.text_muted, tl!("Pin"))
+            };
+            let tip = if pinned { tl!("Unpin from Home") } else { tl!("Pin to Home") };
+            btn_resp.widget_info(|| egui::WidgetInfo::selected(egui::Role::Button, true, pinned, format!("{tip}: {label}")));
+
+            ui.painter().rect(btn_rect, egui::CornerRadius::same(6), btn_fill, btn_stroke, egui::StrokeKind::Inside);
+            ui.painter().text(btn_rect.center(), egui::Align2::CENTER_CENTER, btn_label, theme::medium(12.0), text_color);
+
+            let max_w = (btn_rect.left() - body.left() - 44.0).max(10.0);
+            widgets::row_text(ui, body.min + egui::vec2(38.0, 6.0), label, theme::semibold(13.5), t.text, max_w);
+            widgets::row_text(ui, body.min + egui::vec2(38.0, 24.0), &blurb, theme::regular(11.0), t.text_muted, max_w);
+
+            if btn_resp.clicked() || resp.clicked() {
+                toggle = Some(g.id);
+            }
+        }
+        if let Some(id) = toggle {
+            app.toggle_pin_tool(id);
+        }
+    });
+    true
+}
+
 fn dialog_footer(ui: &mut egui::Ui, app: &mut PdfCraftApp, dialog: Dialog, req: &mut Pending) {
     ui.add_space(16.0);
     let changed = draft_changes(app).is_some_and(|c| !c.is_empty());
@@ -1569,6 +1671,10 @@ fn dialog_footer(ui: &mut egui::Ui, app: &mut PdfCraftApp, dialog: Dialog, req:
                     req.recover = Some(false);
                     req.close = true;
                 }
+            } else if dialog == Dialog::PinTool {
+                if widgets::pill_button(ui, tl!("Done"), true).clicked() {
+                    req.close = true;
+                }
             } else if dialog == Dialog::NumberPages {
                 if widgets::pill_button(ui, tl!("OK"), true).clicked() {
                     req.apply_number = true;
@@ -1836,6 +1942,8 @@ fn finish_close(app: &mut PdfCraftApp, dialog: Dialog, modal_closed: bool, req:
     // Protect / Remove security replace the Properties dialog.
     let replaces = req.link_command.is_some_and(|c| c.starts_with("protect.")) || req.open_revision.is_some();
     if modal_closed || req.close || replaces {
+        // Only now: the number in Preferences can pass through 0 on its way to the one wanted.
+        app.recent.truncate(app.recent_limit);
         app.dialog = None;
         app.props_draft = None;
         app.view_draft = None;
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 8def569f58..d4520a15b4 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -31,7 +31,7 @@ fn new_text_typed(v: &crate::DocView) -> bool {
 /// is a deleted annotation's page's annotations before the delete (empty for other edits).
 fn select_after_edit(
     view: &mut crate::DocView,
-    edit: Edit,
+    edit: &Edit,
     info: &pdfcraft_render::DocInfo,
     annots_before: &[pdfcraft_render::Annotation],
     quick_tool: crate::QuickTool,
@@ -39,15 +39,15 @@ fn select_after_edit(
     match edit {
         Edit::MovePages { pages, to } => {
             let n = pages.iter().collect::<std::collections::BTreeSet<_>>().len();
-            let to = to.min(info.pages.len() - n);
+            let to = (*to).min(info.pages.len() - n);
             view.select_pages(&(to..to + n).collect::<Vec<_>>());
         }
         Edit::DuplicatePages { pages, at: Some(at) } => {
             let n = pages.iter().collect::<std::collections::BTreeSet<_>>().len();
-            let at = at.min(info.pages.len().saturating_sub(n));
+            let at = (*at).min(info.pages.len().saturating_sub(n));
             view.select_pages(&(at..at + n).collect::<Vec<_>>());
         }
-        Edit::InsertBlankPage { at, .. } => view.select_pages(&[at.min(info.pages.len() - 1)]),
+        Edit::InsertBlankPage { at, .. } => view.select_pages(&[(*at).min(info.pages.len() - 1)]),
         Edit::DeletePages { .. } => view.select_pages(&[]),
         // A stroke drawn with the pen stays unselected, so the selection box and
         // author popup don't sit over the next stroke (#429).
@@ -71,7 +71,7 @@ fn select_after_edit(
                 view.comments.open_editor(a.page, n, String::new());
             }
         }
-        Edit::DeleteAnnotation { page, index } => view.comments.annotation_deleted(annots_before, &info.annotations, (page, index)),
+        Edit::DeleteAnnotation { page, index } => view.comments.annotation_deleted(annots_before, &info.annotations, (*page, *index)),
         _ => {}
     }
 }
@@ -112,6 +112,25 @@ impl PdfCraftApp {
     pub fn apply_edit(&mut self, edit: Edit) -> bool {
         let Some((i, id)) = self.active_ids() else { return false };
         let label = edit.label();
+        let target_arrange_image = match &edit {
+            Edit::EditPageImage { page, index, change: pdfcraft_engine::ImageEdit::Arrange(_) } => {
+                let doc = self.session.get(id);
+                let target = doc.and_then(|d| d.page_images(*page).get(*index).cloned());
+                let ambiguous = doc.is_some_and(|d| {
+                    if let Some(t) = &target {
+                        d.page_images(*page)
+                            .iter()
+                            .filter(|img| img.name == t.name && img.object == t.object && rect_matches(img.rect, t.rect))
+                            .count()
+                            > 1
+                    } else {
+                        false
+                    }
+                });
+                target.map(|t| (t, ambiguous))
+            }
+            _ => None,
+        };
         let (form_before, page_count_before, had_xfa) = if let Some(d) = self.session.get(id) {
             (Some(std::sync::Arc::clone(&d.form)), d.info.pages.len(), d.xfa.is_some())
         } else {
@@ -166,7 +185,11 @@ impl PdfCraftApp {
                     view.comments.comment_added();
                 }
                 // Keep the pages the user acted on selected, where they now are.
-                select_after_edit(view, edit, info, &annots_before, self.quick_tool);
+                select_after_edit(view, &edit, info, &annots_before, self.quick_tool);
+                if let (Some((target, ambiguous_before)), Edit::EditPageImage { page, .. }) = (target_arrange_image, &edit) {
+                    let page_images = doc.page_images(*page);
+                    re_resolve_image_selection(view, *page, &target, ambiguous_before, &page_images);
+                }
                 if std::mem::take(&mut view.comments.tool_done) && !self.comment_prefs.pinned {
                     self.quick_tool = crate::QuickTool::Select;
                 }
@@ -187,6 +210,9 @@ impl PdfCraftApp {
                 if let Some(view) = self.views.get_mut(i) {
                     // A drawing whose annotation wasn't added must not stay painted.
                     view.comments.drawings_refused();
+                    if matches!(&edit, Edit::EditPageImage { change, .. } if !matches!(change, pdfcraft_engine::ImageEdit::Arrange(_))) {
+                        view.image_selection = None;
+                    }
                     // A paragraph that couldn't be applied opens again with its typing, instead of
                     // the box the click moved to.
                     if let Edit::EditTextBlock { page, block, .. } = &edit
@@ -287,13 +313,34 @@ impl PdfCraftApp {
         if !self.close_text_editors(i, id) {
             return;
         }
+        let target_image = self.views.get(i).and_then(|v| v.image_selection.as_ref()).and_then(|s| {
+            let doc = self.session.get(id)?;
+            let images = doc.page_images(s.page);
+            let target = images.get(s.index).cloned()?;
+            let ambiguous =
+                images.iter().filter(|img| img.name == target.name && img.object == target.object && rect_matches(img.rect, target.rect)).count() > 1;
+            Some((s.page, target, ambiguous))
+        });
+        let had_selection = self.views.get(i).and_then(|v| v.image_selection.as_ref()).is_some();
         let result = if undo { self.session.undo(id) } else { self.session.redo(id) };
         match result {
             Ok(label) => {
-                if let Some(doc) = self.session.get(id) {
-                    self.views[i].document_changed(&doc.info);
+                if let Some(doc) = self.session.get(id)
+                    && let Some(view) = self.views.get_mut(i)
+                {
+                    view.document_changed(&doc.info);
+                    view.picked_image = None;
+                    if let Some((page, target, ambiguous_before)) = target_image {
+                        let page_images = doc.page_images(page);
+                        re_resolve_image_selection(view, page, &target, ambiguous_before, &page_images);
+                    } else if had_selection {
+                        view.image_selection = None;
+                    }
+                }
+                if let Some(view) = self.views.get_mut(i) {
+                    view.comments.selected = None;
+                    view.comments.history_stepped();
                 }
-                self.views[i].comments.history_stepped();
                 let label = crate::i18n::edit_label(&label);
                 if undo {
                     self.notify_fmt("Undid {label}", &[("label", &label)]);
@@ -783,6 +830,48 @@ impl PdfCraftApp {
     }
 }
 
+fn rect_matches(a: [f64; 4], b: [f64; 4]) -> bool {
+    a.iter().zip(b.iter()).all(|(x, y)| (x - y).abs() < 1e-3)
+}
+
+fn re_resolve_image_selection(
+    view: &mut crate::DocView,
+    page: usize,
+    target: &pdfcraft_engine::PageImage,
+    ambiguous_before: bool,
+    page_images: &[pdfcraft_engine::PageImage],
+) {
+    let exact_matches: Vec<usize> = page_images
+        .iter()
+        .enumerate()
+        .filter(|(_, img)| img.name == target.name && img.object == target.object && rect_matches(img.rect, target.rect))
+        .map(|(idx, _)| idx)
+        .collect();
+    let new_idx = if !ambiguous_before && exact_matches.len() == 1 {
+        exact_matches.first().copied()
+    } else if !ambiguous_before && exact_matches.is_empty() {
+        let name_obj_matches: Vec<usize> =
+            page_images.iter().enumerate().filter(|(_, img)| img.name == target.name && img.object == target.object).map(|(idx, _)| idx).collect();
+        if name_obj_matches.len() == 1 {
+            name_obj_matches.first().copied()
+        } else if name_obj_matches.is_empty() {
+            let name_matches: Vec<usize> = page_images.iter().enumerate().filter(|(_, img)| img.name == target.name).map(|(idx, _)| idx).collect();
+            if name_matches.len() == 1 { name_matches.first().copied() } else { None }
+        } else {
+            None
+        }
+    } else {
+        None
+    };
+    if let Some(s) = view.image_selection.as_mut().filter(|s| s.page == page) {
+        if let Some(idx) = new_idx {
+            s.index = idx;
+        } else {
+            view.image_selection = None;
+        }
+    }
+}
+
 /// The single page a content edit changes (`None` for other edits). Like comment edits,
 /// these leave every other page's bytes, geometry and text alone, so their rasters stay valid.
 fn content_page(edit: &Edit) -> Option<usize> {
diff --git a/crates/ui-egui/src/home.rs b/crates/ui-egui/src/home.rs
index 390b059228..4f5ac9deba 100644
--- a/crates/ui-egui/src/home.rs
+++ b/crates/ui-egui/src/home.rs
@@ -20,6 +20,57 @@ pub(crate) fn card_lift(ui: &egui::Ui, t: &Tokens, rect: Rect, press: theme::Pre
     }
 }
 
+/// Render a single tool card with the standard lift, styling, icon, title, description, and action.
+/// If `allow_unpin` is true, an unpin button is always accessible in the top right corner.
+fn tool_card(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g: &'static catalog::ToolGroup, allow_unpin: bool) -> Option<&'static str> {
+    let (rect, resp) = ui.allocate_exact_size(vec2(190.0, 104.0), Sense::click());
+    resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(g.label)));
+    let press = theme::Press::track(ui, &resp);
+    card_lift(ui, t, rect, press);
+    let fill = press.fill(t.card, t.hover, t.pressed);
+    ui.painter().rect(rect, CornerRadius::same(10), fill, Stroke::new(1.0, t.divider), egui::StrokeKind::Inside);
+    let body = rect.translate(press.offset());
+    let color = egui::Color32::from_rgb(g.hue[0], g.hue[1], g.hue[2]);
+    icons::paint(ui, Rect::from_min_size(body.min + vec2(14.0, 14.0), vec2(22.0, 22.0)), g.icon, 21.0, color);
+
+    let mut unpin_clicked = false;
+    if allow_unpin {
+        let unpin_rect = Rect::from_center_size(body.right_top() + vec2(-18.0, 18.0), vec2(22.0, 22.0));
+        let unpin_resp = ui.interact(unpin_rect, ui.scope_id().with(("unpin_card_btn", g.id)), Sense::click());
+        unpin_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Unpin tool")));
+        if unpin_resp.hovered() {
+            ui.painter().rect_filled(unpin_rect, CornerRadius::same(4), t.pressed);
+        }
+        icons::paint(ui, unpin_rect.shrink(4.0), "x", 14.0, t.icon);
+        if unpin_resp.on_hover_text(tl!("Unpin from Home")).clicked() {
+            unpin_clicked = true;
+        }
+    }
+
+    let mut title_job = egui::text::LayoutJob::simple_singleline(tl!(g.label).to_owned(), theme::semibold(13.5), t.text);
+    title_job.wrap = egui::text::TextWrapping { max_width: body.width() - 58.0, max_rows: 1, break_anywhere: true, ..Default::default() };
+    let title = ui.fonts_mut(|f| f.layout_job(title_job));
+    let title_elided = title.elided;
+    ui.painter().galley(body.min + vec2(44.0, 25.0 - title.size().y * 0.5), title, t.text);
+    let blurb = g.sections.first().map(|s| s.items.iter().take(3).map(|i| tl!(i.label)).collect::<Vec<_>>().join(" · ")).unwrap_or_default();
+    // Fixed-height cards must leave room for their action in every language.
+    let mut job = egui::text::LayoutJob::simple(blurb.clone(), theme::regular(11.5), t.text_muted, body.width() - 28.0);
+    job.wrap.max_rows = 2;
+    let galley = ui.fonts_mut(|f| f.layout_job(job));
+    let blurb_elided = galley.elided;
+    ui.painter().galley(body.min + vec2(14.0, 46.0), galley, t.text_muted);
+    ui.painter().text(body.left_bottom() + vec2(14.0, -14.0), Align2::LEFT_CENTER, tl!("Use now"), theme::medium(12.0), t.accent_text);
+    let resp = if title_elided || blurb_elided { resp.on_hover_text(format!("{}\n{blurb}", tl!(g.label))) } else { resp };
+    if unpin_clicked {
+        Some(g.id)
+    } else {
+        if theme::hand(resp).clicked() {
+            app.select_tool(g.id);
+        }
+        None
+    }
+}
+
 /// Draw the Home page with the welcome text, community card and recent documents.
 pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
@@ -73,44 +124,11 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     ui.horizontal_wrapped(|ui| {
                         ui.spacing_mut().item_spacing = vec2(14.0, 14.0);
                         for id in RECOMMENDED {
-                            let Some(g) = catalog::group(id) else { continue };
-                            let (rect, resp) = ui.allocate_exact_size(vec2(190.0, 104.0), Sense::click());
-                            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(g.label)));
-                            let press = theme::Press::track(ui, &resp);
-                            card_lift(ui, &t, rect, press);
-                            let fill = press.fill(t.card, t.hover, t.pressed);
-                            ui.painter().rect(rect, CornerRadius::same(10), fill, Stroke::new(1.0, t.divider), egui::StrokeKind::Inside);
-                            let body = rect.translate(press.offset());
-                            let color = egui::Color32::from_rgb(g.hue[0], g.hue[1], g.hue[2]);
-                            icons::paint(ui, Rect::from_min_size(body.min + vec2(14.0, 14.0), vec2(22.0, 22.0)), g.icon, 21.0, color);
-                            let mut title_job = egui::text::LayoutJob::simple_singleline(tl!(g.label).to_owned(), theme::semibold(13.5), t.text);
-                            title_job.wrap =
-                                egui::text::TextWrapping { max_width: body.width() - 58.0, max_rows: 1, break_anywhere: true, ..Default::default() };
-                            let title = ui.fonts_mut(|f| f.layout_job(title_job));
-                            let title_elided = title.elided;
-                            ui.painter().galley(body.min + vec2(44.0, 25.0 - title.size().y * 0.5), title, t.text);
-                            let blurb = g
-                                .sections
-                                .first()
-                                .map(|s| s.items.iter().take(3).map(|i| tl!(i.label)).collect::<Vec<_>>().join(" · "))
-                                .unwrap_or_default();
-                            // Fixed-height cards must leave room for their action in every language.
-                            let mut job = egui::text::LayoutJob::simple(blurb.clone(), theme::regular(11.5), t.text_muted, body.width() - 28.0);
-                            job.wrap.max_rows = 2;
-                            let galley = ui.fonts_mut(|f| f.layout_job(job));
-                            let blurb_elided = galley.elided;
-                            ui.painter().galley(body.min + vec2(14.0, 46.0), galley, t.text_muted);
-                            ui.painter().text(
-                                body.left_bottom() + vec2(14.0, -14.0),
-                                Align2::LEFT_CENTER,
-                                tl!("Use now"),
-                                theme::medium(12.0),
-                                t.accent_text,
-                            );
-                            let resp = if title_elided || blurb_elided { resp.on_hover_text(format!("{}\n{blurb}", tl!(g.label))) } else { resp };
-                            if theme::hand(resp).clicked() {
-                                app.select_tool(g.id);
+                            if app.is_tool_pinned(id) {
+                                continue;
                             }
+                            let Some(g) = catalog::group(id) else { continue };
+                            tool_card(app, ui, &t, g, false);
                         }
                         let (rect, resp) = ui.allocate_exact_size(vec2(170.0, 104.0), Sense::click());
                         resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Open file")));
@@ -132,31 +150,64 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     });
                 });
 
+            ui.add_space(26.0);
+            let mut unpin_tool = None;
+            ui.horizontal(|ui| {
+                ui.label(egui::RichText::new(tl!("Pinned Tools")).font(theme::semibold(17.0)));
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if widgets::ghost_button(ui, "pin", tl!("Pin a tool…")).clicked() {
+                        app.dialog = Some(crate::Dialog::PinTool);
+                    }
+                });
+            });
+            ui.add_space(4.0);
+            if app.pinned_tools.is_empty() {
+                ui.label(egui::RichText::new(tl!("Pin your favorite tools here for quick access.")).color(t.text_muted));
+            } else {
+                ui.add_space(6.0);
+                let pinned = app.pinned_tools.clone();
+                ui.horizontal_wrapped(|ui| {
+                    ui.spacing_mut().item_spacing = vec2(14.0, 14.0);
+                    for id in &pinned {
+                        let Some(g) = catalog::group(id) else { continue };
+                        if let Some(to_unpin) = tool_card(app, ui, &t, g, true) {
+                            unpin_tool = Some(to_unpin);
+                        }
+                    }
+                });
+            }
+            if let Some(id) = unpin_tool {
+                app.unpin_tool(id);
+            }
+
             #[cfg(not(target_arch = "wasm32"))]
             {
                 ui.add_space(26.0);
                 crate::folders_ui::section(app, ui);
             }
 
-            ui.add_space(26.0);
             let mut clear = false;
-            ui.horizontal(|ui| {
-                ui.label(egui::RichText::new(tl!("Recent")).font(theme::semibold(17.0)));
-                if !app.recent.is_empty() {
-                    ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                        let resp = widgets::ghost_button(ui, "trash-2", tl!("Clear"));
-                        resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Clear Recent Files")));
-                        clear = resp.on_hover_text(tl!("Clear Recent Files")).clicked();
-                    });
+            // Preferences can turn the list off (#5572).
+            if app.recent_limit > 0 {
+                ui.add_space(26.0);
+                ui.horizontal(|ui| {
+                    ui.label(egui::RichText::new(tl!("Recent")).font(theme::semibold(17.0)));
+                    if !app.recent.is_empty() {
+                        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                            let resp = widgets::ghost_button(ui, "trash-2", tl!("Clear"));
+                            resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!("Clear Recent Files")));
+                            clear = resp.on_hover_text(tl!("Clear Recent Files")).clicked();
+                        });
+                    }
+                });
+                ui.add_space(8.0);
+                if app.recent.is_empty() {
+                    ui.label(egui::RichText::new(tl!("Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.")).color(t.text_muted));
                 }
-            });
-            ui.add_space(8.0);
-            if app.recent.is_empty() {
-                ui.label(egui::RichText::new(tl!("Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.")).color(t.text_muted));
             }
             let mut open = None;
             let mut remove = None;
-            for r in &app.recent {
+            for r in app.recent.iter().take(app.recent_limit) {
                 let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 46.0), Sense::click());
                 resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, &r.name));
                 let press = theme::Press::track(ui, &resp);
@@ -229,6 +280,41 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
 mod tests {
     use super::*;
 
+    fn review_home_harness() -> egui_kittest::Harness<'static, PdfCraftApp> {
+        crate::i18n::set_current(crate::i18n::Lang::EN);
+        let mut app = PdfCraftApp::new();
+        app.pinned_tools = vec!["edit".into()];
+        let mut fonts = false;
+        egui_kittest::Harness::builder().with_size(vec2(1500.0, 1200.0)).build_ui_state(
+            move |ui, app| {
+                if !fonts {
+                    ui.ctx().set_fonts(theme::font_definitions());
+                    fonts = true;
+                }
+                show(app, ui);
+            },
+            app,
+        )
+    }
+
+    #[test]
+    fn review_pinned_recommended_tools_appear_once() {
+        use egui_kittest::kittest::Queryable;
+        let mut h = review_home_harness();
+        h.run_steps(3);
+        assert_eq!(h.get_all_by_label("Edit a PDF").count(), 1);
+    }
+
+    #[test]
+    fn review_a_pinned_tool_can_be_unpinned_without_hover() {
+        use egui_kittest::kittest::Queryable;
+        let mut h = review_home_harness();
+        h.run_steps(3);
+        h.get_by_label("Unpin tool").click();
+        h.run_steps(2);
+        assert!(h.state().pinned_tools.is_empty());
+    }
+
     #[test]
     fn translated_card_description_leaves_room_for_the_action() {
         let de = crate::i18n::Lang::from_code("de").unwrap();
diff --git a/crates/ui-egui/src/i18n.rs b/crates/ui-egui/src/i18n.rs
index 3f478b637f..3ac16d622c 100644
--- a/crates/ui-egui/src/i18n.rs
+++ b/crates/ui-egui/src/i18n.rs
@@ -16,7 +16,7 @@
 //! placeholders, plural forms) pick it up from the registry.
 //!
 //! # Looking strings up
-//! - [`tl!`](crate::tl) / [`t`]: a plain string in the current language. [`tr`]: in a given one.
+//! - `tl!` / [`t`]: a plain string in the current language. [`tr`]: in a given one.
 //! - [`tr_ctx`] (`tl_ctx!` in UI code): when one English word needs different translations.
 //! - [`tr_id`]: a command-id keyed string with the English label as fallback (menu items), so a
 //!   translation survives rewording of the English text and can differ per command.
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 56f62b7734..1b08929307 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -20,6 +20,10 @@
 # reorders each line with UAX #9, so preordering here would reverse right-to-left text twice.
 # Spaces and a colon at either end of an entry stay at that end, next to what the code appends.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	القائمة
 	File	ملف
 	Edit	تحرير
@@ -2792,6 +2796,25 @@ certificate	Version	الإصدار
 	Make properties default	جعل الخصائص افتراضية
 	Pages selected	الصفحات المحددة
 	Page properties	خصائص الصفحة
+	Clear search	مسح البحث
+	Pin	تثبيت
+	Pin a tool…	تثبيت أداة…
+	Pin to Home	تثبيت في الصفحة الرئيسية
+	Pin tools to Home	تثبيت الأدوات في الصفحة الرئيسية
+	Pin your favorite tools here for quick access.	ثبّت أدواتك المفضلة هنا للوصول السريع.
+	Pinned	مثبت
+	Pinned Tools	الأدوات المثبتة
+	Search tools…	البحث عن الأدوات…
+	Select tools to display on your Home page for quick access.	حدد الأدوات المراد عرضها على صفحتك الرئيسية للوصول السريع.
+	Unpin from Home	إلغاء التثبيت من الصفحة الرئيسية
+	Unpin tool	إلغاء تثبيت الأداة
+	Transform image	تحويل الصورة
+	Select Tool	أداة التحديد
+	Hand Tool	أداة اليد
+	Marquee Zoom	تكبير بالتحديد
+	Edit this PDF	تحرير هذا الملف PDF
+	Export this PDF	تصدير هذا الملف PDF
+	Find text or tools	البحث عن نص أو أدوات
 	Create & Edit	الإنشاء والتحرير
 	Review & Compare	المراجعة والمقارنة
 	Forms & Signatures	النماذج والتوقيعات
@@ -2838,6 +2861,13 @@ certificate	Version	الإصدار
 	field names can't contain a period: {name}	لا يمكن أن تحتوي أسماء الحقول على نقطة: {name}
 	two cells would both be named {name}	ستحمل خليتان الاسم نفسه {name}
 	a field named {name} already exists	يوجد حقل باسم {name} بالفعل
+	Arrange image	ترتيب الصورة
+	Bring forward	إحضار للأمام
+	Bring to front	إحضار إلى المقدمة
+	Crop	قص
+	Remove crop	إزالة القص
+	Send backward	إرسال للخلف
+	Send to back	إرسال إلى المؤخرة
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	اليوم
@@ -2854,3 +2884,11 @@ certificate	Version	الإصدار
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	خيارات هذا الرد
 	Export value	قيمة التصدير
+	Show Page Edge Shadows	إظهار ظلال حواف الصفحات
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	بحث…
+	Image pasted	تم لصق الصورة
+	No image on clipboard to paste	لا توجد صورة في الحافظة للصقها
+	Pinned {tool} to Home	تم تثبيت {tool} في الرئيسية
+	Unpinned {tool} from Home	تم إلغاء تثبيت {tool} من الرئيسية
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index ceccdf9582..e269febf18 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -7,6 +7,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	About	За програмата
 	Contributors	Сътрудници
 	Models	Модели
@@ -2432,7 +2436,7 @@ animation effects	Off	Изключени
 	You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original.	Разглеждате редакция {rev} на „{from}“. Това е моментна снимка: промените тук няма да засегнат оригинала.
 	Turn upside down (180°)	Обърни наопаки (180°)
 	4 x 6 in label (101.6 x 152.4 mm)	Етикет 4 × 6 in (101,6 × 152,4 mm)
-	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Изрязва всяка страница до отпечатаната ѝ област, завърта я изправено и я побира в листа без разтягане. Един етикет на лист.
+	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Изрязва всяка страница до отпечатаната и област, завърта я изправено и я побира в листа без разтягане. Един етикет на лист.
 	Find untagged content	Намиране на немаркирано съдържание
 	No untagged content was found.	Не е намерено немаркирано съдържание.
 	Found {n} untagged content problems.	Открити са {n} проблема с немаркирано съдържание.
@@ -2478,6 +2482,26 @@ animation effects	Off	Изключени
 	Make properties default	Задаване като свойства по подразбиране
 	Pages selected	Избрани страници
 	Page properties	Свойства на страницата
+	Clear search	Изчистване на търсенето
+	Pin	Закачане
+	Pin a tool…	Закачане на инструмент…
+	Pin to Home	Закачане към Начало
+	Pin tools to Home	Закачане на инструменти към Начало
+	Pin your favorite tools here for quick access.	Закачете любимите си инструменти тук за бърз достъп.
+	Pinned	Закачено
+	Pinned Tools	Закачени инструменти
+	Search tools…	Търсене на инструменти…
+	Select tools to display on your Home page for quick access.	Изберете инструменти за показване на началната страница за бърз достъп.
+	Unpin from Home	Откачане от Начало
+	Unpin tool	Откачане на инструмент
+	Transform image	Трансформиране на изображение
+	Select Tool	Инструмент за избор
+	Hand Tool	Инструмент „Ръка“
+	Marquee Zoom	Мащабиране с рамка
+	Paste	Постави
+	Edit this PDF	Редактирай този PDF
+	Export this PDF	Експортирай този PDF
+	Find text or tools	Търсене на текст или инструменти
 	Create & Edit	Създаване и редактиране
 	Review & Compare	Преглед и сравнение
 	Forms & Signatures	Формуляри и подписи
@@ -2525,6 +2549,13 @@ animation effects	Off	Изключени
 	field names can't contain a period: {name}	имената на полетата не може да съдържат точка: {name}
 	two cells would both be named {name}	две клетки биха имали едно и също име {name}
 	a field named {name} already exists	вече съществува поле с име {name}
+	Arrange image	Подреждане на изображението
+	Bring forward	Преместване напред
+	Bring to front	Преместване най-отпред
+	Crop	Изрязване
+	Remove crop	Премахване на изрязването
+	Send backward	Преместване назад
+	Send to back	Преместване най-отзад
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Днес
@@ -2541,3 +2572,11 @@ animation effects	Off	Изключени
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Опции за този отговор
 	Export value	Стойност за експортиране
+	Show Page Edge Shadows	Показване на сенки по краищата на страниците
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Търсене…
+	Image pasted	Изображението е поставено
+	No image on clipboard to paste	Няма изображение в клипборда за поставяне
+	Pinned {tool} to Home	{tool} е закачен в Начало
+	Unpinned {tool} from Home	{tool} е откачен от Начало
diff --git a/crates/ui-egui/src/i18n/ca.tsv b/crates/ui-egui/src/i18n/ca.tsv
index 83750ba124..7ff0f83fee 100644
--- a/crates/ui-egui/src/i18n/ca.tsv
+++ b/crates/ui-egui/src/i18n/ca.tsv
@@ -9,6 +9,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menú
 	File	Fitxer
 	Edit	Edita
@@ -2815,6 +2819,33 @@ theme	Appearance	Aspecte
 	field names can't contain a period: {name}	els noms dels camps no poden contenir cap punt: {name}
 	two cells would both be named {name}	dues cel·les es dirien {name}
 	a field named {name} already exists	ja existeix un camp anomenat {name}
+	Bring forward	Porta endavant
+	Bring to front	Porta al capdavant
+	Crop image	Retalla la imatge
+	Remove crop	Elimina el retall
+	Send backward	Envia enrere
+	Send to back	Envia al fons
+	Clear search	Neteja la cerca
+	Edit this PDF	Edita aquest PDF
+	Export this PDF	Exporta aquest PDF
+	Find text or tools	Cerca text o eines
+	Hand Tool	Eina Mà
+	Marquee Zoom	Zoom d'enquadrament
+	Pin	Fixa
+	Pin a tool…	Fixa una eina…
+	Pin to Home	Fixa a l'Inici
+	Pin tools to Home	Fixa eines a l'Inici
+	Pin your favorite tools here for quick access.	Fixeu aquí les vostres eines preferides per a un accés ràpid.
+	Pinned	Fixat
+	Pinned Tools	Eines fixades
+	Search tools…	Cerca eines…
+	Select Tool	Eina Selecció
+	Select tools to display on your Home page for quick access.	Seleccioneu les eines que es mostraran a la pàgina d'Inici per a un accés ràpid.
+	Transform image	Transforma la imatge
+	Unpin from Home	Desenganxa de l'Inici
+	Unpin tool	Desenganxa l'eina
+	Arrange image	Organitza la imatge
+	Crop	Escapça
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Avui
@@ -2838,3 +2869,10 @@ theme	Appearance	Aspecte
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opcions d'aquesta resposta
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Cerca…
+	Image pasted	Imatge enganxada
+	No image on clipboard to paste	No hi ha cap imatge al porta-retalls per enganxar
+	Pinned {tool} to Home	{tool} fixat a Inici
+	Unpinned {tool} from Home	{tool} desfixat d’Inici
diff --git a/crates/ui-egui/src/i18n/ckb.tsv b/crates/ui-egui/src/i18n/ckb.tsv
index f6d91e3f42..3b6a7671ed 100644
--- a/crates/ui-egui/src/i18n/ckb.tsv
+++ b/crates/ui-egui/src/i18n/ckb.tsv
@@ -20,6 +20,10 @@
 # reorders each line with UAX #9, so preordering here would reverse right-to-left text twice.
 # Spaces and a colon at either end of an entry stay at that end, next to what the code appends.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	پێڕست
 	File	فایل
 	Edit	دەستکاریکردن
@@ -2735,6 +2739,13 @@ certificate	Version	وەشان
 	Make properties default	کردنی تایبەتمەندییەکان بە بنەڕەتی
 	Pages selected	پەڕە هەڵبژێردراوەکان
 	Page properties	تایبەتمەندییەکانی پەڕە
+	Arrange image	ڕێکخستنی وێنە
+	Bring forward	هێنانە پێشەوە
+	Bring to front	هێنانە پێشەوەی سەرەکی
+	Crop	بڕینەوە
+	Remove crop	لابردنی بڕینەوە
+	Send backward	ناردنە دواوە
+	Send to back	ناردنە دواوەی سەرەکی
 	Create & Edit	دروستکردن و دەستکاریکردن
 	Review & Compare	پێداچوونەوە و بەراوردکردن
 	Forms & Signatures	فۆڕمەکان و واژووەکان
@@ -2770,3 +2781,32 @@ certificate	Version	وەشان
 @plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} more formula reads a missing field.|{n} more formulas read missing fields.
 @plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.
 @plural	{fields} is missing|{fields} are missing	{fields} is missing|{fields} are missing
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	گەڕان…
+	Image pasted	وێنەکە لکێنرا
+	No image on clipboard to paste	هیچ وێنەیەک لە کلیپبۆرد نییە بۆ لکاندن
+	Pinned {tool} to Home	{tool} لە ماڵەوە جێگیرکرا
+	Unpinned {tool} from Home	{tool} لە ماڵەوە لابرا
+
+# Home tools (AI-assisted; not separately native-reviewed)
+	Clear search	پاککردنەوەی گەڕان
+	Pin	جێگیرکردن
+	Pin a tool…	جێگیرکردنی ئامراز…
+	Pin to Home	جێگیرکردن لە ماڵەوە
+	Pin tools to Home	جێگیرکردنی ئامرازەکان لە ماڵەوە
+	Pin your favorite tools here for quick access.	ئامرازە دڵخوازەکانت لێرە جێگیر بکە بۆ دەستگەیشتنی خێرا.
+	Pinned	جێگیرکراو
+	Pinned Tools	ئامرازە جێگیرکراوەکان
+	Search tools…	گەڕان بەدوای ئامرازەکان…
+	Select tools to display on your Home page for quick access.	ئامرازەکان هەڵبژێرە بۆ پیشاندان لە ماڵەوە و دەستگەیشتنی خێرا.
+	Unpin from Home	لابردنی جێگیرکردن لە ماڵەوە
+	Unpin tool	لابردنی جێگیرکردنی ئامراز
+	Transform image	گۆڕینی شێوەی وێنە
+	Select Tool	ئامرازی هەڵبژاردن
+	Hand Tool	ئامرازی دەست
+	Marquee Zoom	گەورەکردنی ناوچەی هەڵبژێردراو
+	Edit this PDF	دەستکاریکردنی ئەم PDF ـە
+	Export this PDF	هەناردەکردنی ئەم PDF ـە
+	Find text or tools	دۆزینەوەی دەق یان ئامراز
+	Crop image	بڕینەوەی وێنە
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 8bfde72a85..22f6e3e056 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -19,6 +19,10 @@
 # commands is kept. Messages with a count but no `@plural` entry use count-neutral wording
 # ("Vybráno stránek: {n}"), because Czech has three plural forms.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Nabídka
 	File	Soubor
 	Rotation:	Otočení:
@@ -2589,6 +2593,26 @@ animation effects	Off	Vypnuto
 	Make properties default	Nastavit vlastnosti jako výchozí
 	Pages selected	Vybrané stránky
 	Page properties	Vlastnosti stránky
+	Clear search	Vymazat hledání
+	Pin	Připnout
+	Pin a tool…	Připnout nástroj…
+	Pin to Home	Připnout na domovskou stránku
+	Pin tools to Home	Připnout nástroje na domovskou stránku
+	Pin your favorite tools here for quick access.	Připněte si sem oblíbené nástroje pro rychlý přístup.
+	Pinned	Připnuto
+	Pinned Tools	Připnuté nástroje
+	Search tools…	Hledat nástroje…
+	Select tools to display on your Home page for quick access.	Vyberte nástroje, které se mají zobrazovat na domovské stránce pro rychlý přístup.
+	Unpin from Home	Odepnout z domovské stránky
+	Unpin tool	Odepnout nástroj
+	Transform image	Transformovat obrázek
+	Select Tool	Nástroj pro výběr
+	Hand Tool	Nástroj ručička
+	Marquee Zoom	Zvětšit vybranou oblast
+	Paste	Vložit
+	Edit this PDF	Upravit toto PDF
+	Export this PDF	Exportovat toto PDF
+	Find text or tools	Hledat text nebo nástroje
 	Create & Edit	Vytváření a úpravy
 	Review & Compare	Revize a porovnání
 	Forms & Signatures	Formuláře a podpisy
@@ -2793,7 +2817,6 @@ animation effects	Off	Vypnuto
 	Organize	Uspořádat
 	Page {n}	Stránka {n}
 	Page {n} of {total}	Stránka {n} z {total}
-	Paste	Vložit
 	Previous	Předchozí
 	Previous (⇧⌘G)	Předchozí (⇧⌘G)
 	Print (⌘P)	Tisk (⌘P)
@@ -2869,6 +2892,14 @@ certificate	Version	Verze
 	field names can't contain a period: {name}	názvy polí nesmějí obsahovat tečku: {name}
 	two cells would both be named {name}	dvě buňky by se jmenovaly {name}
 	a field named {name} already exists	pole s názvem {name} už existuje
+	Bring forward	Přenést blíž
+	Bring to front	Přenést do popředí
+	Crop image	Oříznout obrázek
+	Remove crop	Odebrat oříznutí
+	Send backward	Přenést dál
+	Send to back	Přenést do pozadí
+	Arrange image	Uspořádat obrázek
+	Crop	Oříznout
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Dnes
@@ -2885,3 +2916,11 @@ certificate	Version	Verze
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Možnosti této odpovědi
 	Export value	Exportní hodnota
+	Show Page Edge Shadows	Zobrazovat stíny okrajů stránek
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Hledat…
+	Image pasted	Obrázek vložen
+	No image on clipboard to paste	Ve schránce není obrázek k vložení
+	Pinned {tool} to Home	{tool} připnuto na úvodní stránku
+	Unpinned {tool} from Home	{tool} odepnuto z úvodní stránky
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index 83684c08ea..2c9ce7ae36 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -9,6 +9,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menü
 	File	Datei
 	Edit	Bearbeiten
@@ -2516,6 +2520,26 @@ animation effects	Off	Aus
 	Make properties default	Eigenschaften als Standard festlegen
 	Pages selected	Ausgewählte Seiten
 	Page properties	Seiteneigenschaften
+	Clear search	Suche löschen
+	Pin	Anheften
+	Pin a tool…	Werkzeug anheften…
+	Pin to Home	An Start anheften
+	Pin tools to Home	Werkzeuge an Start anheften
+	Pin your favorite tools here for quick access.	Heften Sie Ihre bevorzugten Werkzeuge hier an, um schnell darauf zuzugreifen.
+	Pinned	Angeheftet
+	Pinned Tools	Angeheftete Werkzeuge
+	Search tools…	Werkzeuge suchen…
+	Select tools to display on your Home page for quick access.	Wählen Sie Werkzeuge für den Schnellzugriff auf Ihrer Startseite aus.
+	Unpin from Home	Von Start lösen
+	Unpin tool	Werkzeug lösen
+	Transform image	Bild transformieren
+	Select Tool	Auswahl-Werkzeug
+	Hand Tool	Hand-Werkzeug
+	Marquee Zoom	Auswahlrahmen-Zoom
+	Paste	Einfügen
+	Edit this PDF	Dieses PDF bearbeiten
+	Export this PDF	Dieses PDF exportieren
+	Find text or tools	Text oder Werkzeuge suchen
 	Create & Edit	Erstellen & Bearbeiten
 	Review & Compare	Prüfen & Vergleichen
 	Forms & Signatures	Formulare & Signaturen
@@ -2563,6 +2587,13 @@ animation effects	Off	Aus
 	field names can't contain a period: {name}	Feldnamen dürfen keinen Punkt enthalten: {name}
 	two cells would both be named {name}	zwei Zellen hätten beide den Namen {name}
 	a field named {name} already exists	ein Feld namens {name} ist bereits vorhanden
+	Arrange image	Bild anordnen
+	Bring forward	Nach vorne bringen
+	Bring to front	In den Vordergrund
+	Crop	Zuschneiden
+	Remove crop	Zuschnitt entfernen
+	Send backward	Nach hinten senden
+	Send to back	In den Hintergrund
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Heute
@@ -2579,3 +2610,11 @@ animation effects	Off	Aus
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Optionen für diese Antwort
 	Export value	Exportwert
+	Show Page Edge Shadows	Schatten an Seitenrändern anzeigen
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Suchen…
+	Image pasted	Bild eingefügt
+	No image on clipboard to paste	Kein Bild in der Zwischenablage zum Einfügen
+	Pinned {tool} to Home	{tool} an Start angeheftet
+	Unpinned {tool} from Home	{tool} von Start gelöst
diff --git a/crates/ui-egui/src/i18n/el.tsv b/crates/ui-egui/src/i18n/el.tsv
index 576cdfcd6d..d83bf4aef7 100644
--- a/crates/ui-egui/src/i18n/el.tsv
+++ b/crates/ui-egui/src/i18n/el.tsv
@@ -2,6 +2,11 @@
 # Partial, clean-room initial contribution. Entries not yet translated fall back to English.
 # Translate from English meanings; retain placeholders and trailing ellipses.
 # Greek plural forms: one (1) | other (0, 2+).
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Μενού
 	File	Αρχείο
 	Edit	Επεξεργασία
@@ -2521,6 +2526,26 @@ animation effects	Off	Ανενεργά
 	Make properties default	Ορισμός ιδιοτήτων ως προεπιλογή
 	Pages selected	Επιλεγμένες σελίδες
 	Page properties	Ιδιότητες σελίδας
+	Clear search	Εκκαθάριση αναζήτησης
+	Pin	Καρφίτσωμα
+	Pin a tool…	Καρφίτσωμα εργαλείου…
+	Pin to Home	Καρφίτσωμα στην Αρχική
+	Pin tools to Home	Καρφίτσωμα εργαλείων στην Αρχική
+	Pin your favorite tools here for quick access.	Καρφιτσώστε τα αγαπημένα σας εργαλεία εδώ για γρήγορη πρόσβαση.
+	Pinned	Καρφιτσωμένο
+	Pinned Tools	Καρφιτσωμένα εργαλεία
+	Search tools…	Αναζήτηση εργαλείων…
+	Select tools to display on your Home page for quick access.	Επιλέξτε εργαλεία για εμφάνιση στην Αρχική σας για γρήγορη πρόσβαση.
+	Unpin from Home	Ξεκαρφίτσωμα από την Αρχική
+	Unpin tool	Ξεκαρφίτσωμα εργαλείου
+	Transform image	Μετασχηματισμός εικόνας
+	Select Tool	Εργαλείο επιλογής
+	Hand Tool	Εργαλείο χεριού
+	Marquee Zoom	Μεγέθυνση επιλεγμένης περιοχής
+	Paste	Επικόλληση
+	Edit this PDF	Επεξεργασία αυτού του PDF
+	Export this PDF	Εξαγωγή αυτού του PDF
+	Find text or tools	Εύρεση κειμένου ή εργαλείων
 	Create & Edit	Δημιουργία και επεξεργασία
 	Review & Compare	Αναθεώρηση και σύγκριση
 	Forms & Signatures	Φόρμες και υπογραφές
@@ -2568,6 +2593,13 @@ animation effects	Off	Ανενεργά
 	field names can't contain a period: {name}	τα ονόματα πεδίων δεν μπορούν να περιέχουν τελεία: {name}
 	two cells would both be named {name}	δύο κελιά θα είχαν το ίδιο όνομα {name}
 	a field named {name} already exists	υπάρχει ήδη πεδίο με όνομα {name}
+	Arrange image	Διάταξη εικόνας
+	Bring forward	Μεταφορά εμπρός
+	Bring to front	Μεταφορά σε πρώτο πλάνο
+	Crop	Περικοπή
+	Remove crop	Κατάργηση περικοπής
+	Send backward	Μεταφορά πίσω
+	Send to back	Μεταφορά σε δεύτερο πλάνο
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Σήμερα
@@ -2584,3 +2616,11 @@ animation effects	Off	Ανενεργά
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Επιλογές για αυτήν την απάντηση
 	Export value	Τιμή εξαγωγής
+	Show Page Edge Shadows	Εμφάνιση σκιών στα άκρα των σελίδων
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Αναζήτηση…
+	Image pasted	Η εικόνα επικολλήθηκε
+	No image on clipboard to paste	Δεν υπάρχει εικόνα στο πρόχειρο για επικόλληση
+	Pinned {tool} to Home	Το {tool} καρφιτσώθηκε στην Αρχική
+	Unpinned {tool} from Home	Το {tool} ξεκαρφιτσώθηκε από την Αρχική
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 3216e4e448..131d2dacaf 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -9,6 +9,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menú
 	File	Archivo
 	Edit	Edición
@@ -2012,9 +2016,16 @@ action wizard	Start	Iniciar
 	Edit text	Editar texto
 	Load document font	Cargar fuente del documento
 	Move image	Mover imagen
+	Transform image	Transformar imagen
 	Rotate image	Girar imagen
 	Flip image	Voltear imagen
 	Delete image	Eliminar imagen
+	Bring to front	Traer al frente
+	Send to back	Enviar al fondo
+	Bring forward	Traer adelante
+	Send backward	Enviar atrás
+	Remove crop	Quitar recorte
+	Crop image	Recortar imagen
 	Add header & footer	Añadir encabezado y pie de página
 	Update header & footer	Actualizar encabezado y pie de página
 	Update watermark	Actualizar marca de agua
@@ -2679,6 +2690,25 @@ animation effects	Off	Desactivados
 # Historical snapshot notice bar (View signed version / View revision).
 	You are viewing the signed version of “{from}” (revision {rev}). It is a snapshot: changes here won't affect the original.	Estás viendo la versión firmada de «{from}» (revisión {rev}). Es una instantánea: los cambios aquí no afectarán al original.
 	You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original.	Estás viendo la revisión {rev} de «{from}». Es una instantánea: los cambios aquí no afectarán al original.
+	Clear search	Borrar búsqueda
+	Pin	Anclar
+	Pin a tool…	Anclar una herramienta…
+	Pin to Home	Anclar en Inicio
+	Pin tools to Home	Anclar herramientas en Inicio
+	Pin your favorite tools here for quick access.	Ancla tus herramientas favoritas aquí para un acceso rápido.
+	Pinned	Anclado
+	Pinned Tools	Herramientas ancladas
+	Search tools…	Buscar herramientas…
+	Select tools to display on your Home page for quick access.	Selecciona las herramientas que se mostrarán en la página de Inicio para un acceso rápido.
+	Unpin from Home	Desanclar de Inicio
+	Unpin tool	Desanclar herramienta
+	Select Tool	Herramienta Selección
+	Hand Tool	Herramienta Mano
+	Marquee Zoom	Zoom por selección
+	Paste	Pegar
+	Edit this PDF	Editar este PDF
+	Export this PDF	Exportar este PDF
+	Find text or tools	Buscar texto o herramientas
 	Attach a file…	Adjuntar un archivo…
 	Delete attachment	Eliminar adjunto
 	Attaching files is not available on the web yet	Adjuntar archivos aún no está disponible en la web
@@ -2834,7 +2864,6 @@ theme	Appearance	Aspecto
 	Import	Importar
 	Move	Mover
 	Duplicate	Duplicar
-	Paste	Pegar
 	Select all	Seleccionar todo
 	Refresh	Actualizar
 	Next	Siguiente
@@ -2885,6 +2914,8 @@ theme	Appearance	Aspecto
 	field names can't contain a period: {name}	los nombres de campo no pueden contener un punto: {name}
 	two cells would both be named {name}	dos celdas se llamarían {name}
 	a field named {name} already exists	ya existe un campo llamado {name}
+	Arrange image	Organizar imagen
+	Crop	Recortar
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Hoy
@@ -2901,3 +2932,11 @@ theme	Appearance	Aspecto
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opciones de esta respuesta
 	Export value	Valor de exportación
+	Show Page Edge Shadows	Mostrar sombras en los bordes de las páginas
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Buscar…
+	Image pasted	Imagen pegada
+	No image on clipboard to paste	No hay ninguna imagen en el portapapeles para pegar
+	Pinned {tool} to Home	{tool} fijado en Inicio
+	Unpinned {tool} from Home	{tool} desfijado de Inicio
diff --git a/crates/ui-egui/src/i18n/fa.tsv b/crates/ui-egui/src/i18n/fa.tsv
index 292b4fbdb3..4f9286b843 100644
--- a/crates/ui-egui/src/i18n/fa.tsv
+++ b/crates/ui-egui/src/i18n/fa.tsv
@@ -19,6 +19,10 @@
 # each rendered line. The Persian comma \u060c and question mark \u061f are used, and \u200c (ZWNJ) joins
 # compound words.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	منو
 	File	فایل
 	Edit	ویرایش
@@ -2816,3 +2820,10 @@ theme	Appearance	ظاهر
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	گزینه‌های این پاسخ
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	جستجو…
+	Image pasted	تصویر چسبانده شد
+	No image on clipboard to paste	تصویری در حافظهٔ موقت برای چسباندن نیست
+	Pinned {tool} to Home	{tool} به خانه سنجاق شد
+	Unpinned {tool} from Home	{tool} از خانه جدا شد
diff --git a/crates/ui-egui/src/i18n/fi.tsv b/crates/ui-egui/src/i18n/fi.tsv
index 80d2a0f859..8c1a9baab9 100644
--- a/crates/ui-egui/src/i18n/fi.tsv
+++ b/crates/ui-egui/src/i18n/fi.tsv
@@ -16,6 +16,11 @@
 # Labels use sentence case. Product and technology names (PdfCraft, PDF, OCR, JavaScript ...)
 # stay in Latin letters; the trailing "…" of dialog commands is kept. Calendar headings use the
 # nominative month (`Lokakuu 2026`); dates use the partitive (`14. lokakuuta 2026`).
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Valikko
 	File	Tiedosto
 	Edit	Muokkaa
@@ -2824,6 +2829,33 @@ theme	Appearance	Teema
 	field names can't contain a period: {name}	kenttien nimissä ei voi olla pistettä: {name}
 	two cells would both be named {name}	kahdella solulla olisi sama nimi {name}
 	a field named {name} already exists	kenttä nimeltä {name} on jo olemassa
+	Bring forward	Tuo eteenpäin
+	Bring to front	Tuo etualalle
+	Crop image	Rajaa kuva
+	Remove crop	Poista rajaus
+	Send backward	Vie taaksepäin
+	Send to back	Vie taustalle
+	Clear search	Tyhjennä haku
+	Edit this PDF	Muokkaa tätä PDF-tiedostoa
+	Export this PDF	Vie tämä PDF-tiedosto
+	Find text or tools	Etsi tekstiä tai työkaluja
+	Hand Tool	Käsityökalu
+	Marquee Zoom	Alueen zoomaus
+	Pin	Kiinnitä
+	Pin a tool…	Kiinnitä työkalu…
+	Pin to Home	Kiinnitä Aloitus-näkymään
+	Pin tools to Home	Kiinnitä työkaluja Aloitus-näkymään
+	Pin your favorite tools here for quick access.	Kiinnitä suosikkityökalusi tähän nopeaa käyttöä varten.
+	Pinned	Kiinnitetty
+	Pinned Tools	Kiinnitetyt työkalut
+	Search tools…	Etsi työkaluja…
+	Select Tool	Valintatyökalu
+	Select tools to display on your Home page for quick access.	Valitse Aloitus-sivulla näytettävät työkalut nopeaa käyttöä varten.
+	Transform image	Muunna kuvaa
+	Unpin from Home	Irrota Aloitus-näkymästä
+	Unpin tool	Irrota työkalu
+	Arrange image	Järjestä kuva
+	Crop	Rajaa
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Tänään
@@ -2847,3 +2879,10 @@ theme	Appearance	Teema
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Tämän vastauksen asetukset
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Hae…
+	Image pasted	Kuva liitetty
+	No image on clipboard to paste	Leikepöydällä ei ole liitettävää kuvaa
+	Pinned {tool} to Home	{tool} kiinnitetty aloitussivulle
+	Unpinned {tool} from Home	{tool} irrotettu aloitussivulta
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 6092231df3..1c22cf9d81 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -9,6 +9,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menu
 	File	Fichier
 	Edit	Édition
@@ -2515,6 +2519,26 @@ animation effects	Off	Désactivés
 	Make properties default	Définir comme propriétés par défaut
 	Pages selected	Pages sélectionnées
 	Page properties	Propriétés de la page
+	Clear search	Effacer la recherche
+	Pin	Épingler
+	Pin a tool…	Épingler un outil…
+	Pin to Home	Épingler à l'Accueil
+	Pin tools to Home	Épingler des outils à l'Accueil
+	Pin your favorite tools here for quick access.	Épinglez vos outils préférés ici pour un accès rapide.
+	Pinned	Épinglé
+	Pinned Tools	Outils épinglés
+	Search tools…	Rechercher des outils…
+	Select tools to display on your Home page for quick access.	Sélectionnez les outils à afficher sur votre page d'Accueil pour un accès rapide.
+	Unpin from Home	Désépingler de l'Accueil
+	Unpin tool	Désépingler l'outil
+	Transform image	Transformer l'image
+	Select Tool	Outil Sélection
+	Hand Tool	Outil Main
+	Marquee Zoom	Zoom par sélection
+	Paste	Coller
+	Edit this PDF	Modifier ce PDF
+	Export this PDF	Exporter ce PDF
+	Find text or tools	Rechercher du texte ou des outils
 	Create & Edit	Créer et modifier
 	Review & Compare	Réviser et comparer
 	Forms & Signatures	Formulaires et signatures
@@ -2632,7 +2656,6 @@ animation effects	Off	Désactivés
 	Page {} has additional actions	La page {} contient des actions supplémentaires
 	Panel layout could not be restored: {error}	Impossible de restaurer la disposition des panneaux : {error}
 	Panel move was not applied: {error}	Le déplacement du panneau n'a pas été appliqué : {error}
-	Paste	Coller
 	PdfCraft can't check this signature yet: {}.	PdfCraft ne peut pas encore contrôler cette signature : {}.
 	Previous	Précédent
 	Previous (⇧⌘G)	Précédent (⇧⌘G)
@@ -2828,6 +2851,13 @@ certificate	Version	Version
 	field names can't contain a period: {name}	les noms de champ ne peuvent pas contenir de point : {name}
 	two cells would both be named {name}	deux cellules porteraient le nom {name}
 	a field named {name} already exists	un champ nommé {name} existe déjà
+	Arrange image	Organiser l'image
+	Bring forward	Avancer
+	Bring to front	Mettre au premier plan
+	Crop	Recadrer
+	Remove crop	Supprimer le recadrage
+	Send backward	Reculer
+	Send to back	Mettre à l'arrière-plan
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Aujourd'hui
@@ -2844,3 +2874,11 @@ certificate	Version	Version
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Options de cette réponse
 	Export value	Valeur d’exportation
+	Show Page Edge Shadows	Afficher les ombres des bords des pages
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Rechercher…
+	Image pasted	Image collée
+	No image on clipboard to paste	Aucune image à coller dans le presse-papiers
+	Pinned {tool} to Home	{tool} épinglé à l’Accueil
+	Unpinned {tool} from Home	{tool} désépinglé de l’Accueil
diff --git a/crates/ui-egui/src/i18n/hi.tsv b/crates/ui-egui/src/i18n/hi.tsv
index dfaa94b5d6..52c5450bb3 100644
--- a/crates/ui-egui/src/i18n/hi.tsv
+++ b/crates/ui-egui/src/i18n/hi.tsv
@@ -2,6 +2,11 @@
 #   context <TAB> English source <TAB> translation
 #   Clean-room translation written from the English source's meaning.
 #   License: MIT OR Apache-2.0.
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	मेनू
 	File	फ़ाइल
 	Edit	संपादित करें
@@ -2786,6 +2791,31 @@ theme	Appearance	स्वरूप
 	field names can't contain a period: {name}	फ़ील्ड के नामों में पूर्ण विराम (.) नहीं हो सकता: {name}
 	two cells would both be named {name}	दो सेल का नाम {name} हो जाएगा
 	a field named {name} already exists	{name} नाम का फ़ील्ड पहले से मौजूद है
+	Clear search	खोज साफ़ करें
+	Edit this PDF	इस PDF को संपादित करें
+	Export this PDF	इस PDF को निर्यात करें
+	Find text or tools	पाठ या उपकरण ढूंढें
+	Hand Tool	हैंड टूल
+	Marquee Zoom	मार्की ज़ूम
+	Pin	पिन करें
+	Pin a tool…	उपकरण पिन करें…
+	Pin to Home	होम पर पिन करें
+	Pin tools to Home	होम पर उपकरण पिन करें
+	Pin your favorite tools here for quick access.	त्वरित पहुँच के लिए अपने पसंदीदा उपकरण यहाँ पिन करें।
+	Pinned	पिन किया गया
+	Pinned Tools	पिन किए गए उपकरण
+	Search tools…	उपकरण खोजें…
+	Select Tool	चयन उपकरण
+	Select tools to display on your Home page for quick access.	त्वरित पहुँच के लिए अपने होम पेज पर प्रदर्शित करने हेतु उपकरण चुनें।
+	Unpin from Home	होम से अनपिन करें
+	Unpin tool	उपकरण अनपिन करें
+	Arrange image	छवि व्यवस्थित करें
+	Bring forward	आगे लाएँ
+	Bring to front	सबसे आगे लाएँ
+	Crop	क्रॉप करें
+	Remove crop	क्रॉप हटाएँ
+	Send backward	पीछे भेजें
+	Send to back	सबसे पीछे भेजें
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	आज
@@ -2809,3 +2839,10 @@ theme	Appearance	स्वरूप
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	इस जवाब के विकल्प
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	खोजें…
+	Image pasted	छवि चिपकाई गई
+	No image on clipboard to paste	चिपकाने के लिए क्लिपबोर्ड में कोई छवि नहीं है
+	Pinned {tool} to Home	{tool} को होम पर पिन किया गया
+	Unpinned {tool} from Home	{tool} को होम से अनपिन किया गया
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 53b81062bb..47d9c24b40 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -9,6 +9,11 @@
 # consulted or copied; add entries the same way.
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menü
 	File	Fájl
 	Edit	Szerkesztés
@@ -2514,6 +2519,26 @@ animation effects	Off	Ki
 	Make properties default	Tulajdonságok beállítása alapértelmezettként
 	Pages selected	Kijelölt oldalak
 	Page properties	Oldaltulajdonságok
+	Clear search	Keresés törlése
+	Pin	Rögzítés
+	Pin a tool…	Eszköz rögzítése…
+	Pin to Home	Rögzítés a Kezdőlapra
+	Pin tools to Home	Eszközök rögzítése a Kezdőlapra
+	Pin your favorite tools here for quick access.	Rögzítse ide kedvenc eszközeit a gyors eléréshez.
+	Pinned	Rögzítve
+	Pinned Tools	Rögzített eszközök
+	Search tools…	Eszközök keresése…
+	Select tools to display on your Home page for quick access.	Válassza ki a Kezdőlapon megjelenítendő eszközöket a gyors eléréshez.
+	Unpin from Home	Rögzítés feloldása a Kezdőlapról
+	Unpin tool	Eszköz rögzítésének feloldása
+	Transform image	Kép transzformálása
+	Select Tool	Kijelölő eszköz
+	Hand Tool	Kéz eszköz
+	Marquee Zoom	Kijelölő nagyítás
+	Paste	Beillesztés
+	Edit this PDF	Ezen PDF szerkesztése
+	Export this PDF	Ezen PDF exportálása
+	Find text or tools	Szöveg vagy eszközök keresése
 	Create & Edit	Létrehozás és szerkesztés
 	Review & Compare	Áttekintés és összehasonlítás
 	Forms & Signatures	Űrlapok és aláírások
@@ -2561,6 +2586,13 @@ animation effects	Off	Ki
 	field names can't contain a period: {name}	a mezőnevek nem tartalmazhatnak pontot: {name}
 	two cells would both be named {name}	két cella neve is {name} lenne
 	a field named {name} already exists	már van {name} nevű mező
+	Arrange image	Kép elrendezése
+	Bring forward	Előrébb hozás
+	Bring to front	Előrehozás
+	Crop	Körülvágás
+	Remove crop	Körülvágás eltávolítása
+	Send backward	Hátrébb küldés
+	Send to back	Hátraküldés
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Ma
@@ -2577,3 +2609,11 @@ animation effects	Off	Ki
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	A válasz beállításai
 	Export value	Exportérték
+	Show Page Edge Shadows	Oldalszéli árnyékok megjelenítése
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Keresés…
+	Image pasted	Kép beillesztve
+	No image on clipboard to paste	Nincs beilleszthető kép a vágólapon
+	Pinned {tool} to Home	{tool} rögzítve a kezdőlapra
+	Unpinned {tool} from Home	{tool} leválasztva a kezdőlapról
diff --git a/crates/ui-egui/src/i18n/id.tsv b/crates/ui-egui/src/i18n/id.tsv
index 0eb02928f1..89152f62a4 100644
--- a/crates/ui-egui/src/i18n/id.tsv
+++ b/crates/ui-egui/src/i18n/id.tsv
@@ -3,6 +3,11 @@
 # Clean-room translations of PdfCraft's English UI labels. Use standard Indonesian computing
 # terms; keep product and format names (PdfCraft, PDF, PDF/A, OCR, XFA, Word...) unchanged.
 # Indonesian does not inflect nouns for number, so @plural entries list one form.
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menu
 	Edit	Edit
 	Pages	Halaman
@@ -2787,6 +2792,31 @@ theme	Appearance	Tampilan
 	field names can't contain a period: {name}	nama kolom tidak boleh berisi titik: {name}
 	two cells would both be named {name}	dua sel akan sama-sama bernama {name}
 	a field named {name} already exists	kolom bernama {name} sudah ada
+	Clear search	Bersihkan pencarian
+	Edit this PDF	Edit PDF ini
+	Export this PDF	Ekspor PDF ini
+	Find text or tools	Temukan teks atau alat
+	Hand Tool	Alat Tangan
+	Marquee Zoom	Zoom Bidang
+	Pin	Sematkan
+	Pin a tool…	Sematkan alat…
+	Pin to Home	Sematkan ke Beranda
+	Pin tools to Home	Sematkan alat ke Beranda
+	Pin your favorite tools here for quick access.	Sematkan alat favorit Anda di sini untuk akses cepat.
+	Pinned	Disematkan
+	Pinned Tools	Alat yang Disematkan
+	Search tools…	Cari alat…
+	Select Tool	Alat Pemilih
+	Select tools to display on your Home page for quick access.	Pilih alat untuk ditampilkan di halaman Beranda Anda untuk akses cepat.
+	Unpin from Home	Lepas sematan dari Beranda
+	Unpin tool	Lepas sematan alat
+	Arrange image	Atur gambar
+	Bring forward	Maju Selangkah
+	Bring to front	Bawa ke Depan
+	Crop	Pangkas
+	Remove crop	Hapus pangkasan
+	Send backward	Mundur Selangkah
+	Send to back	Kirim ke Belakang
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Hari ini
@@ -2810,3 +2840,10 @@ theme	Appearance	Tampilan
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opsi untuk balasan ini
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Cari…
+	Image pasted	Gambar ditempel
+	No image on clipboard to paste	Tidak ada gambar di papan klip untuk ditempel
+	Pinned {tool} to Home	{tool} disematkan ke Beranda
+	Unpinned {tool} from Home	{tool} dilepas dari Beranda
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index a3dc999d6d..0cae8f3e98 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -15,6 +15,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menu
 	File	File
 	Edit	Modifica
@@ -2727,6 +2731,26 @@ certificate	Key usage	Utilizzo chiave
 certificate	Self-signed	Autofirmato
 certificate	SHA-1 digest	Impronta SHA-1
 certificate	SHA-256 digest	Impronta SHA-256
+	Clear search	Cancella ricerca
+	Pin	Fissa
+	Pin a tool…	Fissa uno strumento…
+	Pin to Home	Fissa sulla Home
+	Pin tools to Home	Fissa strumenti sulla Home
+	Pin your favorite tools here for quick access.	Fissa qui i tuoi strumenti preferiti per un accesso rapido.
+	Pinned	Fissato
+	Pinned Tools	Strumenti fissati
+	Search tools…	Cerca strumenti…
+	Select tools to display on your Home page for quick access.	Seleziona gli strumenti da visualizzare nella pagina Home per un acceso rapido.
+	Unpin from Home	Rimuovi da Home
+	Unpin tool	Sblocca strumento dalla Home
+	Transform image	Trasforma immagine
+	Select Tool	Strumento Selezione
+	Hand Tool	Strumento Mano
+	Marquee Zoom	Ingrandimento selettivo
+	Paste	Incolla
+	Edit this PDF	Modifica questo PDF
+	Export this PDF	Esporta questo PDF
+	Find text or tools	Trova testo o strumenti
 	Create & Edit	Crea e modifica
 	Review & Compare	Revisione e confronto
 	Forms & Signatures	Moduli e firme
@@ -2794,6 +2818,13 @@ certificate	SHA-256 digest	Impronta SHA-256
 	field names can't contain a period: {name}	i nomi dei campi non possono contenere un punto: {name}
 	two cells would both be named {name}	due celle si chiamerebbero entrambe {name}
 	a field named {name} already exists	esiste già un campo chiamato {name}
+	Arrange image	Disponi immagine
+	Bring forward	Porta avanti
+	Bring to front	Porta in primo piano
+	Crop	Ritaglia
+	Remove crop	Rimuovi ritaglio
+	Send backward	Porta indietro
+	Send to back	Porta in secondo piano
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Oggi
@@ -2810,3 +2841,11 @@ certificate	SHA-256 digest	Impronta SHA-256
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opzioni per questa risposta
 	Export value	Valore di esportazione
+	Show Page Edge Shadows	Mostra le ombre ai bordi delle pagine
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Cerca…
+	Image pasted	Immagine incollata
+	No image on clipboard to paste	Nessuna immagine negli appunti da incollare
+	Pinned {tool} to Home	{tool} fissato alla Home
+	Unpinned {tool} from Home	{tool} rimosso dai preferiti della Home
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 5e64a1a8ce..abc616b817 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -15,6 +15,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	メニュー
 	File	ファイル
 	Edit	編集
@@ -2515,6 +2519,26 @@ animation effects	Off	オフ
 	Make properties default	プロパティをデフォルトに設定
 	Pages selected	選択したページ
 	Page properties	ページのプロパティ
+	Clear search	検索をクリア
+	Pin	ピン留め
+	Pin a tool…	ツールをピン留め…
+	Pin to Home	ホームにピン留め
+	Pin tools to Home	ツールをホームにピン留め
+	Pin your favorite tools here for quick access.	よく使うツールをここにピン留めして、すばやくアクセスできるようにします。
+	Pinned	ピン留め済み
+	Pinned Tools	ピン留めしたツール
+	Search tools…	ツールを検索…
+	Select tools to display on your Home page for quick access.	すばやくアクセスできるように、ホームに表示するツールを選択します。
+	Unpin from Home	ホームからピン留めを解除
+	Unpin tool	ツールのピン留めを解除
+	Transform image	画像を変換
+	Select Tool	選択ツール
+	Hand Tool	手のひらツール
+	Marquee Zoom	範囲指定ズーム
+	Paste	貼り付け
+	Edit this PDF	この PDF を編集
+	Export this PDF	この PDF を書き出す
+	Find text or tools	テキストまたはツールを検索
 	Create & Edit	作成と編集
 	Review & Compare	レビューと比較
 	Forms & Signatures	フォームと署名
@@ -2562,6 +2586,13 @@ animation effects	Off	オフ
 	field names can't contain a period: {name}	フィールド名にピリオドは使えません: {name}
 	two cells would both be named {name}	2 つのセルが同じ名前 {name} になります
 	a field named {name} already exists	{name} という名前のフィールドは既にあります
+	Arrange image	画像を配置
+	Bring forward	前面へ移動
+	Bring to front	最前面へ移動
+	Crop	切り抜き
+	Remove crop	切り抜きを解除
+	Send backward	背面へ移動
+	Send to back	最背面へ移動
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	今日
@@ -2578,3 +2609,11 @@ animation effects	Off	オフ
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	この返信のオプション
 	Export value	書き出し値
+	Show Page Edge Shadows	ページ端の影を表示
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	検索…
+	Image pasted	画像を貼り付けました
+	No image on clipboard to paste	貼り付ける画像がクリップボードにありません
+	Pinned {tool} to Home	{tool} をホームにピン留めしました
+	Unpinned {tool} from Home	{tool} のホームへのピン留めを解除しました
diff --git a/crates/ui-egui/src/i18n/kk.tsv b/crates/ui-egui/src/i18n/kk.tsv
index 5c8e594759..fc6a2d783a 100644
--- a/crates/ui-egui/src/i18n/kk.tsv
+++ b/crates/ui-egui/src/i18n/kk.tsv
@@ -1,3 +1,7 @@
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Мәзір
 	File	Файл
 	Edit	Түзету
@@ -2513,6 +2517,26 @@ animation effects	Off	Өшірулі
 	Make properties default	Қасиеттерді әдепкі ету
 	Pages selected	Таңдалған беттер
 	Page properties	Бет қасиеттері
+	Clear search	Іздеуді тазалау
+	Pin	Бекіту
+	Pin a tool…	Құралды бекіту…
+	Pin to Home	Басты бетке бекіту
+	Pin tools to Home	Құралдарды басты бетке бекіту
+	Pin your favorite tools here for quick access.	Жылдам қол жеткізу үшін таңдаулы құралдарды осында бекітіңіз.
+	Pinned	Бекітілген
+	Pinned Tools	Бекітілген құралдар
+	Search tools…	Құралдарды іздеу…
+	Select tools to display on your Home page for quick access.	Жылдам қол жеткізу үшін басты бетте көрсетілетін құралдарды таңдаңыз.
+	Unpin from Home	Басты беттен алып тастау
+	Unpin tool	Құралды бекітуден шығару
+	Transform image	Кескінді түрлендіру
+	Select Tool	Таңдау құралы
+	Hand Tool	Қол құралы
+	Marquee Zoom	Аймақты масштабтау
+	Paste	Қою
+	Edit this PDF	Осы PDF файлын түзету
+	Export this PDF	Осы PDF файлын экспорттау
+	Find text or tools	Мәтінді немесе құралдарды табу
 	Create & Edit	Жасау және өңдеу
 	Review & Compare	Шолу және салыстыру
 	Forms & Signatures	Пішіндер және қолтаңбалар
@@ -2560,6 +2584,13 @@ animation effects	Off	Өшірулі
 	field names can't contain a period: {name}	өріс атауларында нүкте болмауы керек: {name}
 	two cells would both be named {name}	екі ұяшықтың да атауы {name} болар еді
 	a field named {name} already exists	{name} атты өріс бар
+	Arrange image	Суретті реттеу
+	Bring forward	Алға жылжыту
+	Bring to front	Алдыңғы планға шығару
+	Crop	Қию
+	Remove crop	Қиюды алып тастау
+	Send backward	Артқа жылжыту
+	Send to back	Артқы планға жіберу
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Бүгін
@@ -2576,3 +2607,11 @@ animation effects	Off	Өшірулі
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Осы жауаптың параметрлері
 	Export value	Экспорт мәні
+	Show Page Edge Shadows	Бет жиектерінің көлеңкелерін көрсету
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Іздеу…
+	Image pasted	Сурет қойылды
+	No image on clipboard to paste	Алмасу буферінде қоятын сурет жоқ
+	Pinned {tool} to Home	{tool} басты бетке бекітілді
+	Unpinned {tool} from Home	{tool} басты беттен ажыратылды
diff --git a/crates/ui-egui/src/i18n/ko.tsv b/crates/ui-egui/src/i18n/ko.tsv
index 1e461bbdff..20315b5fcf 100644
--- a/crates/ui-egui/src/i18n/ko.tsv
+++ b/crates/ui-egui/src/i18n/ko.tsv
@@ -2,6 +2,11 @@
 #   context <TAB> English source <TAB> translation
 #   Clean-room translation written from the English source's meaning.
 #   License: MIT OR Apache-2.0.
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	메뉴
 	File	파일
 	Edit	편집
@@ -2786,6 +2791,31 @@ theme	Appearance	모양
 	field names can't contain a period: {name}	필드 이름에는 마침표를 쓸 수 없습니다: {name}
 	two cells would both be named {name}	두 셀의 이름이 모두 {name}이(가) 됩니다
 	a field named {name} already exists	{name}(이)라는 필드가 이미 있습니다
+	Clear search	검색 지우기
+	Edit this PDF	이 PDF 편집
+	Export this PDF	이 PDF 내보내기
+	Find text or tools	텍스트 또는 도구 찾기
+	Hand Tool	손 도구
+	Marquee Zoom	영역 확대/축소
+	Pin	고정
+	Pin a tool…	도구 고정…
+	Pin to Home	홈에 고정
+	Pin tools to Home	홈에 도구 고정
+	Pin your favorite tools here for quick access.	빠른 액세스를 위해 즐겨찾는 도구를 여기에 고정하세요.
+	Pinned	고정됨
+	Pinned Tools	고정된 도구
+	Search tools…	도구 검색…
+	Select Tool	선택 도구
+	Select tools to display on your Home page for quick access.	빠른 액세스를 위해 홈 페이지에 표시할 도구를 선택하세요.
+	Unpin from Home	홈에서 고정 해제
+	Unpin tool	도구 고정 해제
+	Arrange image	이미지 정렬
+	Bring forward	앞으로 가져오기
+	Bring to front	맨 앞으로 가져오기
+	Crop	자르기
+	Remove crop	자르기 제거
+	Send backward	뒤로 보내기
+	Send to back	맨 뒤로 보내기
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	오늘
@@ -2809,3 +2839,10 @@ theme	Appearance	모양
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	이 답글의 옵션
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	검색…
+	Image pasted	이미지를 붙여넣었습니다
+	No image on clipboard to paste	클립보드에 붙여넣을 이미지가 없습니다
+	Pinned {tool} to Home	{tool}을 홈에 고정했습니다
+	Unpinned {tool} from Home	{tool}의 홈 고정을 해제했습니다
diff --git a/crates/ui-egui/src/i18n/lo.tsv b/crates/ui-egui/src/i18n/lo.tsv
index c4d45c90d1..ea684f6d59 100644
--- a/crates/ui-egui/src/i18n/lo.tsv
+++ b/crates/ui-egui/src/i18n/lo.tsv
@@ -15,6 +15,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "..." of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	ເມນູ
 	File	ໄຟລ໌
 	Edit	ແກ້ໄຂ
@@ -2451,6 +2455,13 @@ animation effects	Off	ປິດ
 	Make properties default	ກຳນົດຄຸນສົມບັດເປັນຄ່າເລີ່ມຕົ້ນ
 	Pages selected	ໜ້າທີ່ເລືອກ
 	Page properties	ຄຸນສົມບັດໜ້າ
+	Arrange image	ຈັດຮູບພາບ
+	Bring forward	ນຳມາທາງໜ້າ
+	Bring to front	ນຳມາໄວ້ໜ້າສຸດ
+	Crop	ຕັດຂອບ
+	Remove crop	ຍົກເລີກການຕັດຂອບ
+	Send backward	ສົ່ງໄປທາງຫຼັງ
+	Send to back	ສົ່ງໄປໄວ້ຫຼັງສຸດ
 	Create & Edit	ສ້າງ & ແກ້ໄຂ
 	Review & Compare	ກວດກາຄືນ & ປຽບທຽບ
 	Forms & Signatures	ຟອມ & ລາຍເຊັນ
@@ -2481,3 +2492,33 @@ animation effects	Off	ປິດ
 	Unchecked reads	Unchecked reads
 	{field} reads fields named as it runs	{field} reads fields named as it runs
 	Some names are built as it runs	Some names are built as it runs
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	ຄົ້ນຫາ…
+	Image pasted	ວາງຮູບແລ້ວ
+	No image on clipboard to paste	ບໍ່ມີຮູບໃນຄລິບບອດເພື່ອວາງ
+	Pinned {tool} to Home	ປັກໝຸດ {tool} ໄວ້ໜ້າຫຼັກແລ້ວ
+	Unpinned {tool} from Home	ຖອນໝຸດ {tool} ຈາກໜ້າຫຼັກແລ້ວ
+
+# Home tools (AI-assisted; not separately native-reviewed)
+	Clear search	ລ້າງການຄົ້ນຫາ
+	Pin	ປັກໝຸດ
+	Pin a tool…	ປັກໝຸດເຄື່ອງມື…
+	Pin to Home	ປັກໝຸດໄວ້ໜ້າຫຼັກ
+	Pin tools to Home	ປັກໝຸດເຄື່ອງມືໄວ້ໜ້າຫຼັກ
+	Pin your favorite tools here for quick access.	ປັກໝຸດເຄື່ອງມືທີ່ມັກໄວ້ທີ່ນີ້ເພື່ອເຂົ້າໃຊ້ໄດ້ໄວ.
+	Pinned	ປັກໝຸດແລ້ວ
+	Pinned Tools	ເຄື່ອງມືທີ່ປັກໝຸດ
+	Search tools…	ຄົ້ນຫາເຄື່ອງມື…
+	Select tools to display on your Home page for quick access.	ເລືອກເຄື່ອງມືໃຫ້ສະແດງໃນໜ້າຫຼັກເພື່ອເຂົ້າໃຊ້ໄດ້ໄວ.
+	Unpin from Home	ຖອນໝຸດຈາກໜ້າຫຼັກ
+	Unpin tool	ຖອນໝຸດເຄື່ອງມື
+	Transform image	ປ່ຽນຮູບຮ່າງຮູບ
+	Select Tool	ເຄື່ອງມືເລືອກ
+	Hand Tool	ເຄື່ອງມືມື
+	Marquee Zoom	ຊູມພື້ນທີ່ເລືອກ
+	Paste	ວາງ
+	Edit this PDF	ແກ້ໄຂ PDF ນີ້
+	Export this PDF	ສົ່ງອອກ PDF ນີ້
+	Find text or tools	ຊອກຫາຂໍ້ຄວາມ ຫຼື ເຄື່ອງມື
+	Crop image	ຕັດຂອບຮູບພາບ
diff --git a/crates/ui-egui/src/i18n/lt.tsv b/crates/ui-egui/src/i18n/lt.tsv
index 61fd9dc9a2..fd7f431154 100644
--- a/crates/ui-egui/src/i18n/lt.tsv
+++ b/crates/ui-egui/src/i18n/lt.tsv
@@ -4,6 +4,10 @@
 # consult the Lietuvos Respublikos terminų bankas (terminai.vlkk.lt) when selecting terminology.
 # Product and format names (PdfCraft, PDF, PDF/A, OCR, XFA, Word…) remain unchanged.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Meniu
 	Edit	Redaguoti
 	Pages	Puslapiai
@@ -2765,6 +2769,12 @@ key	Space	Tarpas
 	Make properties default	Nustatyti ypatybes kaip numatytąsias
 	Pages selected	Pasirinkti puslapiai
 	Page properties	Puslapio ypatybės
+	Bring forward	Perkelti į priekį
+	Bring to front	Iškelti į priekį
+	Crop image	Apkarpyti paveikslėlį
+	Remove crop	Pašalinti apkarpymą
+	Send backward	Perkelti atgal
+	Send to back	Nukelti į galą
 	Create & Edit	Kūrimas ir redagavimas
 	Review & Compare	Peržiūra ir palyginimas
 	Forms & Signatures	Formos ir parašai
@@ -2773,7 +2783,6 @@ key	Space	Tarpas
 	No tools match your search.	Paieškos neatitinka joks įrankis.
 	Expand all tools	Išskleisti visus įrankius
 	Collapse all tools	Suskleisti visus įrankius
-
 # AI-assisted additions for concurrently merged UI features (2026-10-15).
 # These additions have not had separate native-speaker review.
 	Mouse wheel scroll speed	Pelės ratuko slinkimo greitis
@@ -2781,6 +2790,25 @@ key	Space	Tarpas
 	The password must have at least 6 characters.	Slaptažodį turi sudaryti bent 6 simboliai.
 	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Šis failas diske pasikeitė. Įkelkite jį iš naujo, kad pamatytumėte naują versiją; neįrašyti pakeitimai bus prarasti.
 theme	Appearance	Išvaizda
+	Clear search	Išvalyti paiešką
+	Pin	Prisegti
+	Pin a tool…	Prisegti įrankį…
+	Pin to Home	Prisegti pradžioje
+	Pin tools to Home	Prisegti įrankius pradžioje
+	Pin your favorite tools here for quick access.	Prisekite mėgstamus įrankius čia, kad greitai pasiektumėte.
+	Pinned	Prisegta
+	Pinned Tools	Prisegti įrankiai
+	Search tools…	Ieškoti įrankių…
+	Select tools to display on your Home page for quick access.	Pasirinkite įrankius, kuriuos norite rodyti pradžios puslapyje.
+	Unpin from Home	Atsegti nuo pradžios
+	Unpin tool	Atsegti įrankį
+	Transform image	Transformuoti paveikslėlį
+	Select Tool	Pasirinkimo įrankis
+	Hand Tool	Rankos įrankis
+	Marquee Zoom	Didinti pažymėtą sritį
+	Edit this PDF	Redaguoti šį PDF
+	Export this PDF	Eksportuoti šį PDF
+	Find text or tools	Rasti tekstą arba įrankius
 	Attach a file…	Pridėti failą…
 	Delete attachment	Ištrinti priedą
 	Attaching files is not available on the web yet	Failų pridėjimas žiniatinklyje dar negalimas
@@ -2823,6 +2851,8 @@ theme	Appearance	Išvaizda
 	a table has 1 to {max} columns	lentelėje gali būti nuo 1 iki {max} stulpelių
 	the first row number can be at most {max}	pirmosios eilutės numeris gali būti ne didesnis nei {max}
 	the area, the spacing and the column widths must be numbers, the spacing 0 or more and each width more than 0	sritis, tarpai ir stulpelių pločiai turi būti skaičiai, tarpai – 0 arba daugiau, o kiekvienas plotis – daugiau nei 0
+	Arrange image	Tvarkyti vaizdą
+	Crop	Apkarpyti
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Šiandien
@@ -2839,3 +2869,11 @@ theme	Appearance	Išvaizda
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Šio atsakymo parinktys
 	Export value	Eksporto reikšmė
+	Show Page Edge Shadows	Rodyti puslapių kraštų šešėlius
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Ieškoti…
+	Image pasted	Paveikslėlis įklijuotas
+	No image on clipboard to paste	Iškarpinėje nėra paveikslėlio įklijuoti
+	Pinned {tool} to Home	{tool} prisegtas pradžios puslapyje
+	Unpinned {tool} from Home	{tool} atsegtas nuo pradžios puslapio
diff --git a/crates/ui-egui/src/i18n/nb.tsv b/crates/ui-egui/src/i18n/nb.tsv
index e81b84e341..b54b3e3526 100644
--- a/crates/ui-egui/src/i18n/nb.tsv
+++ b/crates/ui-egui/src/i18n/nb.tsv
@@ -7,6 +7,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Allow	Tillat
 	Cancel	Avbryt
 	Only allow this if you trust the source document.	Tillat dette bare hvis du stoler på kildedokumentet.
@@ -2724,6 +2728,13 @@ key	Space	Mellomrom
 # Page gaps (AI-assisted, not separately native-reviewed)
 	Show gaps between pages	Vis mellomrom mellom sidene
 	Hide gaps to join page edges. Margins inside the PDF remain unchanged.	Skjul mellomrommene slik at sidekantene møtes. Margene inne i PDF-en endres ikke.
+	Arrange image	Ranger bilde
+	Bring forward	Flytt fremover
+	Bring to front	Plasser lengst frem
+	Crop	Beskjær
+	Remove crop	Fjern beskjæring
+	Send backward	Flytt bakover
+	Send to back	Plasser lengst bak
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	I dag
@@ -2754,3 +2765,32 @@ key	Space	Mellomrom
 @plural	{n} more formula reads a missing field.|{n} more formulas read missing fields.	{n} more formula reads a missing field.|{n} more formulas read missing fields.
 @plural	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.	{fields} builds some field names as it runs, so those reads aren't checked.|{fields} build some field names as they run, so those reads aren't checked.
 @plural	{fields} is missing|{fields} are missing	{fields} is missing|{fields} are missing
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Søk…
+	Image pasted	Bilde limt inn
+	No image on clipboard to paste	Ingen bilder på utklippstavlen å lime inn
+	Pinned {tool} to Home	Festet {tool} til Hjem
+	Unpinned {tool} from Home	Løsnet {tool} fra Hjem
+
+# Home tools (AI-assisted; not separately native-reviewed)
+	Clear search	Tøm søk
+	Pin	Fest
+	Pin a tool…	Fest et verktøy…
+	Pin to Home	Fest til Hjem
+	Pin tools to Home	Fest verktøy til Hjem
+	Pin your favorite tools here for quick access.	Fest favorittverktøyene dine her for rask tilgang.
+	Pinned	Festet
+	Pinned Tools	Festede verktøy
+	Search tools…	Søk etter verktøy…
+	Select tools to display on your Home page for quick access.	Velg verktøy som skal vises på hjemmesiden for rask tilgang.
+	Unpin from Home	Løsne fra Hjem
+	Unpin tool	Løsne verktøy
+	Transform image	Transformer bilde
+	Select Tool	Markeringsverktøy
+	Hand Tool	Håndverktøy
+	Marquee Zoom	Områdezoom
+	Edit this PDF	Rediger denne PDF-en
+	Export this PDF	Eksporter denne PDF-en
+	Find text or tools	Finn tekst eller verktøy
+	Crop image	Beskjær bilde
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 203cad58d8..208dd1c61e 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -15,6 +15,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menu
 	File	Plik
 	Edit	Edycja
@@ -2491,6 +2495,26 @@ animation effects	Off	Wyłączone
 	Make properties default	Ustaw właściwości jako domyślne
 	Pages selected	Zaznaczone strony
 	Page properties	Właściwości strony
+	Clear search	Wyczyść wyszukiwanie
+	Pin	Przypnij
+	Pin a tool…	Przypnij narzędzie…
+	Pin to Home	Przypnij do strony głównej
+	Pin tools to Home	Przypnij narzędzia do strony głównej
+	Pin your favorite tools here for quick access.	Przypnij tutaj ulubione narzędzia, aby mieć do nich szybki dostęp.
+	Pinned	Przypięte
+	Pinned Tools	Przypięte narzędzia
+	Search tools…	Szukaj narzędzi…
+	Select tools to display on your Home page for quick access.	Wybierz narzędzia do wyświetlenia na stronie głównej, aby mieć do nich szybki dostęp.
+	Unpin from Home	Odepnij od strony głównej
+	Unpin tool	Odepnij narzędzie
+	Transform image	Przekształć obraz
+	Select Tool	Narzędzie Zaznaczanie
+	Hand Tool	Narzędzie Rączka
+	Marquee Zoom	Powiększ zaznaczony obszar
+	Paste	Wklej
+	Edit this PDF	Edytuj ten plik PDF
+	Export this PDF	Eksportuj ten plik PDF
+	Find text or tools	Znajdź tekst lub narzędzia
 	Create & Edit	Tworzenie i edycja
 	Review & Compare	Recenzja i porównanie
 	Forms & Signatures	Formularze i podpisy
@@ -2658,6 +2682,13 @@ animation effects	Off	Wyłączone
 	field names can't contain a period: {name}	nazwy pól nie mogą zawierać kropki: {name}
 	two cells would both be named {name}	dwie komórki miałyby nazwę {name}
 	a field named {name} already exists	pole o nazwie {name} już istnieje
+	Arrange image	Rozmieść obraz
+	Bring forward	Przesuń do przodu
+	Bring to front	Przesuń na wierzch
+	Crop	Przytnij
+	Remove crop	Usuń przycięcie
+	Send backward	Przesuń do tyłu
+	Send to back	Przesuń pod spód
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Dzisiaj
@@ -2674,3 +2705,11 @@ animation effects	Off	Wyłączone
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opcje tej odpowiedzi
 	Export value	Wartość eksportowa
+	Show Page Edge Shadows	Pokaż cienie krawędzi stron
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Szukaj…
+	Image pasted	Wklejono obraz
+	No image on clipboard to paste	Brak obrazu do wklejenia w schowku
+	Pinned {tool} to Home	Przypięto {tool} do strony głównej
+	Unpinned {tool} from Home	Odpięto {tool} od strony głównej
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 45f827171b..a172a03879 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menu
 	File	Arquivo
 	Rotation:	Rotação:
@@ -2529,6 +2533,25 @@ animation effects	Off	Desativados
 	Make properties default	Tornar propriedades padrão
 	Pages selected	Páginas selecionadas
 	Page properties	Propriedades da página
+	Clear search	Limpar pesquisa
+	Pin	Fixar
+	Pin a tool…	Fixar uma ferramenta…
+	Pin to Home	Fixar no Início
+	Pin tools to Home	Fixar ferramentas no Início
+	Pin your favorite tools here for quick access.	Fixe suas ferramentas favoritas aqui para acesso rápido.
+	Pinned	Fixado
+	Pinned Tools	Ferramentas fixadas
+	Search tools…	Pesquisar ferramentas…
+	Select tools to display on your Home page for quick access.	Selecione ferramentas para exibir na página Início para acesso rápido.
+	Unpin from Home	Desafixar do Início
+	Unpin tool	Desafixar ferramenta
+	Transform image	Transformar imagem
+	Select Tool	Ferramenta Seleção
+	Hand Tool	Ferramenta Mão
+	Marquee Zoom	Zoom por seleção
+	Edit this PDF	Editar este PDF
+	Export this PDF	Exportar este PDF
+	Find text or tools	Localizar texto ou ferramentas
 	Create & Edit	Criar e editar
 	Review & Compare	Revisar e comparar
 	Forms & Signatures	Formulários e assinaturas
@@ -2847,6 +2870,14 @@ theme	Appearance	Aparência
 	a table has 1 to {max} columns	uma tabela tem de 1 a {max} colunas
 	the first row number can be at most {max}	o número da primeira linha pode ser no máximo {max}
 	the area, the spacing and the column widths must be numbers, the spacing 0 or more and each width more than 0	a área, o espaçamento e as larguras das colunas devem ser números, o espaçamento 0 ou mais e cada largura maior que 0
+	Bring forward	Avançar
+	Bring to front	Trazer para a frente
+	Crop image	Cortar imagem
+	Remove crop	Remover corte
+	Send backward	Recuar
+	Send to back	Enviar para trás
+	Arrange image	Organizar imagem
+	Crop	Cortar
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Hoje
@@ -2863,3 +2894,11 @@ theme	Appearance	Aparência
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opções desta resposta
 	Export value	Valor de exportação
+	Show Page Edge Shadows	Mostrar sombras nas bordas das páginas
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Pesquisar…
+	Image pasted	Imagem colada
+	No image on clipboard to paste	Nenhuma imagem na área de transferência para colar
+	Pinned {tool} to Home	{tool} fixado no Início
+	Unpinned {tool} from Home	{tool} desafixado do Início
diff --git a/crates/ui-egui/src/i18n/ro.tsv b/crates/ui-egui/src/i18n/ro.tsv
index 6b23515b8e..0d0fbf16b4 100644
--- a/crates/ui-egui/src/i18n/ro.tsv
+++ b/crates/ui-egui/src/i18n/ro.tsv
@@ -9,6 +9,10 @@
 # the trailing "…" of dialog commands is kept. Commands use the noun form ("Salvare", "Deschidere…"),
 # messages address the user formally ("Alegeți", "dvs.").
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Meniu
 	Edit	Editare
 	Pages	Pagini
@@ -2815,6 +2819,33 @@ theme	Appearance	Aspect
 	field names can't contain a period: {name}	numele câmpurilor nu pot conține punct: {name}
 	two cells would both be named {name}	două celule s-ar numi amândouă {name}
 	a field named {name} already exists	există deja un câmp numit {name}
+	Bring forward	Aduce mai în față
+	Bring to front	Aduce în prim-plan
+	Crop image	Decupare imagine
+	Remove crop	Elimină decuparea
+	Send backward	Trimite mai în spate
+	Send to back	Trimite în fundal
+	Clear search	Golește căutarea
+	Edit this PDF	Editează acest PDF
+	Export this PDF	Exportă acest PDF
+	Find text or tools	Găsește text sau instrumente
+	Hand Tool	Instrumentul Mână
+	Marquee Zoom	Zoom cadru
+	Pin	Fixează
+	Pin a tool…	Fixează un instrument…
+	Pin to Home	Fixează la Pagina de pornire
+	Pin tools to Home	Fixează instrumente la Pagina de pornire
+	Pin your favorite tools here for quick access.	Fixează instrumentele preferate aici pentru acces rapid.
+	Pinned	Fixat
+	Pinned Tools	Instrumente fixate
+	Search tools…	Caută instrumente…
+	Select Tool	Instrumentul Selecție
+	Select tools to display on your Home page for quick access.	Selectează instrumentele de afișat pe Pagina de pornire pentru acces rapid.
+	Transform image	Transformare imagine
+	Unpin from Home	Anulează fixarea la Pagina de pornire
+	Unpin tool	Anulează fixarea instrumentului
+	Arrange image	Aranjează imaginea
+	Crop	Decupare
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Astăzi
@@ -2838,3 +2869,10 @@ theme	Appearance	Aspect
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opțiuni pentru acest răspuns
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Caută…
+	Image pasted	Imagine lipită
+	No image on clipboard to paste	Nicio imagine în clipboard de lipit
+	Pinned {tool} to Home	{tool} fixat pe pagina principală
+	Unpinned {tool} from Home	{tool} desprins de pe pagina principală
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 59c483526a..b45d73ecab 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Меню
 	File	Файл
 	Edit	Редактирование
@@ -2428,6 +2432,26 @@ animation effects	Off	Выкл
 	Make properties default	Сделать свойства стандартными
 	Pages selected	Выделенные страницы
 	Page properties	Свойства страницы
+	Clear search	Очистить поиск
+	Pin	Закрепить
+	Pin a tool…	Закрепить инструмент…
+	Pin to Home	Закрепить на Главной
+	Pin tools to Home	Закрепить инструменты на Главной
+	Pin your favorite tools here for quick access.	Закрепите здесь избранные инструменты для быстрого доступа.
+	Pinned	Закреплено
+	Pinned Tools	Закрепленные инструменты
+	Search tools…	Поиск инструментов…
+	Select tools to display on your Home page for quick access.	Выберите инструменты для отображения на Главной странице для быстрого доступа.
+	Unpin from Home	Открепить от Главной
+	Unpin tool	Открепить инструмент
+	Transform image	Трансформировать изображение
+	Select Tool	Инструмент «Выделение»
+	Hand Tool	Инструмент «Рука»
+	Marquee Zoom	Масштаб выделением
+	Paste	Вставить
+	Edit this PDF	Редактировать этот PDF
+	Export this PDF	Экспортировать этот PDF
+	Find text or tools	Найти текст или инструменты
 	Create & Edit	Создание и редактирование
 	Review & Compare	Рецензирование и сравнение
 	Forms & Signatures	Формы и подписи
@@ -2475,6 +2499,13 @@ animation effects	Off	Выкл
 	field names can't contain a period: {name}	имена полей не могут содержать точку: {name}
 	two cells would both be named {name}	две ячейки получили бы одно имя {name}
 	a field named {name} already exists	поле с именем {name} уже существует
+	Arrange image	Упорядочить изображение
+	Bring forward	Переместить вперед
+	Bring to front	На передний план
+	Crop	Обрезать
+	Remove crop	Убрать обрезку
+	Send backward	Переместить назад
+	Send to back	На задний план
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Сегодня
@@ -2491,3 +2522,11 @@ animation effects	Off	Выкл
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Параметры этого ответа
 	Export value	Значение экспорта
+	Show Page Edge Shadows	Показывать тени по краям страниц
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Поиск…
+	Image pasted	Изображение вставлено
+	No image on clipboard to paste	В буфере обмена нет изображения для вставки
+	Pinned {tool} to Home	{tool} закреплён на главной
+	Unpinned {tool} from Home	{tool} откреплён от главной
diff --git a/crates/ui-egui/src/i18n/sl.tsv b/crates/ui-egui/src/i18n/sl.tsv
index 83cb594158..c95f6d6bd6 100644
--- a/crates/ui-egui/src/i18n/sl.tsv
+++ b/crates/ui-egui/src/i18n/sl.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Meni
 	File	Datoteka
 	Edit	Urejanje
@@ -2520,6 +2524,26 @@ animation effects	Off	Izklopljeni
 	Make properties default	Nastavi lastnosti kot privzete
 	Pages selected	Izbrane strani
 	Page properties	Lastnosti strani
+	Clear search	Počisti iskanje
+	Pin	Pripni
+	Pin a tool…	Pripni orodje…
+	Pin to Home	Pripni na domov
+	Pin tools to Home	Pripni orodja na domov
+	Pin your favorite tools here for quick access.	Tukaj pripnite svoja priljubljena orodja za hiter dostop.
+	Pinned	Pripeto
+	Pinned Tools	Pripeta orodja
+	Search tools…	Išči orodja…
+	Select tools to display on your Home page for quick access.	Izberite orodja za prikaz na domači strani za hiter dostop.
+	Unpin from Home	Odpni z domače strani
+	Unpin tool	Odpni orodje
+	Transform image	Preoblikuj sliko
+	Select Tool	Orodje za izbiro
+	Hand Tool	Orodje z roko
+	Marquee Zoom	Povečava z okvirjem
+	Paste	Prilepi
+	Edit this PDF	Uredi ta PDF
+	Export this PDF	Izvozi ta PDF
+	Find text or tools	Poišči besedilo ali orodja
 	Create & Edit	Ustvarjanje in urejanje
 	Review & Compare	Pregled in primerjava
 	Forms & Signatures	Obrazci in podpisi
@@ -2567,6 +2591,13 @@ animation effects	Off	Izklopljeni
 	field names can't contain a period: {name}	imena polj ne smejo vsebovati pike: {name}
 	two cells would both be named {name}	dve celici bi imeli enako ime {name}
 	a field named {name} already exists	polje z imenom {name} že obstaja
+	Arrange image	Uredi sliko
+	Bring forward	Premakni naprej
+	Bring to front	Postavi v ospredje
+	Crop	Obreži
+	Remove crop	Odstrani obrezovanje
+	Send backward	Premakni nazaj
+	Send to back	Postavi v ozadje
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Danes
@@ -2583,3 +2614,11 @@ animation effects	Off	Izklopljeni
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Možnosti tega odgovora
 	Export value	Izvozna vrednost
+	Show Page Edge Shadows	Prikaži sence robov strani
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Išči…
+	Image pasted	Slika prilepljena
+	No image on clipboard to paste	V odložišču ni slike za lepljenje
+	Pinned {tool} to Home	{tool} pripeto na domačo stran
+	Unpinned {tool} from Home	{tool} odpeto z domače strani
diff --git a/crates/ui-egui/src/i18n/sq.tsv b/crates/ui-egui/src/i18n/sq.tsv
index e5a8f5b037..eb9eed3a0e 100644
--- a/crates/ui-egui/src/i18n/sq.tsv
+++ b/crates/ui-egui/src/i18n/sq.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menyja
 	File	Skedari
 	Edit	Redakto
@@ -2385,7 +2389,7 @@ animation effects	Off	Joaktiv
 	Collapse all pages	Collapse all pages
 	Counting words… {n} pages read	Counting words… {n} pages read
 	Create Link…	Create Link…
-	Crop Image	Crop Image
+	Crop Image	Prit imazhin
 	Current page only	Current page only
 	Cut Image	Cut Image
 	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.	Cuts each page to its printed area, turns it upright and fits it to the sheet without stretching. One label per sheet.
@@ -2463,7 +2467,7 @@ animation effects	Off	Joaktiv
 	Recognize Text…	Recognize Text…
 	Redact Image	Redact Image
 	Redaction mark appearance	Redaction mark appearance
-	Remove Crop	Remove Crop
+	Remove Crop	Hiq prerjen
 	Remove this leaf tag from reading order and mark its direct content as an artifact	Remove this leaf tag from reading order and mark its direct content as an artifact
 	Resolution:	Resolution:
 	Save anyway	Save anyway
@@ -2541,6 +2545,32 @@ animation effects	Off	Joaktiv
 	field names can't contain a period: {name}	emrat e fushave nuk mund të përmbajnë pikë: {name}
 	two cells would both be named {name}	dy qeliza do të kishin të dyja emrin {name}
 	a field named {name} already exists	ekziston tashmë një fushë me emrin {name}
+	Clear search	Pastro kërkimin
+	Edit this PDF	Redakto këtë PDF
+	Export this PDF	Eksporto këtë PDF
+	Find text or tools	Gjej tekst ose mjete
+	Hand Tool	Mjeti Dorë
+	Marquee Zoom	Zmadhim me kornizë
+	Paste	Ngjit
+	Pin	Fikso
+	Pin a tool…	Fikso një mjet…
+	Pin to Home	Fikso në Ballinë
+	Pin tools to Home	Fikso mjetet në Ballinë
+	Pin your favorite tools here for quick access.	Fiksoni mjetet tuaja të preferuara këtu për qasje të shpejtë.
+	Pinned	I fiksuar
+	Pinned Tools	Mjete të fiksuara
+	Search tools…	Kërko mjete…
+	Select Tool	Mjeti Përzgjedhje
+	Select tools to display on your Home page for quick access.	Zgjidhni mjetet për t'u shfaqur në faqen tuaj të Ballinës për qasje të shpejtë.
+	Unpin from Home	Hiq fiksimin nga Ballina
+	Unpin tool	Hiq fiksimin e mjetit
+	Arrange image	Rregullo figurën
+	Bring forward	Kalo përpara
+	Bring to front	Sille përpara
+	Crop	Prit
+	Remove crop	Hiq prerjen
+	Send backward	Kalo prapa
+	Send to back	Dërgo mbrapa
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Sot
@@ -2564,3 +2594,10 @@ animation effects	Off	Joaktiv
 
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Opsionet për këtë përgjigje
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Kërko…
+	Image pasted	Imazhi u ngjit
+	No image on clipboard to paste	Nuk ka imazh në kujtesën e përkohshme për të ngjitur
+	Pinned {tool} to Home	{tool} u fiksua te Kreu
+	Unpinned {tool} from Home	{tool} u hoq nga fiksimi te Kreu
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 0bb56f4793..9b81ffb8b9 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -12,6 +12,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) are not translated;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	మెనూ
 	File	ఫైల్
 	Edit	సవరణ
@@ -2424,6 +2428,26 @@ animation effects	Off	ఆఫ్
 	Make properties default	లక్షణాలను డిఫాల్ట్‌గా చేయి
 	Pages selected	ఎంచుకున్న పేజీలు
 	Page properties	పేజీ లక్షణాలు
+	Clear search	శోధనను తీసివేయి
+	Pin	పిన్ చేయి
+	Pin a tool…	ఒక సాధనాన్ని పిన్ చేయి…
+	Pin to Home	హోమ్‌కు పిన్ చేయి
+	Pin tools to Home	సాధనాలను హోమ్‌కు పిన్ చేయి
+	Pin your favorite tools here for quick access.	త్వరిత ప్రాప్యత కోసం మీకు ఇష్టమైన సాధనాలను ఇక్కడ పిన్ చేయండి.
+	Pinned	పిన్ చేయబడింది
+	Pinned Tools	పిన్ చేసిన సాధనాలు
+	Search tools…	సాధనాలను శోధించండి…
+	Select tools to display on your Home page for quick access.	త్వరిత ప్రాప్యత కోసం మీ హోమ్ పేజీలో ప్రదర్శించడానికి సాధనాలను ఎంచుకోండి.
+	Unpin from Home	హోమ్ నుండి అన్‌పిన్ చేయి
+	Unpin tool	సాధనాన్ని అన్‌పిన్ చేయి
+	Transform image	చిత్రాన్ని రూపాంతరం చేయండి
+	Select Tool	ఎంపిక సాధనం
+	Hand Tool	హ్యాండ్ సాధనం
+	Marquee Zoom	ఎంచుకున్న ప్రాంతానికి జూమ్
+	Paste	అతికించు
+	Edit this PDF	ఈ PDFను సవరించు
+	Export this PDF	ఈ PDFను ఎగుమти చేయి
+	Find text or tools	వచనం లేదా సాధనాలను కనుగొనండి
 	Create & Edit	సృష్టించు & సవరించు
 	Review & Compare	సమీక్షించు & పోల్చు
 	Forms & Signatures	ఫారమ్‌లు & సంతకాలు
@@ -2471,6 +2495,13 @@ animation effects	Off	ఆఫ్
 	field names can't contain a period: {name}	ఫీల్డ్ పేర్లలో చుక్క ఉండకూడదు: {name}
 	two cells would both be named {name}	రెండు గడులకూ {name} అనే పేరు వస్తుంది
 	a field named {name} already exists	{name} అనే ఫీల్డ్ ఇప్పటికే ఉంది
+	Arrange image	చిత్రాన్ని అమర్చు
+	Bring forward	ముందుకు తీసుకురా
+	Bring to front	అందరికంటే ముందుకు తీసుకురా
+	Crop	కత్తిరించు
+	Remove crop	కత్తిరింపును తీసివేయి
+	Send backward	వెనుకకు పంపు
+	Send to back	అందరికంటే వెనుకకు పంపు
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	ఈరోజు
@@ -2487,3 +2518,11 @@ animation effects	Off	ఆఫ్
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	ఈ ప్రత్యుత్తరం ఎంపికలు
 	Export value	ఎగుమతి విలువ
+	Show Page Edge Shadows	పేజీ అంచుల నీడలను చూపించు
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	శోధించండి…
+	Image pasted	చిత్రం అతికించబడింది
+	No image on clipboard to paste	అతికించడానికి క్లిప్‌బోర్డ్‌లో చిత్రం లేదు
+	Pinned {tool} to Home	{tool} హోమ్‌కు పిన్ చేయబడింది
+	Unpinned {tool} from Home	{tool} హోమ్ నుండి అన్‌పిన్ చేయబడింది
diff --git a/crates/ui-egui/src/i18n/tests.rs b/crates/ui-egui/src/i18n/tests.rs
index 41a4578cf0..22110de938 100644
--- a/crates/ui-egui/src/i18n/tests.rs
+++ b/crates/ui-egui/src/i18n/tests.rs
@@ -1217,3 +1217,12 @@ fn date_languages_are_the_interface_languages() {
     let dates: Vec<(&str, &str)> = pdfcraft_engine::dates::DATE_LANGUAGES.iter().map(|l| (l.code, l.name)).collect();
     assert_eq!(dates, interface);
 }
+
+#[test]
+fn image_paste_and_home_notifications_are_translated() {
+    for language in Lang::all().filter(|l| *l != Lang::EN) {
+        for source in ["Search…", "Image pasted", "No image on clipboard to paste", "Pinned {tool} to Home", "Unpinned {tool} from Home"] {
+            assert!(language.catalog().plain(source).is_some(), "{}: {source}", language.code());
+        }
+    }
+}
diff --git a/crates/ui-egui/src/i18n/th.tsv b/crates/ui-egui/src/i18n/th.tsv
index 0c2b58a812..f7f8a65c5c 100644
--- a/crates/ui-egui/src/i18n/th.tsv
+++ b/crates/ui-egui/src/i18n/th.tsv
@@ -7,6 +7,10 @@
 # names stay in Latin letters; the trailing ellipsis of dialog commands is kept. Thai has one
 # plural form.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	เมนู
 	File	ไฟล์
 	Edit	แก้ไข
@@ -2711,6 +2715,13 @@ key	Space	Space
 	Collapse all tools	ยุบเครื่องมือทั้งหมด
 	The password must have at least 8 characters.	รหัสผ่านต้องมีอย่างน้อย 8 ตัวอักษร
 theme	Appearance	ลักษณะที่ปรากฏ
+	Arrange image	จัดเรียงรูปภาพ
+	Bring forward	นำไปข้างหน้า
+	Bring to front	นำไปไว้ข้างหน้าสุด
+	Crop	ครอบตัด
+	Remove crop	เอาการครอบตัดออก
+	Send backward	ส่งไปข้างหลัง
+	Send to back	ส่งไปไว้ข้างหลังสุด
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	วันนี้
@@ -2736,3 +2747,32 @@ theme	Appearance	ลักษณะที่ปรากฏ
 	Unchecked reads	Unchecked reads
 	{field} reads fields named as it runs	{field} reads fields named as it runs
 	Some names are built as it runs	Some names are built as it runs
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	ค้นหา…
+	Image pasted	วางรูปภาพแล้ว
+	No image on clipboard to paste	ไม่มีรูปภาพในคลิปบอร์ดให้วาง
+	Pinned {tool} to Home	ปักหมุด {tool} ไว้ที่หน้าแรกแล้ว
+	Unpinned {tool} from Home	เลิกปักหมุด {tool} จากหน้าแรกแล้ว
+
+# Home tools (AI-assisted; not separately native-reviewed)
+	Clear search	ล้างการค้นหา
+	Pin	ปักหมุด
+	Pin a tool…	ปักหมุดเครื่องมือ…
+	Pin to Home	ปักหมุดไว้ที่หน้าแรก
+	Pin tools to Home	ปักหมุดเครื่องมือไว้ที่หน้าแรก
+	Pin your favorite tools here for quick access.	ปักหมุดเครื่องมือโปรดที่นี่เพื่อเข้าถึงอย่างรวดเร็ว
+	Pinned	ปักหมุดแล้ว
+	Pinned Tools	เครื่องมือที่ปักหมุด
+	Search tools…	ค้นหาเครื่องมือ…
+	Select tools to display on your Home page for quick access.	เลือกเครื่องมือที่จะแสดงบนหน้าแรกเพื่อเข้าถึงอย่างรวดเร็ว
+	Unpin from Home	เลิกปักหมุดจากหน้าแรก
+	Unpin tool	เลิกปักหมุดเครื่องมือ
+	Transform image	แปลงรูปภาพ
+	Select Tool	เครื่องมือเลือก
+	Hand Tool	เครื่องมือมือ
+	Marquee Zoom	ซูมพื้นที่ที่เลือก
+	Edit this PDF	แก้ไข PDF นี้
+	Export this PDF	ส่งออก PDF นี้
+	Find text or tools	ค้นหาข้อความหรือเครื่องมือ
+	Crop image	ครอบตัดรูปภาพ
diff --git a/crates/ui-egui/src/i18n/tr.tsv b/crates/ui-egui/src/i18n/tr.tsv
index b52688606b..6921a6c33e 100644
--- a/crates/ui-egui/src/i18n/tr.tsv
+++ b/crates/ui-egui/src/i18n/tr.tsv
@@ -4,6 +4,10 @@
 #
 # Clean-room: clean-room translations of PdfCraft's English UI labels, no proprietary localisation resources.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Menü
 	File	Dosya
 	Edit	Düzen
@@ -2511,6 +2515,26 @@ animation effects	Off	Kapalı
 	Make properties default	Özellikleri varsayılan yap
 	Pages selected	Seçilen sayfalar
 	Page properties	Sayfa özellikleri
+	Clear search	Aramayı temizle
+	Pin	Sabitle
+	Pin a tool…	Bir aracı sabitle…
+	Pin to Home	Giriş'e sabitle
+	Pin tools to Home	Araçları Giriş'e sabitle
+	Pin your favorite tools here for quick access.	Hızlı erişim için favori araçlarınızı buraya sabitleyin.
+	Pinned	Sabitlendi
+	Pinned Tools	Sabitlenen Araçlar
+	Search tools…	Araçları ara…
+	Select tools to display on your Home page for quick access.	Hızlı erişim için Giriş sayfanızda görüntülenecek araçları seçin.
+	Unpin from Home	Giriş'ten sabitlemeyi kaldır
+	Unpin tool	Aracın sabitlemesini kaldır
+	Transform image	Görüntüyü dönüştür
+	Select Tool	Seçim Aracı
+	Hand Tool	El Aracı
+	Marquee Zoom	Seçim yakınlaştırma
+	Paste	Yapıştır
+	Edit this PDF	Bu PDF'i düzenle
+	Export this PDF	Bu PDF'i dışa aktar
+	Find text or tools	Metin veya araç bul
 	Create & Edit	Oluştur ve Düzenle
 	Review & Compare	İncele ve Karşılaştır
 	Forms & Signatures	Formlar ve İmzalar
@@ -2558,6 +2582,13 @@ animation effects	Off	Kapalı
 	field names can't contain a period: {name}	alan adları nokta içeremez: {name}
 	two cells would both be named {name}	iki hücrenin de adı {name} olurdu
 	a field named {name} already exists	{name} adlı bir alan zaten var
+	Arrange image	Resmi düzenle
+	Bring forward	Öne getir
+	Bring to front	En öne getir
+	Crop	Kırp
+	Remove crop	Kırpmayı kaldır
+	Send backward	Arkaya gönder
+	Send to back	En arkaya gönder
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Bugün
@@ -2574,3 +2605,11 @@ animation effects	Off	Kapalı
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Bu yanıtın seçenekleri
 	Export value	Dışa aktarma değeri
+	Show Page Edge Shadows	Sayfa kenarı gölgelerini göster
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Ara…
+	Image pasted	Görüntü yapıştırıldı
+	No image on clipboard to paste	Panoda yapıştırılacak görüntü yok
+	Pinned {tool} to Home	{tool} Ana Sayfaya sabitlendi
+	Unpinned {tool} from Home	{tool} Ana Sayfadan kaldırıldı
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index dc65faf7a2..a824769600 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -18,6 +18,10 @@
 # Integer plurals (CLDR uk): one (1, 21) | few (2–4, 22–24) | many (0, 5–19); 11–14 take many.
 # Commands use infinitives. Fixed-count templates use count-neutral wording.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Меню
 	File	Файл
 	Edit	Редагування
@@ -2537,6 +2541,26 @@ animation effects	Off	Вимкнено
 	Make properties default	Зробити властивості типовими
 	Pages selected	Вибрані сторінки
 	Page properties	Властивості сторінки
+	Clear search	Очистити пошук
+	Pin	Закріпити
+	Pin a tool…	Закріпити інструмент…
+	Pin to Home	Закріпити на Головній
+	Pin tools to Home	Закріпити інструменти на Головній
+	Pin your favorite tools here for quick access.	Закріпіть улюблені інструменти тут для швидкого доступу.
+	Pinned	Закріплено
+	Pinned Tools	Закріплені інструменти
+	Search tools…	Шукати інструменти…
+	Select tools to display on your Home page for quick access.	Виберіть інструменти для відображення на Головній для швидкого доступу.
+	Unpin from Home	Відкріпити від Головної
+	Unpin tool	Відкріпити інструмент
+	Transform image	Трансформувати зображення
+	Select Tool	Інструмент виділення
+	Hand Tool	Інструмент «Рука»
+	Marquee Zoom	Масштабувати виділену область
+	Paste	Вставити
+	Edit this PDF	Редактировать цей PDF
+	Export this PDF	Експортувати цей PDF
+	Find text or tools	Знайти текст або інструменти
 	Create & Edit	Створення й редагування
 	Review & Compare	Рецензування й порівняння
 	Forms & Signatures	Форми й підписи
@@ -2584,6 +2608,13 @@ animation effects	Off	Вимкнено
 	field names can't contain a period: {name}	імена полів не можуть містити крапку: {name}
 	two cells would both be named {name}	дві клітинки мали б однакове ім'я {name}
 	a field named {name} already exists	поле з іменем {name} уже існує
+	Arrange image	Упорядкувати зображення
+	Bring forward	Перемістити вперед
+	Bring to front	На передній план
+	Crop	Обрізати
+	Remove crop	Прибрати обрізання
+	Send backward	Перемістити назад
+	Send to back	На задній план
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Сьогодні
@@ -2600,3 +2631,11 @@ animation effects	Off	Вимкнено
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Параметри цієї відповіді
 	Export value	Значення експорту
+	Show Page Edge Shadows	Показувати тіні на краях сторінок
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Пошук…
+	Image pasted	Зображення вставлено
+	No image on clipboard to paste	У буфері обміну немає зображення для вставлення
+	Pinned {tool} to Home	{tool} закріплено на головній
+	Unpinned {tool} from Home	{tool} відкріплено від головної
diff --git a/crates/ui-egui/src/i18n/vi.tsv b/crates/ui-egui/src/i18n/vi.tsv
index e9a9a73f2b..e79a8aacc4 100644
--- a/crates/ui-egui/src/i18n/vi.tsv
+++ b/crates/ui-egui/src/i18n/vi.tsv
@@ -7,6 +7,11 @@
 # Plural rule: `plural_none` — every @plural row lists exactly one form.
 # Context-sensitive wording and intentional unchanged strings are regression-tested in i18n/mod.rs.
 #
+
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	Trình đơn
 	Edit	Chỉnh sửa
 	Pages	Trang
@@ -2702,6 +2707,12 @@ key	Space	Space
 	Redact Image	Xóa nội dung nhạy cảm của hình ảnh
 	Create Link…	Tạo liên kết…
 	Recognize Text…	Nhận dạng văn bản…
+	Bring forward	Chuyển lên trước
+	Bring to front	Đưa lên trước cùng
+	Crop image	Cắt hình ảnh
+	Remove crop	Xóa cắt
+	Send backward	Chuyển về sau
+	Send to back	Đưa về sau cùng
 	Create & Edit	Tạo và chỉnh sửa
 	Review & Compare	Xem xét và so sánh
 	Forms & Signatures	Biểu mẫu và chữ ký
@@ -2789,6 +2800,25 @@ key	Space	Space
 # Historical snapshot notice bar (View signed version / View revision).
 	You are viewing the signed version of “{from}” (revision {rev}). It is a snapshot: changes here won't affect the original.	Bạn đang xem phiên bản đã ký của “{from}” (bản sửa đổi {rev}). Đây là ảnh nhanh: các thay đổi ở đây không được áp dụng đến bản gốc.
 	You are viewing revision {rev} of “{from}”. It is a snapshot: changes here won't affect the original.	Bạn đang xem bản sửa đổi {rev} của “{from}”. Đây là ảnh nhanh: các thay đổi ở đây không được áp dụng đến bản gốc.
+	Clear search	Xóa tìm kiếm
+	Pin	Ghim
+	Pin a tool…	Ghim công cụ…
+	Pin to Home	Ghim vào Trang chủ
+	Pin tools to Home	Ghim công cụ vào Trang chủ
+	Pin your favorite tools here for quick access.	Ghim các công cụ yêu thích của bạn vào đây để truy cập nhanh.
+	Pinned	Đã ghim
+	Pinned Tools	Công cụ đã ghim
+	Search tools…	Tìm kiếm công cụ…
+	Select tools to display on your Home page for quick access.	Chọn các công cụ hiển thị trên Trang chủ để truy cập nhanh.
+	Unpin from Home	Bỏ ghim khỏi Trang chủ
+	Unpin tool	Bỏ ghim công cụ
+	Transform image	Chuyển đổi hình ảnh
+	Select Tool	Công cụ chọn
+	Hand Tool	Công cụ bàn tay
+	Marquee Zoom	Thu phóng theo vùng chọn
+	Edit this PDF	Chỉnh sửa PDF này
+	Export this PDF	Xuất PDF này
+	Find text or tools	Tìm văn bản hoặc công cụ
 	Attach a file…	Đính kèm tệp…
 	Delete attachment	Xóa tệp đính kèm
 	Attaching files is not available on the web yet	Chưa thể đính kèm tệp trên web
@@ -2826,6 +2856,8 @@ key	Space	Space
 	a table has 1 to {max} columns	một bảng có từ 1 đến {max} cột
 	the first row number can be at most {max}	số hàng đầu tiên tối đa là {max}
 	the area, the spacing and the column widths must be numbers, the spacing 0 or more and each width more than 0	vùng, khoảng cách và độ rộng cột phải là số, khoảng cách từ 0 trở lên và mỗi độ rộng lớn hơn 0
+	Arrange image	Sắp xếp hình ảnh
+	Crop	Xén
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	Hôm nay
@@ -2845,3 +2877,11 @@ key	Space	Space
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	Tùy chọn cho câu trả lời này
 	Export value	Giá trị xuất
+	Show Page Edge Shadows	Hiển thị bóng viền trang
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	Tìm kiếm…
+	Image pasted	Đã dán hình ảnh
+	No image on clipboard to paste	Không có hình ảnh trong bảng nhớ tạm để dán
+	Pinned {tool} to Home	Đã ghim {tool} vào Trang chủ
+	Unpinned {tool} from Home	Đã bỏ ghim {tool} khỏi Trang chủ
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 5f08576b8e..96e9c3bb75 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 # About, contributor/model credits, and multiline interface guidance.
 	About	关于
 	Contributors	贡献者
@@ -2479,6 +2483,26 @@ animation effects	Off	关
 	Make properties default	将属性设为默认
 	Pages selected	选定的页面
 	Page properties	页面属性
+	Clear search	清除搜索
+	Pin	固定
+	Pin a tool…	固定工具…
+	Pin to Home	固定到主页
+	Pin tools to Home	将工具固定到主页
+	Pin your favorite tools here for quick access.	将常用的工具固定在此处以便快速访问。
+	Pinned	已固定
+	Pinned Tools	已固定的工具
+	Search tools…	搜索工具…
+	Select tools to display on your Home page for quick access.	选择要在主页上显示的工具以便快速访问。
+	Unpin from Home	从主页取消固定
+	Unpin tool	取消固定工具
+	Transform image	变换图像
+	Select Tool	选择工具
+	Hand Tool	手形工具
+	Marquee Zoom	选框缩放
+	Paste	粘贴
+	Edit this PDF	编辑此 PDF
+	Export this PDF	导出此 PDF
+	Find text or tools	查找文本或工具
 	Create & Edit	创建和编辑
 	Review & Compare	审阅和比较
 	Forms & Signatures	表单和签名
@@ -2526,6 +2550,13 @@ animation effects	Off	关
 	field names can't contain a period: {name}	字段名称不能包含句点：{name}
 	two cells would both be named {name}	两个单元格的名称都会是 {name}
 	a field named {name} already exists	已存在名为 {name} 的字段
+	Arrange image	排列图像
+	Bring forward	上移一层
+	Bring to front	置于顶层
+	Crop	裁剪
+	Remove crop	移除裁剪
+	Send backward	下移一层
+	Send to back	置于底层
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	今天
@@ -2542,3 +2573,11 @@ animation effects	Off	关
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	此回复的选项
 	Export value	导出值
+	Show Page Edge Shadows	显示页面边缘阴影
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	搜索…
+	Image pasted	已粘贴图像
+	No image on clipboard to paste	剪贴板中没有可粘贴的图像
+	Pinned {tool} to Home	已将 {tool} 固定到主页
+	Unpinned {tool} from Home	已从主页取消固定 {tool}
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 2570f12f1c..a1b933b830 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -8,6 +8,10 @@
 # Product and technology names (PdfCraft, PDF, Acrobat JavaScript ...) stay in Latin letters;
 # the trailing "…" of dialog commands is kept.
 
+# Untranslated: English text until a translator fills these in.
+	Lowering this forgets the oldest files. At 0 there is no list.	Lowering this forgets the oldest files. At 0 there is no list.
+	Recent files to keep	Recent files to keep
+
 	Menu	選單
 	File	檔案
 	Edit	編輯
@@ -2465,6 +2469,26 @@ animation effects	Off	關
 	Make properties default	將內容設為預設
 	Pages selected	選取的頁面
 	Page properties	頁面屬性
+	Clear search	清除搜尋
+	Pin	釘選
+	Pin a tool…	釘選工具…
+	Pin to Home	釘選到首頁
+	Pin tools to Home	將工具釘選到首頁
+	Pin your favorite tools here for quick access.	將常用的工具釘選在此處以便快速存取。
+	Pinned	已釘選
+	Pinned Tools	已釘選的工具
+	Search tools…	搜尋工具…
+	Select tools to display on your Home page for quick access.	選取要在首頁上顯示的工具以便快速存取。
+	Unpin from Home	從首頁取消釘選
+	Unpin tool	取消釘選工具
+	Transform image	變換影像
+	Select Tool	選取工具
+	Hand Tool	手形工具
+	Marquee Zoom	選取範圍縮放
+	Paste	貼上
+	Edit this PDF	編輯此 PDF
+	Export this PDF	匯出此 PDF
+	Find text or tools	尋找文字或工具
 	Create & Edit	建立與編輯
 	Review & Compare	審閱與比較
 	Forms & Signatures	表單與簽名
@@ -2512,6 +2536,13 @@ animation effects	Off	關
 	field names can't contain a period: {name}	欄位名稱不能包含句點：{name}
 	two cells would both be named {name}	兩個儲存格的名稱都會是 {name}
 	a field named {name} already exists	已有名為 {name} 的欄位
+	Arrange image	排列影像
+	Bring forward	上移一層
+	Bring to front	移到最上層
+	Crop	裁切
+	Remove crop	移除裁切
+	Send backward	下移一層
+	Send to back	移到最下層
 
 # Date picker: Today button (#4274) (AI-assisted, not separately native-reviewed)
 	Today	今天
@@ -2528,3 +2559,11 @@ animation effects	Off	關
 # Comments panel: each reply's own "…" menu (AI-assisted, not separately native-reviewed)
 	Options for this reply	此回覆的選項
 	Export value	匯出值
+	Show Page Edge Shadows	顯示頁面邊緣陰影
+
+# Image paste and Home notifications (AI-assisted; not separately native-reviewed)
+	Search…	搜尋…
+	Image pasted	已貼上影像
+	No image on clipboard to paste	剪貼簿中沒有可貼上的影像
+	Pinned {tool} to Home	已將 {tool} 釘選至首頁
+	Unpinned {tool} from Home	已從首頁取消釘選 {tool}
diff --git a/crates/ui-egui/src/image_engine.rs b/crates/ui-egui/src/image_engine.rs
new file mode 100644
index 0000000000..518bea0223
--- /dev/null
+++ b/crates/ui-egui/src/image_engine.rs
@@ -0,0 +1,578 @@
+//! Image manipulation engine for non-destructive crop, anchor-based resize, and movement.
+//!
+//! Contributor-original clean-room design with zero-panic safety and lockstep pixel-scale invariance.
+
+use egui::{Color32, Pos2, Rect, Stroke, Vec2, pos2};
+
+use crate::edit_text_ui::ImageHandle;
+
+// ============================================================================
+// 1. MATHEMATICAL CORE: ANCHOR-BASED RESIZE & CROP
+// ============================================================================
+
+/// Minimum allowed dimensions in pixels to prevent panics, zero divisions, or inverted rects.
+pub const MIN_RECT_SIZE: f32 = 10.0;
+
+/// **Anchor-Based Resize System**
+///
+/// Recalculates the screen bounding box by locking the diagonally opposite point/edge as
+/// a fixed anchor.
+///
+/// Math breakdown:
+/// - Corner handles: The diagonally opposite corner is fixed in both X and Y.
+///   Width and height are calculated relative to that anchor, clamped to >= `MIN_RECT_SIZE`,
+///   and the new bounding box is constructed from `anchor` and the clamped dragged coordinate.
+/// - Mid-edge handles: The opposite edge coordinate is fixed in 1D. The perpendicular axis is
+///   completely unaffected.
+pub fn apply_resize(image_rect: Rect, handle: ImageHandle, delta: Vec2) -> Rect {
+    if !image_rect.is_finite() || !delta.x.is_finite() || !delta.y.is_finite() {
+        return image_rect;
+    }
+    let mut min = image_rect.min;
+    let mut max = image_rect.max;
+
+    match handle {
+        // Dragging TopLeft: Fixed Anchor = BottomRight (max.x, max.y)
+        ImageHandle::TopLeft => {
+            let anchor = max;
+            let target = min + delta;
+            let new_w = (anchor.x - target.x).max(MIN_RECT_SIZE);
+            let new_h = (anchor.y - target.y).max(MIN_RECT_SIZE);
+            min.x = anchor.x - new_w;
+            min.y = anchor.y - new_h;
+        }
+
+        // Dragging TopCenter: Fixed Anchor = Bottom edge (max.y)
+        ImageHandle::TopCenter => {
+            let anchor_y = max.y;
+            let target_y = min.y + delta.y;
+            let new_h = (anchor_y - target_y).max(MIN_RECT_SIZE);
+            min.y = anchor_y - new_h;
+        }
+
+        // Dragging TopRight: Fixed Anchor = BottomLeft (min.x, max.y)
+        ImageHandle::TopRight => {
+            let anchor_x = min.x;
+            let anchor_y = max.y;
+            let target_x = max.x + delta.x;
+            let target_y = min.y + delta.y;
+            let new_w = (target_x - anchor_x).max(MIN_RECT_SIZE);
+            let new_h = (anchor_y - target_y).max(MIN_RECT_SIZE);
+            max.x = anchor_x + new_w;
+            min.y = anchor_y - new_h;
+        }
+
+        // Dragging RightCenter: Fixed Anchor = Left edge (min.x)
+        ImageHandle::RightCenter => {
+            let anchor_x = min.x;
+            let target_x = max.x + delta.x;
+            let new_w = (target_x - anchor_x).max(MIN_RECT_SIZE);
+            max.x = anchor_x + new_w;
+        }
+
+        // Dragging BottomRight: Fixed Anchor = TopLeft (min.x, min.y)
+        ImageHandle::BottomRight => {
+            let anchor = min;
+            let target = max + delta;
+            let new_w = (target.x - anchor.x).max(MIN_RECT_SIZE);
+            let new_h = (target.y - anchor.y).max(MIN_RECT_SIZE);
+            max.x = anchor.x + new_w;
+            max.y = anchor.y + new_h;
+        }
+
+        // Dragging BottomCenter: Fixed Anchor = Top edge (min.y)
+        ImageHandle::BottomCenter => {
+            let anchor_y = min.y;
+            let target_y = max.y + delta.y;
+            let new_h = (target_y - anchor_y).max(MIN_RECT_SIZE);
+            max.y = anchor_y + new_h;
+        }
+
+        // Dragging BottomLeft: Fixed Anchor = TopRight (max.x, min.y)
+        ImageHandle::BottomLeft => {
+            let anchor_x = max.x;
+            let anchor_y = min.y;
+            let target_x = min.x + delta.x;
+            let target_y = max.y + delta.y;
+            let new_w = (anchor_x - target_x).max(MIN_RECT_SIZE);
+            let new_h = (target_y - anchor_y).max(MIN_RECT_SIZE);
+            min.x = anchor_x - new_w;
+            max.y = anchor_y + new_h;
+        }
+
+        // Dragging LeftCenter: Fixed Anchor = Right edge (max.x)
+        ImageHandle::LeftCenter => {
+            let anchor_x = max.x;
+            let target_x = min.x + delta.x;
+            let new_w = (anchor_x - target_x).max(MIN_RECT_SIZE);
+            min.x = anchor_x - new_w;
+        }
+    }
+
+    Rect::from_min_max(min, max)
+}
+
+/// **Anchor-Based Proportional Resize System**
+///
+/// Recalculates the screen bounding box by locking the diagonally opposite point as
+/// a fixed anchor while preserving the aspect ratio.
+///
+/// For corner handles, uses the axis with the larger relative change to scale both
+/// width and height uniformly from the locked anchor point, clamped to `>= MIN_RECT_SIZE`.
+/// For mid-edge handles, delegates to `apply_resize`.
+pub fn apply_resize_proportional(image_rect: Rect, handle: ImageHandle, delta: Vec2) -> Rect {
+    if !image_rect.is_finite() || !delta.x.is_finite() || !delta.y.is_finite() {
+        return image_rect;
+    }
+    let w0 = image_rect.width().max(1.0);
+    let h0 = image_rect.height().max(1.0);
+
+    match handle {
+        ImageHandle::TopLeft => {
+            let horizontal = -delta.x / w0;
+            let vertical = -delta.y / h0;
+            let d = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
+            let k = (1.0 + d).max(MIN_RECT_SIZE / w0).max(MIN_RECT_SIZE / h0);
+            let (w, h) = (w0 * k, h0 * k);
+            Rect::from_min_max(Pos2::new(image_rect.max.x - w, image_rect.max.y - h), image_rect.max)
+        }
+        ImageHandle::TopRight => {
+            let horizontal = delta.x / w0;
+            let vertical = -delta.y / h0;
+            let d = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
+            let k = (1.0 + d).max(MIN_RECT_SIZE / w0).max(MIN_RECT_SIZE / h0);
+            let (w, h) = (w0 * k, h0 * k);
+            Rect::from_min_max(Pos2::new(image_rect.min.x, image_rect.max.y - h), Pos2::new(image_rect.min.x + w, image_rect.max.y))
+        }
+        ImageHandle::BottomLeft => {
+            let horizontal = -delta.x / w0;
+            let vertical = delta.y / h0;
+            let d = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
+            let k = (1.0 + d).max(MIN_RECT_SIZE / w0).max(MIN_RECT_SIZE / h0);
+            let (w, h) = (w0 * k, h0 * k);
+            Rect::from_min_max(Pos2::new(image_rect.max.x - w, image_rect.min.y), Pos2::new(image_rect.max.x, image_rect.min.y + h))
+        }
+        ImageHandle::BottomRight => {
+            let horizontal = delta.x / w0;
+            let vertical = delta.y / h0;
+            let d = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
+            let k = (1.0 + d).max(MIN_RECT_SIZE / w0).max(MIN_RECT_SIZE / h0);
+            let (w, h) = (w0 * k, h0 * k);
+            Rect::from_min_max(image_rect.min, Pos2::new(image_rect.min.x + w, image_rect.min.y + h))
+        }
+        mid => apply_resize(image_rect, mid, delta),
+    }
+}
+
+/// Trim a screen rectangle and its UVs together, keeping the opposite edge fixed.
+/// The pixel scale stays unchanged, and each edge stops at the texture boundary.
+pub fn apply_crop(image_rect: Rect, uv_rect: Rect, handle: ImageHandle, delta: Vec2) -> (Rect, Rect) {
+    if !delta.is_finite() || !image_rect.is_finite() || !uv_rect.is_finite() || !image_rect.is_positive() || !uv_rect.is_positive() {
+        return (image_rect, uv_rect);
+    }
+    let scale = image_rect.size() / uv_rect.size();
+    if !scale.is_finite() || scale.x <= 0.0 || scale.y <= 0.0 {
+        return (image_rect, uv_rect);
+    }
+    let minimum = (egui::vec2(MIN_RECT_SIZE, MIN_RECT_SIZE) / scale).min(uv_rect.size() * 0.95);
+    let mut uv = uv_rect;
+    if matches!(handle, ImageHandle::TopLeft | ImageHandle::LeftCenter | ImageHandle::BottomLeft) {
+        uv.min.x = (uv.min.x + delta.x / scale.x).clamp(0.0, (uv.max.x - minimum.x).max(0.0));
+    } else if matches!(handle, ImageHandle::TopRight | ImageHandle::RightCenter | ImageHandle::BottomRight) {
+        uv.max.x = (uv.max.x + delta.x / scale.x).clamp((uv.min.x + minimum.x).min(1.0), 1.0);
+    }
+    if matches!(handle, ImageHandle::TopLeft | ImageHandle::TopCenter | ImageHandle::TopRight) {
+        uv.min.y = (uv.min.y + delta.y / scale.y).clamp(0.0, (uv.max.y - minimum.y).max(0.0));
+    } else if matches!(handle, ImageHandle::BottomLeft | ImageHandle::BottomCenter | ImageHandle::BottomRight) {
+        uv.max.y = (uv.max.y + delta.y / scale.y).clamp((uv.min.y + minimum.y).min(1.0), 1.0);
+    }
+    // Reconstruct from the fixed opposite edge, rather than adding a nearly full-width
+    // shift to the moved edge. Calculate in f64 so each screen coordinate rounds only
+    // once to f32; small crops far from the origin otherwise lose multiple ulps.
+    let span = |min: f32, max: f32| f64::from(max) - f64::from(min);
+    let width = span(image_rect.min.x, image_rect.max.x) * span(uv.min.x, uv.max.x) / span(uv_rect.min.x, uv_rect.max.x);
+    let height = span(image_rect.min.y, image_rect.max.y) * span(uv.min.y, uv.max.y) / span(uv_rect.min.y, uv_rect.max.y);
+    let mut screen = image_rect;
+    if uv.min.x != uv_rect.min.x {
+        screen.min.x = (f64::from(image_rect.max.x) - width) as f32;
+    } else if uv.max.x != uv_rect.max.x {
+        screen.max.x = (f64::from(image_rect.min.x) + width) as f32;
+    }
+    if uv.min.y != uv_rect.min.y {
+        screen.min.y = (f64::from(image_rect.max.y) - height) as f32;
+    } else if uv.max.y != uv_rect.max.y {
+        screen.max.y = (f64::from(image_rect.min.y) + height) as f32;
+    }
+    if !screen.is_finite() || !screen.is_positive() {
+        return (image_rect, uv_rect);
+    }
+    (screen, uv)
+}
+
+// ============================================================================
+// 2. VISUAL RENDERING HELPERS
+// ============================================================================
+
+/// Vibrant amber/orange color for Crop Mode.
+pub const CROP_ACCENT: Color32 = Color32::from_rgb(230, 126, 34);
+
+/// Renders the Rule-of-Thirds composition grid inside the given crop rectangle.
+pub fn draw_rule_of_thirds(painter: &egui::Painter, rect: Rect, stroke: Stroke) {
+    let w = rect.width();
+    let h = rect.height();
+    if w <= 0.0 || h <= 0.0 {
+        return;
+    }
+
+    let x1 = rect.min.x + w / 3.0;
+    let x2 = rect.min.x + (2.0 * w) / 3.0;
+    painter.line_segment([pos2(x1, rect.min.y), pos2(x1, rect.max.y)], stroke);
+    painter.line_segment([pos2(x2, rect.min.y), pos2(x2, rect.max.y)], stroke);
+
+    let y1 = rect.min.y + h / 3.0;
+    let y2 = rect.min.y + (2.0 * h) / 3.0;
+    painter.line_segment([pos2(rect.min.x, y1), pos2(rect.max.x, y1)], stroke);
+    painter.line_segment([pos2(rect.min.x, y2), pos2(rect.max.x, y2)], stroke);
+}
+
+/// Renders a circular handle with shadow, fill, and accent stroke using the image tool accent.
+pub fn draw_handle(painter: &egui::Painter, center: Pos2, is_active: bool, is_hovered: bool, crop_mode: bool, accent_color: Color32) {
+    let base_radius = 6.5;
+    let circle_radius = if is_active {
+        base_radius + 2.0
+    } else if is_hovered {
+        base_radius + 1.2
+    } else {
+        base_radius
+    };
+
+    let fill_color = if crop_mode {
+        if is_active || is_hovered { Color32::from_rgb(255, 230, 150) } else { Color32::from_rgb(255, 255, 255) }
+    } else if is_active || is_hovered {
+        Color32::from_rgb(210, 235, 255)
+    } else {
+        Color32::from_rgb(255, 255, 255)
+    };
+
+    // Draw handle shadow/glow
+    painter.circle_filled(center, circle_radius + 1.5, Color32::from_rgba_unmultiplied(0, 0, 0, 80));
+
+    // Draw handle circle
+    painter.circle_filled(center, circle_radius, fill_color);
+    painter.circle_stroke(center, circle_radius, Stroke::new(1.8, accent_color));
+}
+
+// ============================================================================
+// 3. UNIT TESTS: MATHEMATICAL VERIFICATION
+// ============================================================================
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::vec2;
+
+    // Verify scale in screen space: dividing an endpoint's rounding error by a tiny
+    // retained UV span would magnify it and make a fixed scale tolerance invalid.
+    fn crop_scale_preserved(before: Rect, uv_before: Rect, after: Rect, uv_after: Rect) -> bool {
+        let axis = |lo: f32, hi: f32, u0: f32, u1: f32, new_lo: f32, new_hi: f32, v0: f32, v1: f32| {
+            let span = f64::from(hi) - f64::from(lo);
+            let expected = span * (f64::from(v1) - f64::from(v0)) / (f64::from(u1) - f64::from(u0));
+            let actual = f64::from(new_hi) - f64::from(new_lo);
+            // One moved endpoint rounds once to f32. EPSILON * coordinate magnitude
+            // bounds one ulp (conservatively twice the nearest-rounding error).
+            // The f64 term also covers the two arithmetic operations above.
+            let magnitude = f64::from(new_lo).abs().max(f64::from(new_hi).abs()).max(expected.abs());
+            let bound = f64::from(f32::EPSILON) * magnitude + 4.0 * f64::EPSILON * span.abs();
+            (actual - expected).abs() <= bound
+        };
+        axis(before.min.x, before.max.x, uv_before.min.x, uv_before.max.x, after.min.x, after.max.x, uv_after.min.x, uv_after.max.x)
+            && axis(before.min.y, before.max.y, uv_before.min.y, uv_before.max.y, after.min.y, after.max.y, uv_after.min.y, uv_after.max.y)
+    }
+
+    #[test]
+    fn crop_scale_at_large_screen_offset() {
+        let screen = Rect::from_min_size(pos2(813.7157, 0.0), vec2(495.0725, 50.0));
+        let uv = Rect::from_min_size(pos2(0.114936605, 0.0), vec2(0.32074833, 0.3));
+        let (cropped, kept) = apply_crop(screen, uv, ImageHandle::BottomLeft, vec2(1255.676, 0.0));
+        let width = (f64::from(screen.max.x) - f64::from(screen.min.x)) * (f64::from(kept.max.x) - f64::from(kept.min.x))
+            / (f64::from(uv.max.x) - f64::from(uv.min.x));
+        assert_eq!(cropped.min.x, (f64::from(screen.max.x) - width) as f32, "moved edge rounds once from the fixed anchor");
+        assert_eq!(cropped.max.x, screen.max.x, "opposite horizontal edge stays fixed");
+        assert_eq!(cropped.min.y, screen.min.y, "opposite vertical edge stays fixed");
+        assert!(crop_scale_preserved(screen, uv, cropped, kept));
+        let stretched = Rect::from_min_max(cropped.min - vec2(0.1, 0.0), cropped.max);
+        assert!(!crop_scale_preserved(screen, uv, stretched, kept), "a visible stretch must exceed the rounding bound");
+    }
+
+    #[test]
+    fn test_resize_bottom_right_anchor() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(300.0, 200.0));
+        let res = apply_resize(r, ImageHandle::BottomRight, vec2(50.0, 25.0));
+        assert_eq!(res.min, pos2(100.0, 100.0), "TopLeft anchor must remain fixed");
+        assert_eq!(res.max, pos2(350.0, 225.0), "BottomRight must expand by delta");
+    }
+
+    #[test]
+    fn test_resize_top_left_anchor() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(300.0, 200.0));
+        let res = apply_resize(r, ImageHandle::TopLeft, vec2(20.0, 15.0));
+        assert_eq!(res.max, pos2(300.0, 200.0), "BottomRight anchor must remain fixed");
+        assert_eq!(res.min, pos2(120.0, 115.0), "TopLeft must move by delta");
+    }
+
+    #[test]
+    fn test_resize_clamping_prevents_inversion() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(200.0, 200.0));
+        let res = apply_resize(r, ImageHandle::TopLeft, vec2(500.0, 500.0));
+        assert_eq!(res.max, pos2(200.0, 200.0));
+        assert_eq!(res.min, pos2(200.0 - MIN_RECT_SIZE, 200.0 - MIN_RECT_SIZE));
+        assert!(res.width() >= MIN_RECT_SIZE);
+        assert!(res.height() >= MIN_RECT_SIZE);
+    }
+
+    #[test]
+    fn test_resize_top_right_anchor() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(300.0, 200.0));
+        let res = apply_resize(r, ImageHandle::TopRight, vec2(10.0, -10.0));
+        assert_eq!(res.min.x, 100.0, "min.x (BL) anchor fixed");
+        assert_eq!(res.max.y, 200.0, "max.y (BL) anchor fixed");
+        assert_eq!(res.max.x, 310.0);
+        assert_eq!(res.min.y, 90.0);
+    }
+
+    #[test]
+    fn test_resize_bottom_left_anchor() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(300.0, 200.0));
+        let res = apply_resize(r, ImageHandle::BottomLeft, vec2(-15.0, 20.0));
+        assert_eq!(res.max.x, 300.0, "max.x (TR) anchor fixed");
+        assert_eq!(res.min.y, 100.0, "min.y (TR) anchor fixed");
+        assert_eq!(res.min.x, 85.0);
+        assert_eq!(res.max.y, 220.0);
+    }
+
+    #[test]
+    fn test_resize_mid_edges() {
+        let r = Rect::from_min_max(pos2(100.0, 100.0), pos2(300.0, 200.0));
+
+        let tm = apply_resize(r, ImageHandle::TopCenter, vec2(50.0, -30.0));
+        assert_eq!(tm.min.x, 100.0, "X min unaffected");
+        assert_eq!(tm.max.x, 300.0, "X max unaffected");
+        assert_eq!(tm.max.y, 200.0, "Y max anchor locked");
+        assert_eq!(tm.min.y, 70.0);
+
+        let rm = apply_resize(r, ImageHandle::RightCenter, vec2(40.0, 50.0));
+        assert_eq!(rm.min.x, 100.0, "X min anchor locked");
+        assert_eq!(rm.max.x, 340.0);
+        assert_eq!(rm.min.y, 100.0, "Y unaffected");
+        assert_eq!(rm.max.y, 200.0, "Y unaffected");
+    }
+
+    #[test]
+    fn test_crop_lockstep_ratio_preservation() {
+        let screen = Rect::from_min_max(pos2(100.0, 100.0), pos2(500.0, 400.0));
+        let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+
+        let initial_px_per_uv_x = screen.width() / uv.width();
+        let initial_px_per_uv_y = screen.height() / uv.height();
+
+        let (new_screen, new_uv) = apply_crop(screen, uv, ImageHandle::RightCenter, vec2(-80.0, 0.0));
+
+        assert_eq!(new_screen.min.x, 100.0, "Left edge anchored");
+        assert_eq!(new_screen.max.x, 420.0, "Right edge moved in by 80px");
+        assert_eq!(new_screen.width(), 320.0);
+
+        assert_eq!(new_uv.min.x, 0.0);
+        assert!((new_uv.max.x - 0.8).abs() < 1e-4);
+
+        let new_px_per_uv_x = new_screen.width() / new_uv.width();
+        assert!((new_px_per_uv_x - initial_px_per_uv_x).abs() < 1e-4, "Pixel scale must remain invariant in crop mode");
+
+        let new_px_per_uv_y = new_screen.height() / new_uv.height();
+        assert!((new_px_per_uv_y - initial_px_per_uv_y).abs() < 1e-4, "Pixel scale Y must remain invariant");
+    }
+
+    #[test]
+    fn test_crop_left_edge_anchoring() {
+        let screen = Rect::from_min_max(pos2(100.0, 100.0), pos2(500.0, 400.0));
+        let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+
+        let (new_screen, new_uv) = apply_crop(screen, uv, ImageHandle::LeftCenter, vec2(50.0, 0.0));
+
+        assert_eq!(new_screen.max.x, 500.0, "Right edge must remain strictly anchored");
+        assert_eq!(new_screen.min.x, 150.0, "Left edge must move by 50px");
+        assert_eq!(new_screen.width(), 350.0);
+
+        assert!((new_uv.min.x - 0.125).abs() < 1e-4);
+        assert_eq!(new_uv.max.x, 1.0);
+    }
+
+    #[test]
+    fn test_crop_uncrop_clamped_at_zero_and_one() {
+        let screen = Rect::from_min_max(pos2(100.0, 100.0), pos2(500.0, 400.0));
+        let uv = Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0));
+
+        let (new_screen, new_uv) = apply_crop(screen, uv, ImageHandle::LeftCenter, vec2(-100.0, 0.0));
+        assert_eq!(new_uv.min.x, 0.0, "UV min cannot go below 0.0");
+        assert_eq!(new_screen.min.x, 100.0, "Screen min clamped at initial position");
+
+        let (new_screen2, new_uv2) = apply_crop(screen, uv, ImageHandle::RightCenter, vec2(100.0, 0.0));
+        assert_eq!(new_uv2.max.x, 1.0, "UV max cannot exceed 1.0");
+        assert_eq!(new_screen2.max.x, 500.0, "Screen max clamped at initial position");
+    }
+
+    #[test]
+    fn test_apply_resize_proportional_horizontal_only_scales_both_dimensions() {
+        let rect = Rect::from_min_max(pos2(100.0, 100.0), pos2(200.0, 200.0)); // 100 x 100
+        // TopRight corner moved horizontally by -25px (from x=200 to x=175)
+        let resized = apply_resize_proportional(rect, ImageHandle::TopRight, vec2(-25.0, 0.0));
+        assert_eq!(resized.min.x, 100.0, "Left anchor preserved");
+        assert_eq!(resized.max.y, 200.0, "Bottom anchor preserved");
+        assert_eq!(resized.width(), 75.0, "Width scaled to 75%");
+        assert_eq!(resized.height(), 75.0, "Height scaled to 75% proportionally");
+        assert_eq!(resized.max.x, 175.0);
+        assert_eq!(resized.min.y, 125.0);
+    }
+
+    #[test]
+    fn test_apply_resize_proportional_bottom_right_anchor_locked() {
+        let rect = Rect::from_min_max(pos2(50.0, 50.0), pos2(150.0, 250.0)); // 100 x 200
+        // BottomRight moved down/right by (20px, 40px)
+        let resized = apply_resize_proportional(rect, ImageHandle::BottomRight, vec2(20.0, 40.0));
+        assert_eq!(resized.min, pos2(50.0, 50.0), "TopLeft anchor strictly locked");
+        assert_eq!(resized.width(), 120.0);
+        assert_eq!(resized.height(), 240.0);
+    }
+
+    #[cfg(test)]
+    mod proptests {
+        use super::*;
+        use proptest::prelude::*;
+
+        fn arb_handle() -> impl Strategy<Value = ImageHandle> {
+            prop_oneof![
+                Just(ImageHandle::TopLeft),
+                Just(ImageHandle::TopCenter),
+                Just(ImageHandle::TopRight),
+                Just(ImageHandle::RightCenter),
+                Just(ImageHandle::BottomRight),
+                Just(ImageHandle::BottomCenter),
+                Just(ImageHandle::BottomLeft),
+                Just(ImageHandle::LeftCenter),
+            ]
+        }
+
+        proptest! {
+            #[test]
+            fn prop_apply_resize_never_inverts_and_respects_min_size(
+                min_x in -5000.0f32..5000.0,
+                min_y in -5000.0f32..5000.0,
+                w in 10.0f32..2000.0,
+                h in 10.0f32..2000.0,
+                handle in arb_handle(),
+                dx in -10000.0f32..10000.0,
+                dy in -10000.0f32..10000.0,
+            ) {
+                let rect = Rect::from_min_size(pos2(min_x, min_y), vec2(w, h));
+                let res = apply_resize(rect, handle, vec2(dx, dy));
+                prop_assert!(res.is_finite());
+                prop_assert!(res.width() >= MIN_RECT_SIZE - 1e-3);
+                prop_assert!(res.height() >= MIN_RECT_SIZE - 1e-3);
+                prop_assert!(res.min.x <= res.max.x);
+                prop_assert!(res.min.y <= res.max.y);
+            }
+
+            #[test]
+            fn prop_apply_resize_proportional_preserves_aspect_ratio(
+                min_x in -2000.0f32..2000.0,
+                min_y in -2000.0f32..2000.0,
+                w in 20.0f32..1000.0,
+                h in 20.0f32..1000.0,
+                handle in arb_handle(),
+                dx in -5000.0f32..5000.0,
+                dy in -5000.0f32..5000.0,
+            ) {
+                let rect = Rect::from_min_size(pos2(min_x, min_y), vec2(w, h));
+                let res = apply_resize_proportional(rect, handle, vec2(dx, dy));
+                prop_assert!(res.is_finite());
+                prop_assert!(res.width() >= MIN_RECT_SIZE - 1e-3);
+                prop_assert!(res.height() >= MIN_RECT_SIZE - 1e-3);
+
+                let is_corner = matches!(handle, ImageHandle::TopLeft | ImageHandle::TopRight | ImageHandle::BottomLeft | ImageHandle::BottomRight);
+                if is_corner {
+                    let orig_ratio = w / h;
+                    let new_ratio = res.width() / res.height();
+                    prop_assert!((orig_ratio - new_ratio).abs() <= 1e-3 * orig_ratio.max(1.0), "orig: {orig_ratio}, new: {new_ratio}");
+                }
+            }
+
+            #[test]
+            fn prop_apply_crop_uv_clamped(
+                min_x in 0.0f32..1000.0,
+                min_y in 0.0f32..1000.0,
+                w in 50.0f32..500.0,
+                h in 50.0f32..500.0,
+                uv_u0 in 0.0f32..0.4,
+                uv_v0 in 0.0f32..0.4,
+                uv_w in 0.3f32..0.5,
+                uv_h in 0.3f32..0.5,
+                handle in arb_handle(),
+                dx in -2000.0f32..2000.0,
+                dy in -2000.0f32..2000.0,
+            ) {
+                let screen = Rect::from_min_size(pos2(min_x, min_y), vec2(w, h));
+                let uv = Rect::from_min_size(pos2(uv_u0, uv_v0), vec2(uv_w, uv_h));
+                let (new_screen, new_uv) = apply_crop(screen, uv, handle, vec2(dx, dy));
+
+                prop_assert!(new_screen.is_finite());
+                prop_assert!(new_uv.is_finite());
+                prop_assert!(new_uv.min.x >= 0.0 - 1e-5);
+                prop_assert!(new_uv.min.y >= 0.0 - 1e-5);
+                prop_assert!(new_uv.max.x <= 1.0 + 1e-5);
+                prop_assert!(new_uv.max.y <= 1.0 + 1e-5);
+                prop_assert!(new_uv.width() > 0.0);
+                prop_assert!(new_uv.height() > 0.0);
+
+                if !matches!(handle, ImageHandle::TopLeft | ImageHandle::LeftCenter | ImageHandle::BottomLeft) {
+                    prop_assert_eq!(new_screen.min.x, screen.min.x, "stationary left edge moved");
+                }
+                if !matches!(handle, ImageHandle::TopRight | ImageHandle::RightCenter | ImageHandle::BottomRight) {
+                    prop_assert_eq!(new_screen.max.x, screen.max.x, "stationary right edge moved");
+                }
+                if !matches!(handle, ImageHandle::TopLeft | ImageHandle::TopCenter | ImageHandle::TopRight) {
+                    prop_assert_eq!(new_screen.min.y, screen.min.y, "stationary top edge moved");
+                }
+                if !matches!(handle, ImageHandle::BottomLeft | ImageHandle::BottomCenter | ImageHandle::BottomRight) {
+                    prop_assert_eq!(new_screen.max.y, screen.max.y, "stationary bottom edge moved");
+                }
+
+                prop_assert!(crop_scale_preserved(screen, uv, new_screen, new_uv),
+                    "screen/UV scale changed beyond endpoint rounding: {screen:?} {uv:?} => {new_screen:?} {new_uv:?}");
+            }
+
+            #[test]
+            fn prop_quad_contains_never_panics(
+                q0_x in -1000.0f32..1000.0,
+                q0_y in -1000.0f32..1000.0,
+                q1_x in -1000.0f32..1000.0,
+                q1_y in -1000.0f32..1000.0,
+                q2_x in -1000.0f32..1000.0,
+                q2_y in -1000.0f32..1000.0,
+                q3_x in -1000.0f32..1000.0,
+                q3_y in -1000.0f32..1000.0,
+                px in -2000.0f32..2000.0,
+                py in -2000.0f32..2000.0,
+            ) {
+                let quad = [pos2(q0_x, q0_y), pos2(q1_x, q1_y), pos2(q2_x, q2_y), pos2(q3_x, q3_y)];
+                let p = pos2(px, py);
+                let _ = crate::edit_text_ui::quad_contains(quad, p);
+            }
+        }
+
+        #[test]
+        fn degenerate_quad_does_not_contain_points() {
+            let zero_quad = [pos2(0.0, 0.0), pos2(0.0, 0.0), pos2(0.0, 0.0), pos2(0.0, 0.0)];
+            assert!(!crate::edit_text_ui::quad_contains(zero_quad, pos2(10.0, 10.0)));
+            assert!(!crate::edit_text_ui::quad_contains(zero_quad, pos2(0.0, 0.0)));
+        }
+    }
+}
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 222bb988e4..ab5d1334e3 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -36,6 +36,7 @@ macro_rules! tl_ctx {
 }
 pub mod canvas;
 mod chrome;
+mod image_engine;
 pub use combine_grid::ThumbState as CombineThumb;
 pub use combine_ui::{Columns as CombineColumns, CombineView, Lock as CombineLock, SortKey};
 mod commands;
@@ -45,13 +46,14 @@ mod menus;
 pub mod marks {
     pub use crate::marks_ui::{MarksDraft, PageRange, Subset};
 }
+pub use content_ui::TextDraft;
 pub use create_ui::Clip;
 pub use link_ui::LinkDraft;
 pub use optimize_ui::{OptimizeDraft, OptimizeTab};
 pub use sign_ui::{DigitalIdEntry, SignDraft, SignGraphic, SignStep};
 mod bidi;
 mod dialogs;
-pub use edit_text_ui::CropMode;
+pub use edit_text_ui::{CropMode, DragTarget, ImageDrag, ImageHandle, ImageSelection};
 mod editing;
 mod home;
 mod panels;
@@ -77,6 +79,9 @@ mod state;
 mod tools;
 mod workflows;
 
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) mod os_clipboard;
+
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) use app::same_file;
 pub(crate) use app::{MAX_AUTHOR_CHARS, copy_refused, date_text_for_pdf, print_refused};
@@ -114,6 +119,7 @@ use panels::search_ui;
 pub use panels::side_panels;
 pub use persist::last_session;
 pub use persist::last_view;
+pub use persist::paper;
 use persist::recovery;
 pub use persist::units;
 #[cfg(not(target_arch = "wasm32"))]
@@ -140,7 +146,7 @@ use state::CopyPage;
 use state::OpenRequest;
 pub use state::{
     CustomDraft, Dialog, DuplicateDraft, LeftPanel, LinkOrigin, Mode, NumberDraft, OpenOutcome, PageClip, PagePropsDraft, PasswordPrompt,
-    PendingLink, PendingRemoteLink, PropsTab, QuickTool, RecentFile, RightPanel, UnlockPrompt,
+    PendingLink, PendingRemoteLink, PropsTab, QuickTool, RECENT_FILES_DEFAULT, RECENT_FILES_MAX, RecentFile, RightPanel, UnlockPrompt,
 };
 use state::{DocumentCopyJob, GridFile};
 pub use tools::bulk_fields;
@@ -239,6 +245,7 @@ struct PendingOpen {
     after_open: Option<pdfcraft_render::RemoteDestination>,
     recovered: Option<RecoveryMeta>,
     then: Option<&'static str>,
+    display_override: Option<(canvas::PageLayout, bool)>,
 }
 
 pub struct PdfCraftApp {
@@ -258,6 +265,8 @@ pub struct PdfCraftApp {
     pub view_defaults: canvas::ViewDefaults,
     /// The unit page sizes and margins are shown in (Preferences ▸ Documents and view).
     pub units: units::Unit,
+    /// The paper Create ▸ Blank page makes (#5644): the system region's.
+    pub blank_paper: paper::Paper,
     /// The Preferences ▸ Date format box while it's being edited, or while it holds an invalid
     /// pattern (the session keeps the last valid one).
     pub date_format_draft: Option<String>,
@@ -291,6 +300,8 @@ pub struct PdfCraftApp {
     /// The reading-colours preference (Preferences ▸ Reading colours): applied to every open
     /// document, and documents open with it (Acrobat's Replace Document Colors).
     pub reading_colors: pdfcraft_render::ReadingColors,
+    /// App-wide page decoration only; never part of a PDF edit or render request.
+    pub show_page_edge_shadows: bool,
     /// The Linux portal is enabled only by the native host, and starts on the first System choice.
     #[cfg(target_os = "linux")]
     desktop_theme: Option<pdfcraft_platform::desktop_theme::DesktopTheme>,
@@ -338,6 +349,8 @@ pub struct PdfCraftApp {
     /// tab coming to the front (Home, a document, Combine files) puts the view away.
     all_tools_tab: (Option<DocId>, bool),
     pub recent: Vec<RecentFile>,
+    /// How many recent files to keep, 0 for no list (Preferences ▸ Documents and view, #5572).
+    pub recent_limit: usize,
     /// Preferences: reopen the files that were open when PdfCraft last closed (#442).
     pub reopen_last_session: bool,
     /// Restore last view settings when reopening documents (Preferences ▸ Documents and view;
@@ -368,10 +381,19 @@ pub struct PdfCraftApp {
     pending_opens: Vec<PendingOpen>,
     #[cfg(not(target_arch = "wasm32"))]
     next_open_token: u64,
+    /// Explicit CLI layout waits for flagged launch opens, never targeting restored tabs.
+    #[cfg(not(target_arch = "wasm32"))]
+    launch_layout: Option<(canvas::PageLayout, bool)>,
+    #[cfg(not(target_arch = "wasm32"))]
+    launch_display_target: Option<DocId>,
     #[cfg(all(test, not(target_arch = "wasm32")))]
     open_prepare_gate: Option<std::sync::Arc<open_worker::PrepareGate>>,
     /// Folders pinned to Home, and what they held when last listed.
     pub pinned: folders_ui::PinnedFolders,
+    /// Tools pinned to Home, in user-defined order.
+    pub pinned_tools: Vec<String>,
+    /// Search query for the Pin a tool selection dialog.
+    pub pin_tool_search: String,
     pub toast: Option<(String, f64)>,
     /// The form script message the toast shows now, if it shows one: drawn with its title and
     /// icon (#4293).
@@ -537,8 +559,6 @@ pub struct PdfCraftApp {
     pub system_clipboard: bool,
     /// What ⌘V reads instead of the system clipboard (tests).
     pub clipboard_override: Option<create_ui::Clip>,
-    /// V is down as a plain key press (see [`Self::paste_key_released`]).
-    v_pressed: bool,
     /// Attach file: the file to attach instead of asking (tests, automation).
     pub attach_override: Option<(String, Vec<u8>)>,
     /// Duplicate Field: which field and onto which pages.
diff --git a/crates/ui-egui/src/os_clipboard.rs b/crates/ui-egui/src/os_clipboard.rs
new file mode 100644
index 0000000000..9f68bd957b
--- /dev/null
+++ b/crates/ui-egui/src/os_clipboard.rs
@@ -0,0 +1,28 @@
+//! The one way to the operating system's clipboard.
+//!
+//! The system clipboard is a single process-wide resource: on Windows, two threads that
+//! open it at once can corrupt the heap. Every access goes through [`with`], which holds a
+//! lock across the whole open, use and close, so parallel callers (test threads, workers)
+//! take turns instead of racing.
+
+use std::sync::{Mutex, PoisonError};
+
+static LOCK: Mutex<()> = Mutex::new(());
+
+/// Opens the system clipboard, runs `f` on it and closes it, with no other thread inside.
+pub(crate) fn with<T>(f: impl FnOnce(&mut arboard::Clipboard) -> Result<T, arboard::Error>) -> Result<T, arboard::Error> {
+    let _turn = LOCK.lock().unwrap_or_else(PoisonError::into_inner);
+    // Declared after the guard, so it's closed before the lock is released.
+    let mut clipboard = arboard::Clipboard::new()?;
+    f(&mut clipboard)
+}
+
+/// Nonempty text supersedes the app's cached image, even if another clipboard format also exists.
+pub(crate) fn has_text() -> bool {
+    with(|cb| cb.get_text()).is_ok_and(|text| !text.is_empty())
+}
+
+/// The system clipboard as image paste sees it; text takes precedence over a cached image.
+pub(crate) fn for_image_paste() -> Option<crate::create_ui::Clip> {
+    if has_text() { Some(crate::create_ui::Clip::Text(String::new())) } else { crate::create_ui::read_clipboard() }
+}
diff --git a/crates/ui-egui/src/panels/comments_panel.rs b/crates/ui-egui/src/panels/comments_panel.rs
index c549ed8e3e..d54daf5717 100644
--- a/crates/ui-egui/src/panels/comments_panel.rs
+++ b/crates/ui-egui/src/panels/comments_panel.rs
@@ -241,6 +241,10 @@ pub(crate) fn show(
     }
     let mut page = usize::MAX;
     let mut group: Option<String> = None;
+    // A card (or page header) out of view that was measured at this width only takes up its
+    // height: laying out hundreds of them every frame put the panel over the frame budget
+    // (#5488). Shorter lists are laid out whole, so every card stays in the accessibility tree.
+    let virtual_list = roots.len() > LAY_OUT_WHOLE;
     for a in roots {
         if sort != SortBy::Page {
             let g = group_of(a);
@@ -252,48 +256,118 @@ pub(crate) fn show(
             }
         } else if a.page != page {
             page = a.page;
-            let n = page_counts.get(&page).copied().unwrap_or_default();
-            let open = !view.comments.collapsed_pages.contains(&page);
-            ui.add_space(6.0);
-            let clicked = ui
-                .horizontal(|ui| {
-                    let chevron = if open { "chevron-down" } else { "chevron-right" };
-                    let toggle = icons::button(ui, chevron, 18.0, false, if open { tl!("Collapse") } else { tl!("Expand") }).clicked();
-                    let label = ui.add(
-                        egui::Label::new(
-                            egui::RichText::new(crate::i18n::fmt(tl!("Page {label}"), &[("label", &info.pages[page].label)]))
-                                .font(theme::semibold(12.5))
-                                .color(t.text_muted),
-                        )
-                        .sense(Sense::click()),
-                    );
-                    ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-                        ui.label(egui::RichText::new(n.to_string()).color(t.text_faint).small())
-                    });
-                    toggle || label.clicked()
-                })
-                .inner;
-            if clicked {
-                if open {
-                    view.comments.collapsed_pages.push(page);
-                } else {
-                    view.comments.collapsed_pages.retain(|&c| c != page);
+            // Per document: two documents shown at the same width don't share heights.
+            let header = ui.scope_id().with(("comment-page-header", view.id, page));
+            if !(virtual_list && skip_if_hidden(ui, header)) {
+                let top = ui.cursor().min.y;
+                page_header(ui, t, info, page, page_counts.get(&page).copied().unwrap_or_default(), &mut view.comments.collapsed_pages);
+                if virtual_list {
+                    remember_height(ui, header, top);
                 }
             }
-            ui.add_space(2.0);
         }
         if sort == SortBy::Page && view.comments.collapsed_pages.contains(&a.page) {
             continue;
         }
+        let key = (a.page, a.index);
         let thread = replies_of(a);
+        let selected = view.comments.selected == Some(key);
+        // A height is kept for what the card showed when it was measured: its document, what the
+        // thread says, whether it was the selected card (which draws its menu and editor) and
+        // whether an editor was open on it. An
+        // edit, undo or redo that changes the card measures it afresh; other cards keep theirs.
+        // A card with an editor open on it or on a reply is always drawn too (CodeRabbit on
+        // #5583): a kept height would show it at its size before the editor opened.
+        let editing = view.comments.editing.as_ref().is_some_and(|(p, i, _)| (*p, *i) == key || thread.iter().any(|r| (r.page, r.index) == (*p, *i)));
+        let id = ui.scope_id().with(("comment-card", view.id, key, card_signature(a, thread), selected, editing));
+        // The selected card is always drawn, so it can scroll itself into view and keep its menu
+        // and editor.
+        if virtual_list && !selected && !editing && skip_if_hidden(ui, id) {
+            continue;
+        }
         let rotation = info.pages.get(a.page).map_or(0, |p| p.rotation);
+        let top = ui.cursor().min.y;
         if let Some(e) = card(ui, view, CardContext { theme: t, annotation: a, rotation, thread, doc, prefs, allowed, nav }) {
             edit = Some(e);
         }
+        if virtual_list {
+            remember_height(ui, id, top);
+        }
     }
     edit
 }
 
+/// The "Page N" group header with its fold chevron and comment count `n`; a click folds or
+/// unfolds the page.
+fn page_header(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, page: usize, n: usize, collapsed: &mut Vec<usize>) {
+    let open = !collapsed.contains(&page);
+    ui.add_space(6.0);
+    let clicked = ui
+        .horizontal(|ui| {
+            let chevron = if open { "chevron-down" } else { "chevron-right" };
+            let toggle = icons::button(ui, chevron, 18.0, false, if open { tl!("Collapse") } else { tl!("Expand") }).clicked();
+            let label = ui.add(
+                egui::Label::new(
+                    egui::RichText::new(crate::i18n::fmt(tl!("Page {label}"), &[("label", info.pages.get(page).map_or("?", |p| p.label.as_str()))]))
+                        .font(theme::semibold(12.5))
+                        .color(t.text_muted),
+                )
+                .sense(Sense::click()),
+            );
+            ui.with_layout(Layout::right_to_left(Align::Center), |ui| ui.label(egui::RichText::new(n.to_string()).color(t.text_faint).small()));
+            toggle || label.clicked()
+        })
+        .inner;
+    ui.add_space(2.0);
+    if clicked {
+        if open {
+            collapsed.push(page);
+        } else {
+            collapsed.retain(|&c| c != page);
+        }
+    }
+}
+
+/// What a card's height depends on in the document: the comment and its replies as shown (their
+/// kind, author, text, date, status, colour and lock). Two cards with the same signature lay out
+/// alike at one width.
+fn card_signature(a: &Annotation, thread: &[&Annotation]) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let mut h = std::collections::hash_map::DefaultHasher::new();
+    for x in std::iter::once(a).chain(thread.iter().copied()) {
+        (&x.subtype, &x.author, &x.contents, &x.modified, &x.state, x.locked).hash(&mut h);
+        x.color.map(|c| c.map(f32::to_bits)).hash(&mut h);
+    }
+    h.finish()
+}
+
+/// Comment lists up to this long are laid out whole; longer ones lay out only what is in view.
+const LAY_OUT_WHOLE: usize = 100;
+
+/// For a part of the list (a card or a page header) that was measured at this width and would
+/// fall out of view: takes up its height without laying it out, and returns `true`.
+fn skip_if_hidden(ui: &mut egui::Ui, id: egui::Id) -> bool {
+    let width = ui.available_width();
+    let Some(height) = ui.data(|d| d.get_temp::<(f32, f32)>(id)).filter(|(w, _)| (w - width).abs() < 0.5).map(|(_, h)| h) else {
+        return false;
+    };
+    if ui.is_rect_visible(egui::Rect::from_min_size(ui.cursor().min, vec2(width, height))) {
+        return false;
+    }
+    ui.allocate_space(vec2(width, height));
+    true
+}
+
+/// Records the height part `id` took since the cursor was at `top`, for [`skip_if_hidden`]: less
+/// the spacing `allocate_space` adds back after it.
+fn remember_height(ui: &egui::Ui, id: egui::Id, top: f32) {
+    let height = ui.cursor().min.y - top - ui.spacing().item_spacing.y;
+    if height.is_finite() && height > 0.0 {
+        let width = ui.available_width();
+        ui.data_mut(|d| d.insert_temp(id, (width, height)));
+    }
+}
+
 /// Draw one comment thread card, including author, body or inline editor, replies, status and per-comment
 /// actions; returns an edit to apply.
 struct CardContext<'a> {
diff --git a/crates/ui-egui/src/panels/edit.rs b/crates/ui-egui/src/panels/edit.rs
index e95db85a72..2ba86ee5f5 100644
--- a/crates/ui-egui/src/panels/edit.rs
+++ b/crates/ui-egui/src/panels/edit.rs
@@ -266,11 +266,27 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
             .into_iter()
             .map(|f| (f.resource, f.face))
             .collect();
-        let shown = ed.font_shown(&sources);
+        let fmt = ed.selection_formatting(&sources);
+        ed.sync_selection_look(&fmt);
+        let shown = fmt.font_shown;
+        let mixed_size = fmt.size.is_none();
         // A selection aligns the rows it touches; the caret alone, the whole paragraph.
         let paragraphs = crate::format_text_ui::Paragraphs { text: &ed.text, selection: ed.selection.clone(), tidy: false };
-        let out = crate::format_text_ui::panel(ui, t, &mut ed.look, Some(&mut ed.extras), Fonts { sources: Some(&sources), shown }, Some(paragraphs));
+        let out = crate::format_text_ui::panel(
+            ui,
+            t,
+            &mut ed.look,
+            Some(&mut ed.extras),
+            Fonts { sources: Some(&sources), shown, mixed_size },
+            Some(paragraphs),
+        );
+        if out.size_committed {
+            ed.choose_size(ed.look.size);
+        }
         let mut changed = out.changed;
+        if let Some(script) = out.script {
+            changed |= crate::edit_text_ui::toggle_script(&mut ed.text, &mut ed.selection, script);
+        }
         match out.font {
             Some(FontChoice::KeepSource) => {
                 ed.keep_source_font();
@@ -305,7 +321,13 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
         }
         let mut style = draft.style.clone();
         let paragraphs = crate::format_text_ui::Paragraphs { text: &draft.text, selection: draft.selection.clone(), tidy: true };
-        added_text_format(ui, t, &mut style, Some(paragraphs));
+        let out = added_text_format(ui, t, &mut style, Some(paragraphs));
+        if let Some(script) = out.script {
+            let mut toggled = draft.clone();
+            if crate::edit_text_ui::toggle_script(&mut toggled.text, &mut toggled.selection, script) {
+                app.views[i].content.draft = Some(toggled);
+            }
+        }
         if style != draft.style {
             app.restyle_draft(i, style);
         }
@@ -363,12 +385,18 @@ fn format_section(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
 
 /// Format text for added text: the standard families, size, colour, style and alignment
 /// (of the lines `paragraphs` selects, while the text is being typed).
-fn added_text_format(ui: &mut egui::Ui, t: &Tokens, style: &mut pdfcraft_engine::AddedText, paragraphs: Option<crate::format_text_ui::Paragraphs>) {
+fn added_text_format(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    style: &mut pdfcraft_engine::AddedText,
+    paragraphs: Option<crate::format_text_ui::Paragraphs>,
+) -> crate::format_text_ui::Outcome {
     let shown = style.family.label().to_string();
-    let out = crate::format_text_ui::panel(ui, t, style, None, crate::format_text_ui::Fonts { sources: None, shown }, paragraphs);
+    let out = crate::format_text_ui::panel(ui, t, style, None, crate::format_text_ui::Fonts { sources: None, shown, mixed_size: false }, paragraphs);
     if let Some(crate::format_text_ui::FontChoice::Family(family)) = out.font {
         style.family = family;
     }
+    out
 }
 
 impl PdfCraftApp {
diff --git a/crates/ui-egui/src/panels/format_text_ui.rs b/crates/ui-egui/src/panels/format_text_ui.rs
index eccef2aa79..dbb50f73ec 100644
--- a/crates/ui-egui/src/panels/format_text_ui.rs
+++ b/crates/ui-egui/src/panels/format_text_ui.rs
@@ -3,12 +3,13 @@
 //! horizontal scale and character spacing. One panel serves a paragraph being edited (with the
 //! fonts already on its page and the spacing controls) and added text (the standard families,
 //! size, colour, style, alignment and character spacing). What PdfCraft can't apply yet (lists,
-//! superscript and subscript, paragraph spacing, or line spacing and scale for added text) is shown
+//! paragraph spacing, or line spacing and scale for added text) is shown
 //! disabled and says so.
 //!
 //! The icons are Lucide's (AGENTS.md §1); only the arrangement follows Acrobat.
 
 use egui::{Align, Color32, CornerRadius, Layout, Rect, Sense, Stroke, vec2};
+use pdfcraft_engine::text_script::Script;
 use pdfcraft_engine::{AddedText, FontFamily, TextAlign};
 
 use crate::edit_text_ui::Extras;
@@ -38,6 +39,7 @@ pub(crate) struct Fonts<'a> {
     pub sources: Option<&'a [(String, String)]>,
     /// The name the list shows for the current choice.
     pub shown: String,
+    pub mixed_size: bool,
 }
 
 /// Text being typed in, for the alignment buttons: with some of it selected, they show and set the
@@ -85,7 +87,10 @@ impl Paragraphs<'_> {
 #[derive(Default)]
 pub(crate) struct Outcome {
     pub changed: bool,
+    pub size_committed: bool,
     pub font: Option<FontChoice>,
+    /// Superscript or Subscript was clicked, for the selected paragraphs' text.
+    pub script: Option<Script>,
 }
 
 const SIZES: [f64; 16] = [4.0, 6.0, 8.0, 9.0, 10.0, 11.0, 12.0, 14.0, 16.0, 18.0, 20.0, 24.0, 28.0, 36.0, 48.0, 72.0];
@@ -125,8 +130,9 @@ pub(crate) fn panel(
     widgets::section_title(ui, tl!("Format text"));
 
     // The font, across the panel.
+    ui.spacing_mut().combo_height = 360.0;
     let width = ui.available_width();
-    craft_ui::ComboBox::from_id_salt("format-font")
+    let font_resp = craft_ui::ComboBox::from_id_salt("format-font")
         .selected_text(fonts.shown.as_str())
         .width(width)
         .show_ui(ui, |ui| {
@@ -152,31 +158,87 @@ pub(crate) fn panel(
                     out.font = Some(FontChoice::Load);
                 }
                 #[cfg(not(target_arch = "wasm32"))]
-                ui.menu_button(tl!("Installed fonts…"), |ui| match crate::files::installed_font_files(ui.ctx()) {
-                    Some(list) if list.is_empty() => {
-                        ui.label(tl!("No openly licensed document fonts found. Load a font file."));
-                    }
-                    Some(list) => {
-                        for font in list {
-                            if ui.button(&font.face).clicked() {
-                                out.font = Some(FontChoice::Installed(font.path));
-                                ui.close();
+                ui.menu_button(tl!("Installed fonts…"), |ui| {
+                    ui.set_min_width(260.0);
+                    let reload = ui.button(tl!("Reload")).clicked();
+                    match crate::files::installed_font_files(ui.ctx(), reload) {
+                        Some(list) if list.is_empty() => {
+                            ui.label(tl!("No openly licensed document fonts found. Load a font file."));
+                        }
+                        Some(list) => {
+                            let search_id = ui.scope_id().with("installed-font-search");
+                            let mut query = ui.data(|d| d.get_temp::<String>(search_id)).unwrap_or_default();
+                            ui.horizontal(|ui| {
+                                let (icon_rect, _) = ui.allocate_exact_size(egui::vec2(16.0, 16.0), egui::Sense::hover());
+                                crate::icons::paint(ui, icon_rect, "search", 13.0, ui.visuals().text_color().gamma_multiply(0.6));
+                                let resp = ui
+                                    .add(egui::TextEdit::singleline(&mut query).hint_text(tl!("Search…")).desired_width(ui.available_width() - 8.0));
+                                if resp.changed() {
+                                    ui.data_mut(|d| d.insert_temp(search_id, query.clone()));
+                                }
+                            });
+                            ui.separator();
+
+                            let query_lower = query.trim().to_lowercase();
+                            let mut families: std::collections::BTreeMap<&str, Vec<&pdfcraft_engine::text_fonts::FontFile>> =
+                                std::collections::BTreeMap::new();
+                            for font in &list {
+                                if query_lower.is_empty()
+                                    || font.family.to_lowercase().contains(&query_lower)
+                                    || font.face.to_lowercase().contains(&query_lower)
+                                {
+                                    families.entry(&font.family).or_default().push(font);
+                                }
+                            }
+
+                            if families.is_empty() {
+                                ui.label(tl!("No openly licensed document fonts found. Load a font file."));
+                            } else {
+                                egui::ScrollArea::vertical().max_height(350.0).show(ui, |ui| {
+                                    for (family, faces) in families {
+                                        if faces.len() == 1 {
+                                            if let Some(&font) = faces.first() {
+                                                let label =
+                                                    if font.face != font.family && !font.face.is_empty() { font.face.as_str() } else { family };
+                                                if ui.button(label).clicked() {
+                                                    out.font = Some(FontChoice::Installed(font.path.clone()));
+                                                    ui.close();
+                                                }
+                                            }
+                                        } else {
+                                            ui.menu_button(family, |ui| {
+                                                ui.set_min_width(180.0);
+                                                for font in faces {
+                                                    let label =
+                                                        font.face.strip_prefix(family).map(str::trim).filter(|s| !s.is_empty()).unwrap_or(&font.face);
+                                                    if ui.button(label).clicked() {
+                                                        out.font = Some(FontChoice::Installed(font.path.clone()));
+                                                        ui.close();
+                                                    }
+                                                }
+                                            });
+                                        }
+                                    }
+                                });
                             }
                         }
-                    }
-                    None => {
-                        ui.label(tl!("Finding document fonts…"));
+                        None => {
+                            ui.label(tl!("Finding document fonts…"));
+                        }
                     }
                 });
+                ui.add_space(4.0);
             }
         })
-        .response
-        .on_hover_text(format!("{}\n{}", tl!("Font"), tl!("Thai and Arabic use regular fallback fonts when available.")));
+        .response;
+    font_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ComboBox, ui.is_enabled(), tl!("Font")));
+    font_resp.on_hover_text(format!("{}\n{}", tl!("Font"), tl!("Thai and Arabic use regular fallback fonts when available.")));
     ui.add_space(4.0);
 
     // Size and colour | bullets, numbering and alignment.
+    let mut size_committed = false;
     row(ui, |ui| {
-        font_size_input(ui, &mut look.size);
+        size_committed = font_size_input(ui, &mut look.size, fonts.mixed_size);
         let swatch = colour_button(ui, t, look.color);
         egui::Popup::menu(&swatch).close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside).show(|ui| {
             if let Some(picked) = crate::comments::swatch_grid(ui, Some(look.color)) {
@@ -241,8 +303,17 @@ pub(crate) fn panel(
             }
             None => planned(ui, "underline", tl!("Underline")),
         }
-        planned(ui, "superscript", tl!("Superscript"));
-        planned(ui, "subscript", tl!("Subscript"));
+        if let Some(p) = &paragraphs {
+            for (script, icon, tip) in [(Script::Super, "superscript", tl!("Superscript")), (Script::Sub, "subscript", tl!("Subscript"))] {
+                let on = pdfcraft_engine::text_script::is_in(p.text, p.selection.as_ref(), script);
+                if icons::button(ui, icon, 30.0, on, tip).clicked() {
+                    out.script = Some(script);
+                }
+            }
+        } else {
+            planned(ui, "superscript", tl!("Superscript"));
+            planned(ui, "subscript", tl!("Subscript"));
+        }
     });
 
     // Line and paragraph spacing; horizontal scale and character spacing: two columns, each an
@@ -256,12 +327,17 @@ pub(crate) fn panel(
             labelled_icon(ui, t, "arrow-up-down", tl!("Line spacing"));
             let own = tl!("Auto").to_string();
             let shown = if e.line_spacing == 0.0 { own.clone() } else { number(e.line_spacing) };
-            craft_ui::ComboBox::from_id_salt("format-line-spacing").selected_text(shown).width(half).show_ui(ui, |ui| {
-                ui.selectable_value(&mut e.line_spacing, 0.0, own.as_str());
-                for v in LINE_SPACINGS {
-                    ui.selectable_value(&mut e.line_spacing, v, number(v));
-                }
-            });
+            let spacing_resp = craft_ui::ComboBox::from_id_salt("format-line-spacing")
+                .selected_text(shown)
+                .width(half)
+                .show_ui(ui, |ui| {
+                    ui.selectable_value(&mut e.line_spacing, 0.0, own.as_str());
+                    for v in LINE_SPACINGS {
+                        ui.selectable_value(&mut e.line_spacing, v, number(v));
+                    }
+                })
+                .response;
+            spacing_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::ComboBox, ui.is_enabled(), tl!("Line spacing")));
             ui.add_space(8.0);
             ui.add_enabled_ui(false, |ui| {
                 labelled_icon(ui, t, "pilcrow", tl!("Paragraph spacing"));
@@ -290,7 +366,8 @@ pub(crate) fn panel(
         number_with_presets(ui, spacing, &CHAR_SPACINGS, half, (label.id, tl!("Character spacing")));
     });
 
-    out.changed = (look.clone(), extras.as_deref().copied()) != before;
+    out.size_committed = size_committed;
+    out.changed = out.changed || size_committed || (look.clone(), extras.as_deref().copied()) != before;
     ui.add_space(6.0);
     ui.separator();
     out
@@ -351,7 +428,8 @@ fn number_with_presets(ui: &mut egui::Ui, n: Number<'_>, presets: &[f64], width:
         ui.spacing_mut().item_spacing.x = 2.0;
         let field = egui::DragValue::new(&mut *n.value).range(n.range).speed(n.speed).max_decimals(2).suffix(n.suffix);
         let height = ui.spacing().interact_size.y;
-        ui.add_sized([(width - PRESET_LIST - 2.0).max(30.0), height], field).labelled_by(label.0);
+        let drag_resp = ui.add_sized([(width - PRESET_LIST - 2.0).max(30.0), height], field).labelled_by(label.0);
+        drag_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::SpinButton, ui.is_enabled(), label.1));
         let list = icons::button(ui, "chevron-down", PRESET_LIST, false, label.1);
         egui::Popup::menu(&list).show(|ui| {
             for &v in presets {
@@ -378,31 +456,50 @@ fn colour_button(ui: &mut egui::Ui, t: &Tokens, color: [f64; 3]) -> egui::Respon
 
 /// Commit a typed size once (Enter or leaving the field), rather than one undo step per key.
 /// The bounds match AddedText validation, so the panel also accepts coloured text below 8 pt.
-fn font_size_input(ui: &mut egui::Ui, size: &mut f64) {
+fn font_size_input(ui: &mut egui::Ui, size: &mut f64, mixed: bool) -> bool {
+    let mut committed = false;
     ui.scope(|ui| {
         ui.spacing_mut().item_spacing.x = 2.0;
         let id = ui.make_persistent_id("font-size-input");
-        let (previous, mut text) = ui.data(|d| d.get_temp::<(u64, String)>(id)).unwrap_or_else(|| (size.to_bits(), size.to_string()));
-        if previous != size.to_bits() {
-            text = size.to_string();
+        let initial_text = || {
+            if mixed || *size <= 0.0 { tl!("Mixed").to_string() } else { size.to_string() }
+        };
+        // A selection can become mixed without changing its representative numeric size.
+        let (previous, previous_mixed, mut text) =
+            ui.data(|d| d.get_temp::<(u64, bool, String)>(id)).unwrap_or_else(|| (size.to_bits(), mixed, initial_text()));
+        if previous != size.to_bits() || previous_mixed != mixed {
+            text = initial_text();
         }
-        let field = egui::TextEdit::singleline(&mut text).id(id).desired_width(40.0);
-        let response = ui.add_sized([40.0, ui.spacing().interact_size.y], field).accessible_name(tl!("Font size:"));
+        // Reserve the localized mixed label, field margins and caret without resizing while typing.
+        let font = egui::TextStyle::Body.resolve(ui.style());
+        let margin = egui::Margin::from(ui.spacing().button_padding);
+        let mixed_width = ui.painter().layout_no_wrap(tl!("Mixed").into(), font.clone(), ui.visuals().text_color()).size().x;
+        let width = (mixed_width + margin.sum().x + 2.0).ceil().max(40.0);
+        let field = egui::TextEdit::singleline(&mut text).id(id).font(font).margin(margin).desired_width(width);
+        let response = ui.add_sized([width, ui.spacing().interact_size.y], field).accessible_name(tl!("Font size:"));
         let cancel = (response.has_focus() || response.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Escape));
         if cancel {
-            text = size.to_string();
+            text = initial_text();
             response.surrender_focus();
         } else if response.lost_focus() || (response.has_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter))) {
             if let Some(value) = typed_font_size(&text) {
+                if mixed || *size != value {
+                    committed = true;
+                }
                 *size = value;
+                text = size.to_string();
+            } else {
+                text = initial_text();
             }
-            text = size.to_string();
         }
         let before = *size;
         let list = icons::button(ui, "chevron-down", PRESET_LIST, false, tl!("Font size"));
         egui::Popup::menu(&list).show(|ui| {
             for value in SIZES {
                 if ui.selectable_label(*size == value, format!("{value} pt")).clicked() {
+                    if mixed || *size != value {
+                        committed = true;
+                    }
                     *size = value;
                     ui.close();
                 }
@@ -411,8 +508,9 @@ fn font_size_input(ui: &mut egui::Ui, size: &mut f64) {
         if *size != before {
             text = size.to_string();
         }
-        ui.data_mut(|d| d.insert_temp(id, (size.to_bits(), text)));
+        ui.data_mut(|d| d.insert_temp(id, (size.to_bits(), mixed, text)));
     });
+    committed
 }
 
 fn typed_font_size(text: &str) -> Option<f64> {
@@ -447,12 +545,87 @@ mod typed_size_tests {
         }
     }
 
+    #[test]
+    fn mixed_size_label_fits_the_themed_panel() {
+        crate::i18n::set_current(crate::i18n::Lang::EN);
+        let mut ready = false;
+        let mut h = egui_kittest::Harness::builder().with_size(vec2(272.0, 500.0)).with_accessibility_check(false).build_ui_state(
+            move |ui, look: &mut AddedText| {
+                if !ready {
+                    egui_extras::install_image_loaders(ui.ctx());
+                    crate::theme::install_fonts(ui.ctx());
+                    crate::theme::apply(ui.ctx(), crate::theme::ThemeKind::Light);
+                    ready = true;
+                    return;
+                }
+                let fonts = Fonts { sources: Some(&[]), shown: tl!("Mixed").into(), mixed_size: true };
+                panel(ui, &Tokens::get(ui.ctx()), look, None, fonts, None);
+            },
+            AddedText::default(),
+        );
+        h.run_steps(4);
+        let field = h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Font size:");
+        let style = h.ctx.global_style();
+        let font = egui::TextStyle::Body.resolve(&style);
+        let width = h.ctx.fonts_mut(|fonts| fonts.layout_no_wrap(tl!("Mixed").into(), font, Color32::BLACK).size().x);
+        let padding = 2.0 * style.spacing.button_padding.x;
+        assert!(field.rect().width() - padding >= width, "Mixed must fit inside the input margins");
+        assert!(h.get_by_label("Alignment").rect().right() <= 272.0, "the wider size field must leave room for the rest of the format row");
+        if let Ok(path) = std::env::var("PDFCRAFT_MIXED_PANEL_SHOT") {
+            h.render().unwrap().save(path).unwrap();
+        }
+    }
+
+    #[test]
+    fn mixed_size_changes_refresh_the_field_without_discarding_a_draft() {
+        let mut h = egui_kittest::Harness::new_ui_state(
+            |ui, state: &mut (f64, bool, usize)| {
+                if font_size_input(ui, &mut state.0, state.1) {
+                    state.1 = false;
+                    state.2 += 1;
+                }
+            },
+            (12.0, false, 0),
+        );
+        h.run();
+        let field =
+            |h: &egui_kittest::Harness<'_, (f64, bool, usize)>| h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Font size:").value();
+        assert_eq!(field(&h).as_deref(), Some("12"));
+        h.state_mut().0 = 24.0;
+        h.run_steps(2);
+        assert_eq!(field(&h).as_deref(), Some("24"), "the heading selection updates the size");
+        h.state_mut().1 = true;
+        h.run_steps(2);
+        assert_eq!(field(&h).as_deref(), Some("Mixed"), "collapsing to a mixed block must refresh even when its representative size stays 24");
+        if let Ok(path) = std::env::var("PDFCRAFT_MIXED_SIZE_SHOT") {
+            h.render().unwrap().save(path).unwrap();
+        }
+        h.state_mut().1 = false;
+        h.run_steps(2);
+        assert_eq!(field(&h).as_deref(), Some("24"), "selecting the heading again clears Mixed without a numeric change");
+        h.state_mut().1 = true;
+        h.run_steps(2);
+        h.get_by_role_and_label(egui::accesskit::Role::TextInput, "Font size:").click();
+        h.run();
+        h.event(egui::Event::Key { key: egui::Key::A, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND });
+        h.event(egui::Event::Text("1".into()));
+        h.run_steps(3);
+        assert_eq!(field(&h).as_deref(), Some("1"), "an unchanged mixed style must preserve the draft");
+        h.event(egui::Event::Text("8".into()));
+        h.run_steps(3);
+        assert_eq!(field(&h).as_deref(), Some("18"));
+        assert_eq!(*h.state(), (24.0, true, 0), "typing does not apply a formatting change");
+        h.event(egui::Event::Key { key: egui::Key::Enter, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE });
+        h.run_steps(2);
+        assert_eq!(*h.state(), (18.0, false, 1));
+    }
+
     #[test]
     fn typed_size_commits_once_and_invalid_input_preserves_the_style() {
         let mut h = egui_kittest::Harness::new_ui_state(
             |ui, state: &mut (f64, usize)| {
                 let before = state.0;
-                ui.horizontal(|ui| font_size_input(ui, &mut state.0));
+                ui.horizontal(|ui| font_size_input(ui, &mut state.0, false));
                 if state.0 != before {
                     state.1 += 1;
                 }
@@ -481,7 +654,7 @@ mod typed_size_tests {
         let mut h = egui_kittest::Harness::new_ui_state(
             |ui, state: &mut (f64, usize)| {
                 let before = state.0;
-                ui.horizontal(|ui| font_size_input(ui, &mut state.0));
+                ui.horizontal(|ui| font_size_input(ui, &mut state.0, false));
                 let _ = ui.button("Other control");
                 if state.0 != before {
                     state.1 += 1;
diff --git a/crates/ui-egui/src/panels/tools.rs b/crates/ui-egui/src/panels/tools.rs
index 9d106e38b3..73326fe571 100644
--- a/crates/ui-egui/src/panels/tools.rs
+++ b/crates/ui-egui/src/panels/tools.rs
@@ -78,7 +78,10 @@ fn all_tools(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
         ui.add_space(2.0);
         let shown = if app.all_tools_expanded { TOOL_GROUPS.len() } else { COLLAPSED_TOOLS.min(TOOL_GROUPS.len()) };
         for g in &TOOL_GROUPS[..shown] {
-            if tool_row(ui, t, g).clicked() {
+            let (resp, pin_clicked) = tool_row(ui, t, g, app.is_tool_pinned(g.id));
+            if pin_clicked {
+                app.toggle_pin_tool(g.id);
+            } else if resp.clicked() {
                 app.select_tool(g.id);
             }
         }
@@ -110,21 +113,29 @@ pub(super) fn row_label(ui: &mut egui::Ui, text: &str, font: egui::FontId, color
 }
 
 /// Draw one tool-group row with its icon, label, badge and availability hint.
-fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
+fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup, is_pinned: bool) -> (egui::Response, bool) {
     let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), Sense::click());
     resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tl!(g.label)));
     let press = theme::Press::track(ui, &resp);
     press.wash(ui, rect, 6, false);
     let body = rect.translate(press.offset());
     icons::paint(ui, Rect::from_min_size(body.min + vec2(6.0, 7.0), vec2(20.0, 20.0)), g.icon, 19.0, hue(g));
-    let right_reserved = match (g.badge, g.availability) {
-        (Some(b), _) => ui.fonts_mut(|f| f.layout_no_wrap(tl!(b).to_owned(), theme::semibold(9.5), Color32::WHITE).size().x) + 26.0,
+
+    let pin_rect = Rect::from_center_size(body.right_center() - vec2(14.0, 0.0), vec2(22.0, 22.0));
+    let pin_resp = ui.interact(pin_rect, ui.scope_id().with(("pin_toggle_row", g.id)), Sense::click());
+    let pin_hovered = pin_resp.hovered();
+    let mut pin_clicked = false;
+
+    let pin_space = 26.0;
+    let badge_or_hint_reserved = match (g.badge, g.availability) {
+        (Some(b), _) => ui.fonts_mut(|f| f.layout_no_wrap(tl!(b).to_owned(), theme::semibold(9.5), Color32::WHITE).size().x) + 18.0,
         (None, Availability::Planned(m)) if resp.hovered() => {
             let hint = format!("{} · {m}", tl!("Planned"));
-            ui.fonts_mut(|f| f.layout_no_wrap(hint, theme::medium(10.5), t.text_faint).size().x) + 18.0
+            ui.fonts_mut(|f| f.layout_no_wrap(hint, theme::medium(10.5), t.text_faint).size().x) + 10.0
         }
-        _ => 8.0,
+        _ => 0.0,
     };
+    let right_reserved = pin_space + badge_or_hint_reserved + 8.0;
     let clipped =
         row_label(ui, tl!(g.label), theme::regular(13.5), t.text, body.left_center() + vec2(36.0, 0.0), rect.width() - 36.0 - right_reserved);
     match (g.badge, g.availability) {
@@ -132,14 +143,14 @@ fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
             let font = theme::semibold(9.5);
             let badge = tl!(b);
             let w = ui.fonts_mut(|f| f.layout_no_wrap(badge.to_string(), font.clone(), Color32::WHITE).size().x);
-            let r = Rect::from_center_size(body.right_center() - vec2(w / 2.0 + 10.0, 0.0), vec2(w + 10.0, 16.0));
+            let r = Rect::from_center_size(body.right_center() - vec2(pin_space + w / 2.0 + 4.0, 0.0), vec2(w + 10.0, 16.0));
             ui.painter().rect_filled(r, CornerRadius::same(4), t.badge_new);
             ui.painter().text(r.center(), Align2::CENTER_CENTER, badge, font, Color32::WHITE);
         }
         // Planned tools: a quiet milestone hint instead of a chip, so the list stays calm.
         (None, Availability::Planned(m)) if resp.hovered() => {
             ui.painter().text(
-                body.right_center() - vec2(10.0, 0.0),
+                body.right_center() - vec2(pin_space + 4.0, 0.0),
                 Align2::RIGHT_CENTER,
                 format!("{} · {m}", tl!("Planned")),
                 theme::medium(10.5),
@@ -148,13 +159,34 @@ fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
         }
         _ => {}
     }
+
+    let row_hovered = ui.rect_contains_pointer(rect) || resp.hovered();
+    if is_pinned || row_hovered || pin_hovered {
+        if pin_hovered {
+            ui.painter().rect_filled(pin_rect, CornerRadius::same(4), t.pressed);
+        }
+        let pin_tint = if is_pinned {
+            t.accent_text
+        } else if pin_hovered {
+            t.text
+        } else {
+            t.text_faint
+        };
+        icons::paint(ui, pin_rect.shrink(3.0), "pin", 15.0, pin_tint);
+        let tip = if is_pinned { tl!("Unpin from Home") } else { tl!("Pin to Home") };
+        pin_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, true, tip));
+        if theme::hand(pin_resp).on_hover_text(tip).clicked() {
+            pin_clicked = true;
+        }
+    }
+
     let tip = match g.availability {
         Availability::Ready => tl!("Available").to_string(),
         Availability::Planned(m) => format!("{} {m} — {}", tl!("Planned for milestone"), tl!("open to see what it will include")),
         Availability::Provider => tl!("Optional: needs an AI provider you configure").into(),
     };
     let tip = if clipped { format!("{} — {tip}", tl!(g.label)) } else { tip };
-    theme::hand(resp).on_hover_text(tip)
+    (theme::hand(resp).on_hover_text(tip), pin_clicked)
 }
 
 /// Draw the detail view for one tool group, dispatching its commands and tool-specific panels.
diff --git a/crates/ui-egui/src/persist.rs b/crates/ui-egui/src/persist.rs
index bb29efeff2..32a8ec048d 100644
--- a/crates/ui-egui/src/persist.rs
+++ b/crates/ui-egui/src/persist.rs
@@ -1,5 +1,6 @@
 pub mod last_session;
 pub mod last_view;
+pub mod paper;
 pub(super) mod recovery;
 pub mod units;
 #[cfg(not(target_arch = "wasm32"))]
diff --git a/crates/ui-egui/src/persist/last_session.rs b/crates/ui-egui/src/persist/last_session.rs
index 7bc4833c0a..b46de0de7a 100644
--- a/crates/ui-egui/src/persist/last_session.rs
+++ b/crates/ui-egui/src/persist/last_session.rs
@@ -98,7 +98,7 @@ impl PdfCraftApp {
     /// the Recovery dialog offers, so neither opens twice.
     ///
     /// Only one password prompt can wait at a time: the first encrypted file asks for its
-    /// password and later ones stay closed (they are in the recent-files list).
+    /// password and later ones stay closed (in the recent-files list, if there is one).
     pub fn reopen_last_files(&mut self, skip: &[String]) {
         let last = std::mem::take(&mut self.last_session);
         #[cfg(not(target_arch = "wasm32"))]
diff --git a/crates/ui-egui/src/persist/paper.rs b/crates/ui-egui/src/persist/paper.rs
new file mode 100644
index 0000000000..2aeb8fceb3
--- /dev/null
+++ b/crates/ui-egui/src/persist/paper.rs
@@ -0,0 +1,150 @@
+//! The paper size the system's region prints on: the size of a new blank document (Create ▸
+//! Blank page).
+
+use super::units::region_of;
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Paper {
+    #[default]
+    Letter,
+    A4,
+}
+
+impl Paper {
+    /// Width and height in points, portrait.
+    pub fn points(self) -> (f64, f64) {
+        match self {
+            Paper::Letter => (612.0, 792.0),
+            Paper::A4 => (595.28, 841.89),
+        }
+    }
+
+    /// The system region's paper: US Letter in the Americas that use it, A4 everywhere else;
+    /// Letter when the region can't be told, as before the region was read.
+    pub fn system() -> Paper {
+        static SYSTEM: std::sync::OnceLock<Paper> = std::sync::OnceLock::new();
+        *SYSTEM.get_or_init(|| detect().unwrap_or_default())
+    }
+}
+
+/// The paper for a locale tag's region (`en_US.UTF-8`, `fr-BE`, `es_MX`); `None` without a region.
+/// The Letter regions are CLDR's `paperSize` US-Letter territories.
+pub(crate) fn paper_for_tag(tag: &str) -> Option<Paper> {
+    Some(match region_of(tag)?.as_str() {
+        "US" | "CA" | "MX" | "PH" | "PR" | "BZ" | "CL" | "CO" | "CR" | "GT" | "NI" | "PA" | "SV" | "VE" => Paper::Letter,
+        _ => Paper::A4,
+    })
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn detect() -> Option<Paper> {
+    // A Finder-started app gets no LANG, so the system locale's region decides first.
+    #[cfg(target_os = "macos")]
+    if let Ok(out) = std::process::Command::new("/usr/bin/defaults").args(["read", "-g", "AppleLocale"]).output()
+        && out.status.success()
+        && let Some(paper) = paper_for_tag(String::from_utf8_lossy(&out.stdout).trim())
+    {
+        return Some(paper);
+    }
+    // Region ▸ the paper size Windows keeps per user, read in-process like the measurement system.
+    #[cfg(target_os = "windows")]
+    if let Some(paper) = windows_paper().and_then(|v| paper_for_ipapersize(&v)) {
+        return Some(paper);
+    }
+    paper_for_tag(&locale_for_paper(|var| std::env::var(var).ok())?)
+}
+
+/// The locale that decides the paper, as POSIX picks it: the first of `LC_ALL`, `LC_PAPER` and
+/// `LANG` that is set and not empty, read through `var`. A later one never stands in for it, so
+/// `LC_ALL=C` with `LANG=de_DE` has no paper from the locale (CodeRabbit on #5651).
+#[cfg(any(test, not(target_arch = "wasm32")))]
+pub(crate) fn locale_for_paper(var: impl Fn(&str) -> Option<String>) -> Option<String> {
+    ["LC_ALL", "LC_PAPER", "LANG"].iter().find_map(|name| var(name).filter(|v| !v.is_empty()))
+}
+
+/// The paper for the Windows `iPaperSize` value (a `DMPAPER` number): "1" Letter, "9" A4. `None`
+/// for anything else, so another size falls through to the locale check.
+#[cfg(any(test, target_os = "windows"))]
+pub(crate) fn paper_for_ipapersize(value: &str) -> Option<Paper> {
+    match value.trim() {
+        "1" => Some(Paper::Letter),
+        "9" => Some(Paper::A4),
+        _ => None,
+    }
+}
+
+/// `HKCU\Control Panel\International\iPaperSize` as text; `None` when it is missing, unreadable
+/// or not a string.
+#[cfg(target_os = "windows")]
+fn windows_paper() -> Option<String> {
+    use winsafe::{HKEY, RegistryValue, co::RRF};
+    match HKEY::CURRENT_USER.RegGetValue(Some("Control Panel\\International"), Some("iPaperSize"), RRF::RT_REG_SZ).ok()? {
+        RegistryValue::Sz(v) => Some(v),
+        _ => None,
+    }
+}
+
+#[cfg(target_arch = "wasm32")]
+fn detect() -> Option<Paper> {
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Paper, locale_for_paper, paper_for_ipapersize, paper_for_tag};
+
+    #[test]
+    fn region_decides_the_paper() {
+        assert_eq!(paper_for_tag("en_US.UTF-8"), Some(Paper::Letter));
+        assert_eq!(paper_for_tag("fr_CA"), Some(Paper::Letter));
+        assert_eq!(paper_for_tag("es-MX"), Some(Paper::Letter));
+        assert_eq!(paper_for_tag("fr_BE.UTF-8"), Some(Paper::A4));
+        assert_eq!(paper_for_tag("en_GB@euro"), Some(Paper::A4));
+        assert_eq!(paper_for_tag("de-DE"), Some(Paper::A4));
+        assert_eq!(paper_for_tag("zh-Hans-CN"), Some(Paper::A4));
+        assert_eq!(paper_for_tag("C"), None);
+        assert_eq!(paper_for_tag("en"), None);
+        assert_eq!(paper_for_tag(""), None);
+        // A BCP 47 extension is not the region (CodeRabbit on #5651): `nu` is a key, not Niue.
+        assert_eq!(paper_for_tag("en-US-u-nu-latn"), Some(Paper::Letter));
+        assert_eq!(paper_for_tag("de-DE-u-rg-uszzzz"), Some(Paper::A4));
+        assert_eq!(paper_for_tag("en-x-us"), None);
+    }
+
+    /// POSIX precedence (CodeRabbit on #5651): the first locale variable that is set decides, even
+    /// when it has no region; an empty one is not set.
+    #[test]
+    fn the_first_locale_variable_set_decides() {
+        let env =
+            |pairs: &'static [(&'static str, &'static str)]| move |name: &str| pairs.iter().find(|(k, _)| *k == name).map(|(_, v)| v.to_string());
+        assert_eq!(locale_for_paper(env(&[("LC_ALL", "C"), ("LANG", "de_DE.UTF-8")])).as_deref(), Some("C"));
+        assert_eq!(locale_for_paper(env(&[("LC_ALL", ""), ("LC_PAPER", "en_US"), ("LANG", "de_DE")])).as_deref(), Some("en_US"));
+        assert_eq!(locale_for_paper(env(&[("LANG", "fr_FR")])).as_deref(), Some("fr_FR"));
+        assert_eq!(locale_for_paper(env(&[])), None);
+        assert_eq!(locale_for_paper(env(&[("LC_ALL", "C.UTF-8"), ("LANG", "de_DE")])).and_then(|t| paper_for_tag(&t)), None);
+    }
+
+    #[test]
+    fn windows_paper_size_decides_the_paper() {
+        assert_eq!(paper_for_ipapersize("1"), Some(Paper::Letter));
+        assert_eq!(paper_for_ipapersize(" 9\r\n"), Some(Paper::A4));
+        assert_eq!(paper_for_ipapersize("5"), None);
+        assert_eq!(paper_for_ipapersize(""), None);
+    }
+
+    /// The registry read works in-process and gives a value the mapping understands, or nothing.
+    #[cfg(target_os = "windows")]
+    #[test]
+    fn windows_reads_ipapersize_in_process() {
+        if let Some(v) = super::windows_paper() {
+            assert!(v.trim().parse::<u32>().is_ok(), "unexpected iPaperSize {v:?}");
+        }
+    }
+
+    #[test]
+    fn a4_and_letter_in_points() {
+        assert_eq!(Paper::Letter.points(), (612.0, 792.0));
+        let (w, h) = Paper::A4.points();
+        assert_eq!(((w * 25.4 / 72.0).round(), (h * 25.4 / 72.0).round()), (210.0, 297.0));
+    }
+}
diff --git a/crates/ui-egui/src/persist/units.rs b/crates/ui-egui/src/persist/units.rs
index a345456fab..147c502513 100644
--- a/crates/ui-egui/src/persist/units.rs
+++ b/crates/ui-egui/src/persist/units.rs
@@ -69,14 +69,22 @@ impl Unit {
 /// The unit for a locale tag's region: `en_US.UTF-8`, `en-US`, `bg-BG`, `zh-Hans-CN`, `en_GB@euro`.
 /// `None` without a region (`C`, `POSIX`, `en`).
 pub(crate) fn unit_for_tag(tag: &str) -> Option<Unit> {
-    let tag = tag.split(['.', '@']).next().unwrap_or_default();
-    let region = tag.split(['-', '_']).skip(1).filter(|p| p.len() == 2 && p.chars().all(|c| c.is_ascii_alphabetic())).last()?;
-    Some(match region.to_ascii_uppercase().as_str() {
+    Some(match region_of(tag)?.as_str() {
         "US" | "LR" | "MM" => Unit::Inches,
         _ => Unit::Millimetres,
     })
 }
 
+/// The upper-case two-letter region of a locale tag; `None` without one (`C`, `POSIX`, `en`).
+/// Only the base tag counts: a BCP 47 extension or private use part (`-u-nu-latn`, `-x-…`, each
+/// after a one-letter singleton) is not a region (CodeRabbit on #5651).
+pub(crate) fn region_of(tag: &str) -> Option<String> {
+    let tag = tag.split(['.', '@']).next().unwrap_or_default();
+    let region =
+        tag.split(['-', '_']).skip(1).take_while(|p| p.len() != 1).filter(|p| p.len() == 2 && p.chars().all(|c| c.is_ascii_alphabetic())).last()?;
+    Some(region.to_ascii_uppercase())
+}
+
 #[cfg(not(target_arch = "wasm32"))]
 fn detect() -> Option<Unit> {
     // The system's own measurement setting first: a terminal's LANG is often en_US whatever the region.
diff --git a/crates/ui-egui/src/platform/drag_pointer.rs b/crates/ui-egui/src/platform/drag_pointer.rs
index 05ef05c426..3074f7d851 100644
--- a/crates/ui-egui/src/platform/drag_pointer.rs
+++ b/crates/ui-egui/src/platform/drag_pointer.rs
@@ -1,6 +1,7 @@
-//! Where the pointer is while files are dragged over the window. The windowing layer reports
-//! that a file hovers, but not where, and sends no pointer moves until the drag ends; the
-//! system has to be asked.
+//! Where the pointer is when the windowing layer doesn't say: while files are dragged over the
+//! window (it reports that a file hovers, but not where, and sends no pointer moves until the drag
+//! ends), and when the wheel turns after switching back to the window (no move is sent until the
+//! mouse moves, #1518). The system has to be asked.
 
 /// The pointer in this window's coordinates (egui points), when the system can tell.
 #[cfg(target_os = "macos")]
@@ -38,3 +39,65 @@ pub(crate) fn in_window(ctx: &egui::Context) -> Option<egui::Pos2> {
 pub(crate) fn in_window(_ctx: &egui::Context) -> Option<egui::Pos2> {
     None
 }
+
+/// Wheel input with no known pointer: after Alt+Tab back to the window, the windowing layer sends
+/// no pointer move until the mouse moves, so egui doesn't know what is under the pointer and the
+/// wheel scrolls nothing (#1518). When `raw` turns the wheel, has no pointer move of its own and
+/// egui knows no pointer position (`known`), the pointer from `system` is put first, if it is
+/// inside the window's `size` (egui points).
+pub(crate) fn locate_wheel(raw: &mut egui::RawInput, known: bool, size: egui::Vec2, system: impl FnOnce() -> Option<egui::Pos2>) {
+    let wheel = raw.events.iter().any(|e| matches!(e, egui::Event::MouseWheel { .. }));
+    let moved = raw.events.iter().any(|e| matches!(e, egui::Event::PointerMoved(_) | egui::Event::PointerGone));
+    if !wheel || moved || known {
+        return;
+    }
+    if let Some(pos) = system().filter(|p| egui::Rect::from_min_size(egui::Pos2::ZERO, size).contains(*p)) {
+        raw.events.insert(0, egui::Event::PointerMoved(pos));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn wheel() -> egui::Event {
+        egui::Event::MouseWheel {
+            unit: egui::MouseWheelUnit::Line,
+            delta: egui::vec2(0.0, -1.0),
+            phase: egui::TouchPhase::Move,
+            modifiers: egui::Modifiers::NONE,
+            source: egui::MouseWheelSource::Unknown,
+        }
+    }
+
+    fn located(events: Vec<egui::Event>, known: bool, system: Option<egui::Pos2>) -> Vec<egui::Event> {
+        let mut raw = egui::RawInput { events, ..Default::default() };
+        locate_wheel(&mut raw, known, egui::vec2(800.0, 600.0), || system);
+        raw.events
+    }
+
+    #[test]
+    fn a_wheel_with_no_known_pointer_asks_the_system_where_it_is() {
+        let at = egui::pos2(300.0, 200.0);
+        // After Alt+Tab back: the wheel turns, nothing moved, egui knows no pointer.
+        assert_eq!(located(vec![wheel()], false, Some(at)), vec![egui::Event::PointerMoved(at), wheel()]);
+        // Otherwise nothing is added: egui knows the pointer, the frame moves it itself, there is
+        // no wheel, the system can't tell, or the pointer is outside the window.
+        assert_eq!(located(vec![wheel()], true, Some(at)), vec![wheel()]);
+        let moved = egui::Event::PointerMoved(egui::pos2(1.0, 1.0));
+        assert_eq!(located(vec![moved.clone(), wheel()], false, Some(at)), vec![moved, wheel()]);
+        assert_eq!(located(vec![egui::Event::PointerGone, wheel()], false, Some(at)), vec![egui::Event::PointerGone, wheel()]);
+        assert_eq!(
+            located(
+                vec![egui::Event::Key { key: egui::Key::A, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::NONE }],
+                false,
+                Some(at)
+            )
+            .len(),
+            1
+        );
+        assert_eq!(located(vec![wheel()], false, None), vec![wheel()]);
+        assert_eq!(located(vec![wheel()], false, Some(egui::pos2(900.0, 200.0))), vec![wheel()]);
+        assert_eq!(located(vec![wheel()], false, Some(egui::pos2(f32::NAN, 0.0))), vec![wheel()]);
+    }
+}
diff --git a/crates/ui-egui/src/platform/open_worker/tests.rs b/crates/ui-egui/src/platform/open_worker/tests.rs
index fe2a0ae410..c0fe2f03a2 100644
--- a/crates/ui-egui/src/platform/open_worker/tests.rs
+++ b/crates/ui-egui/src/platform/open_worker/tests.rs
@@ -733,6 +733,146 @@ fn startup_files_wait_for_absolute_link_consent_and_preparation() {
     let _ = std::fs::remove_file(path);
 }
 
+#[test]
+fn launch_layout_waits_for_cli_opens_and_preserves_restored_tabs() {
+    use crate::canvas::PageLayout;
+    // Controlled worker replies exercise both completion orders without scheduling races.
+    for reverse in [false, true] {
+        for count in [1, 2] {
+            for restored in [false, true] {
+                let mut app = PdfCraftApp::new();
+                app.set_option("default-layout", "continuous").unwrap();
+                if restored {
+                    app.open_bytes("restored.pdf", None, fixture(1)).unwrap();
+                }
+                let offset = usize::from(restored);
+                let mut replies = Vec::new();
+                for token in 0..count {
+                    let name = format!("cli-{token}.pdf");
+                    let bytes = Arc::new(fixture(2));
+                    let prepared = app.session.prepare_open(&name, None, bytes.clone(), None);
+                    let (sender, receiver) = std::sync::mpsc::channel();
+                    app.pending_opens.push(crate::PendingOpen {
+                        token,
+                        receiver,
+                        name,
+                        path: None,
+                        stamp: None,
+                        activate: true,
+                        after_open: None,
+                        recovered: None,
+                        then: None,
+                        display_override: Some((PageLayout::TwoUp, false)),
+                    });
+                    replies.push((
+                        sender,
+                        open_worker::ResultMessage { token, kind: open_worker::ResultKind::Prepared { bytes, result: Box::new(prepared) } },
+                    ));
+                }
+                app.set_launch_layout("single").unwrap();
+                if restored {
+                    assert!(app.views[0].continuous(), "pending --layout must not target the restored tab");
+                }
+                if reverse {
+                    replies.reverse();
+                }
+                for (index, (sender, reply)) in replies.into_iter().enumerate() {
+                    let name = format!("cli-{}.pdf", reply.token);
+                    sender.send(reply).unwrap();
+                    app.poll_pending_opens();
+                    let view = &app.views[index + offset];
+                    assert_eq!(view.layout, if index + 1 == count as usize { PageLayout::Single } else { PageLayout::TwoUp });
+                    assert!(!view.continuous());
+                    assert_eq!(app.session.get(view.id).unwrap().name, name);
+                }
+                assert_eq!(app.active, Some(count as usize + offset - 1));
+                if restored {
+                    assert_eq!(app.views[0].layout, PageLayout::Single);
+                    assert!(app.views[0].continuous());
+                }
+                assert_eq!(app.view_defaults.layout, PageLayout::Single);
+                assert!(app.view_defaults.continuous);
+                assert_eq!(serde_json::from_str::<Value>(&app.persist()).unwrap()["default_layout"], "continuous");
+                // Ordinary later opens cannot inherit either launch override.
+                app.open_bytes("later.pdf", None, fixture(1)).unwrap();
+                assert!(app.views.last().unwrap().continuous());
+            }
+        }
+    }
+}
+
+#[test]
+fn launch_layout_failed_or_cancelled_opens_do_not_target_existing_documents() {
+    use crate::canvas::PageLayout;
+    for cancel in [false, true] {
+        let mut app = PdfCraftApp::new();
+        app.set_option("default-layout", "continuous").unwrap();
+        app.open_bytes("restored.pdf", None, fixture(1)).unwrap();
+        let (sender, receiver) = std::sync::mpsc::channel();
+        app.pending_opens.push(crate::PendingOpen {
+            token: 0,
+            receiver,
+            name: "cli.pdf".into(),
+            path: None,
+            stamp: None,
+            activate: true,
+            after_open: None,
+            recovered: None,
+            then: None,
+            display_override: Some((PageLayout::TwoUp, false)),
+        });
+        app.set_launch_layout("single").unwrap();
+        assert!(app.set_launch_layout("invalid").is_err());
+        let kind = if cancel {
+            open_worker::ResultKind::Prepared { bytes: Arc::new(fixture(1)), result: Box::new(Err(pdfcraft_render::OpenError::NeedsPassword)) }
+        } else {
+            open_worker::ResultKind::ReadFailed("synthetic read failure".into())
+        };
+        sender.send(open_worker::ResultMessage { token: 0, kind }).unwrap();
+        app.poll_pending_opens();
+        if cancel {
+            app.submit_password(None);
+        }
+        assert!(app.launch_layout.is_none());
+        assert_eq!(app.views.len(), 1);
+        assert!(app.views[0].continuous());
+        app.open_bytes("later.pdf", None, fixture(1)).unwrap();
+        assert!(app.views[1].continuous());
+    }
+}
+
+#[test]
+fn flagged_startup_opens_wait_for_password_ownership_before_the_first_frame() {
+    use crate::canvas::PageLayout;
+    let locked = tool_open_file("launch-locked", "pdf", &encrypted_tool_fixture());
+    let second = tool_open_file("launch-second", "pdf", &fixture(2));
+    let mut app = PdfCraftApp::new();
+    app.set_option("default-layout", "continuous").unwrap();
+    app.open_path_with_display(locked.0.to_str().unwrap(), PageLayout::TwoUp, false);
+    let bytes = app.password_prompt.as_ref().unwrap().bytes.clone();
+    app.open_path_with_display(locked.0.to_str().unwrap(), PageLayout::TwoUp, false);
+    assert!(app.pending_opens.is_empty(), "repeating the locked file keeps its original prompt");
+    app.open_path_with_display(second.0.to_str().unwrap(), PageLayout::TwoUp, false);
+    assert_eq!(app.pending_opens.len(), 1);
+    assert!(Arc::ptr_eq(&app.password_prompt.as_ref().unwrap().bytes, &bytes));
+    app.set_launch_layout("single").unwrap();
+    app.submit_password(Some("wrong".into()));
+    assert!(app.password_prompt.as_ref().unwrap().error.is_some());
+    app.submit_password(Some("tool-password".into()));
+    assert_eq!(app.views.len(), 1);
+    assert_eq!(app.views[0].layout, PageLayout::TwoUp);
+    let deadline = std::time::Instant::now() + Duration::from_secs(5);
+    while !app.pending_opens.is_empty() {
+        assert!(std::time::Instant::now() < deadline);
+        app.poll_pending_opens();
+        std::thread::sleep(Duration::from_millis(5));
+    }
+    assert_eq!(app.views.len(), 2);
+    assert_eq!(app.views[1].layout, PageLayout::Single);
+    assert!(!app.views[1].continuous());
+    assert!(app.view_defaults.continuous);
+}
+
 /// #1928: a new file handed over by the OS (Finder, or another launch) raises the window at once,
 /// before it is prepared, and is the selected tab once it opens.
 #[test]
diff --git a/crates/ui-egui/src/platform/pickers.rs b/crates/ui-egui/src/platform/pickers.rs
index 92852e4897..80d44d975b 100644
--- a/crates/ui-egui/src/platform/pickers.rs
+++ b/crates/ui-egui/src/platform/pickers.rs
@@ -376,6 +376,7 @@ mod tests {
             after_open: None,
             recovered: None,
             then: None,
+            display_override: None,
         });
         let got = Arc::new(Mutex::new(Vec::new()));
         app.pickers.showing.store(true, Ordering::SeqCst);
diff --git a/crates/ui-egui/src/state.rs b/crates/ui-egui/src/state.rs
index 03df25f201..e3a9c540a6 100644
--- a/crates/ui-egui/src/state.rs
+++ b/crates/ui-egui/src/state.rs
@@ -186,6 +186,8 @@ pub enum Dialog {
     AuditSpace,
     /// Signatures ▸ Show certificate.
     CertificateViewer,
+    /// Pin tools to Home: selection modal.
+    PinTool,
 }
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -329,6 +331,8 @@ pub struct PasswordPrompt {
     pub(crate) then: Option<&'static str>,
     /// A link destination to apply after the linked PDF is unlocked.
     pub(crate) after_open: Option<pdfcraft_render::RemoteDestination>,
+    /// A launch-time display override, applied only after this PDF is unlocked.
+    pub(crate) display_override: Option<(canvas::PageLayout, bool)>,
 }
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -361,6 +365,11 @@ impl UnlockPrompt {
     }
 }
 
+/// How many recent files are kept until Preferences says otherwise.
+pub const RECENT_FILES_DEFAULT: usize = 12;
+/// The most Preferences can ask to keep.
+pub const RECENT_FILES_MAX: usize = 50;
+
 #[derive(serde::Serialize, serde::Deserialize)]
 pub struct RecentFile {
     pub name: String,
diff --git a/crates/ui-egui/src/tools/content_ui.rs b/crates/ui-egui/src/tools/content_ui.rs
index e28f20e232..f6d7574e25 100644
--- a/crates/ui-egui/src/tools/content_ui.rs
+++ b/crates/ui-egui/src/tools/content_ui.rs
@@ -315,7 +315,10 @@ fn on_page(added: &[Added], page: usize) -> Vec<(usize, &Added)> {
 }
 
 pub(crate) fn hits_added(xf: &PageXform, info: &DocInfo, page: usize, added: &[Added], point: Pos2) -> bool {
-    on_page(added, page).iter().any(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(point))
+    on_page(added, page)
+        .iter()
+        .filter(|(_, a)| matches!(a.content, AddedContent::Text(_)))
+        .any(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(point))
 }
 
 fn handles(r: Rect) -> [(Pos2, bool, bool); 4] {
@@ -355,7 +358,7 @@ pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, added: &[Added],
     if !xf.rect.contains(p) {
         return None;
     }
-    let items = on_page(added, page);
+    let items: Vec<(usize, &Added)> = on_page(added, page).into_iter().filter(|(_, a)| matches!(a.content, AddedContent::Text(_))).collect();
     let selected = view.content.selected.filter(|s| s.0 == page).and_then(|(_, si)| items.iter().find(|(i, _)| *i == si));
     if let Some((index, a)) = selected
         && let Some((_, left, top)) = handles(screen_rect(xf, info, page, a.content.rect())).into_iter().find(|(c, ..)| c.distance(p) <= 6.0)
@@ -390,11 +393,10 @@ pub(crate) fn page_input(
             let end = pointer.unwrap_or(start);
             if let Some((sp, si)) = cv.selected
                 && sp == page
-                && let Some((_, a)) = on_page(added, page).into_iter().find(|(i, _)| *i == si)
+                && let Some((_, a)) = on_page(added, page).into_iter().find(|(i, a)| *i == si && matches!(a.content, AddedContent::Text(_)))
                 && (end - start).length() >= 1.0
             {
-                let keep = matches!(a.content, AddedContent::Image(_));
-                let r = dragged(screen_rect(xf, info, page, a.content.rect()), grab, end - start, keep);
+                let r = dragged(screen_rect(xf, info, page, a.content.rect()), grab, end - start, false);
                 let (p0, p1) = (to_display(xf, info, page, r.left_bottom()), to_display(xf, info, page, r.right_top()));
                 let mut rect = [p0[0], p0[1], p1[0], p1[1]];
                 if let AddedContent::Text(t) = &a.content
@@ -409,7 +411,7 @@ pub(crate) fn page_input(
         return consumed;
     }
     let Some(p) = pointer.filter(|p| xf.rect.contains(*p)) else { return consumed };
-    let items = on_page(added, page);
+    let items: Vec<(usize, &Added)> = on_page(added, page).into_iter().filter(|(_, a)| matches!(a.content, AddedContent::Text(_))).collect();
     let hit = items.iter().rev().find(|(_, a)| screen_rect(xf, info, page, a.content.rect()).expand(2.0).contains(p)).map(|(i, a)| (*i, *a));
     let selected_rect = cv
         .selected
@@ -515,6 +517,9 @@ pub(crate) fn paint_page(
 ) {
     let cv = &view.content;
     for (i, a) in on_page(added, page) {
+        if matches!(a.content, AddedContent::Image(_)) {
+            continue;
+        }
         if cv.draft.as_ref().is_some_and(|d| d.page == page && d.index == Some(i)) {
             continue;
         }
@@ -537,9 +542,52 @@ pub(crate) fn paint_page(
     }
 }
 
+/// The image controller owns image selection; the added-content panel follows the same XObject.
+pub(crate) fn sync_image_selection(view: &mut DocView, page: usize, images: &[pdfcraft_engine::PageImage], added: &[Added]) {
+    let Some(selection) = view.image_selection.as_ref().filter(|selection| selection.page == page) else { return };
+    if view.content.draft.is_some() {
+        return;
+    }
+    let object = images
+        .get(selection.index)
+        .and_then(|image| image.object)
+        .filter(|object| images.iter().filter(|image| image.object == Some(*object)).count() == 1);
+    view.content.selected = object.and_then(|object| {
+        let mut matches = added
+            .iter()
+            .filter(|item| item.page == page)
+            .enumerate()
+            .filter(|(_, item)| matches!(&item.content, AddedContent::Image(image) if image.image == object));
+        let selected = matches.next().map(|(index, _)| (page, index));
+        if matches.next().is_none() { selected } else { None }
+    });
+    view.content.select_added = None;
+    view.content.grab = None;
+}
+
+/// Leaving the image controller cannot leave a hidden added image owning keyboard actions.
+pub(crate) fn release_image_selection(view: &mut DocView, added: &[Added]) {
+    if view.content.draft.is_some() {
+        return;
+    }
+    let image_selected = view.content.selected.is_some_and(|(page, index)| {
+        added.iter().filter(|item| item.page == page).nth(index).is_some_and(|item| matches!(item.content, AddedContent::Image(_)))
+    });
+    if image_selected {
+        view.content.selected = None;
+        view.content.select_added = None;
+        view.content.grab = None;
+    }
+}
+
 /// Delete removes the selected item; Escape clears the selection.
-pub(crate) fn keys(ctx: &egui::Context, view: &mut DocView) {
-    if view.content.selected.is_none() || view.content.draft.is_some() || ctx.egui_wants_keyboard_input() {
+pub(crate) fn keys(ctx: &egui::Context, view: &mut DocView, image_controller_active: bool) {
+    if image_controller_active && view.image_selection.is_some()
+        || matches!(view.pending_edit.as_ref(), Some(Edit::EditPageImage { .. }))
+        || view.content.selected.is_none()
+        || view.content.draft.is_some()
+        || ctx.egui_wants_keyboard_input()
+    {
         return;
     }
     let (del, esc) = ctx.input(|i| (i.key_pressed(egui::Key::Delete) || i.key_pressed(egui::Key::Backspace), i.key_pressed(egui::Key::Escape)));
@@ -899,7 +947,7 @@ impl crate::PdfCraftApp {
     }
 
     /// Copy Image: image `index` on `page`, at its own resolution, to the clipboard.
-    pub(crate) fn copy_page_image(&mut self, page: usize, index: usize) -> bool {
+    pub fn copy_page_image(&mut self, page: usize, index: usize) -> bool {
         // A newer copy wins over a whole-document copy still reading its pages.
         self.document_copy = None;
         let Some((_, id)) = self.active_ids() else { return false };
@@ -911,12 +959,13 @@ impl crate::PdfCraftApp {
             #[cfg(not(target_arch = "wasm32"))]
             if self.system_clipboard {
                 let img = arboard::ImageData { width: w as usize, height: h as usize, bytes: std::borrow::Cow::Borrowed(&rgba) };
-                arboard::Clipboard::new().and_then(|mut c| c.set_image(img)).map_err(|e| e.to_string())?;
+                crate::os_clipboard::with(|c| c.set_image(img)).map_err(|e| e.to_string())?;
             }
             #[cfg(target_arch = "wasm32")]
             if self.system_clipboard {
                 return Err("the web version can't put images on the clipboard yet; use Save Image As".to_string());
             }
+            self.last_copied_file = None;
             self.last_copied_image = Some((w, h, rgba));
             Ok((w, h))
         });
@@ -933,17 +982,26 @@ impl crate::PdfCraftApp {
     }
 
     /// The picture's visible box on its page, in user space.
-    fn page_image_box(&self, page: usize, index: usize) -> Option<[f64; 4]> {
+    pub(crate) fn page_image_box(&self, page: usize, index: usize) -> Option<[f64; 4]> {
         let (_, id) = self.active_ids()?;
         let image = self.session.get(id)?.page_images(page).into_iter().nth(index)?;
         Some(image.visible_rect.unwrap_or(image.rect))
     }
 
     /// Cut: copy the picture, and only when that worked take it off the page (one undo step).
-    pub(crate) fn cut_page_image(&mut self, page: usize, index: usize) {
-        if self.copy_page_image(page, index) {
-            self.apply_edit(Edit::EditPageImage { page, index, change: pdfcraft_engine::ImageEdit::Delete });
+    pub(crate) fn cut_page_image(&mut self, page: usize, index: usize) -> bool {
+        let Some((view, id)) = self.active_ids() else { return false };
+        if self.session.get(id).is_some_and(|doc| !doc.allows_modification()) {
+            self.notify_error(tl!("The document's security settings don't allow this change"));
+            return false;
         }
+        if !self.copy_page_image(page, index) || !self.apply_edit(Edit::EditPageImage { page, index, change: pdfcraft_engine::ImageEdit::Delete }) {
+            return false;
+        }
+        if let Some(view) = self.views.get_mut(view) {
+            view.image_selection = None;
+        }
+        true
     }
 
     /// Redact image: a redaction mark over the whole picture. It is applied, like any mark, from
@@ -1002,50 +1060,203 @@ impl crate::PdfCraftApp {
     pub fn add_image(&mut self, name: String, bytes: Vec<u8>) {
         let Some((i, id)) = self.active_ids() else { return };
         let page = self.views[i].current;
-        let before = self.session.get(id).map_or(0, |d| d.added().iter().filter(|a| a.page == page).count());
+        let before_img = self.session.get(id).map_or(0, |d| d.page_images(page).len());
+        let before_added = self.session.get(id).map_or(0, |d| d.added().iter().filter(|a| a.page == page).count());
         if self.apply_edit(Edit::AddImage { page, rect: None, name, bytes: std::sync::Arc::new(bytes) }) {
-            self.views[i].content.select_added = Some((page, before));
+            self.views[i].content.selected = Some((page, before_added));
+            self.views[i].content.select_added = Some((page, before_added));
+            self.views[i].image_selection = Some(crate::edit_text_ui::ImageSelection::at(page, before_img));
+            self.quick_tool = crate::QuickTool::EditText;
             self.left = crate::LeftPanel::Tool("edit");
             self.left_open = true;
         }
     }
 
-    /// Whether ⌘V / Ctrl+V was let go this frame. egui-winit swallows that press (with a Paste
-    /// event only if the clipboard holds text), while a plain V press always comes through: a
-    /// release of V with no press of V since the last one is the shortcut, even when ⌘ or Ctrl
-    /// was let go first. Read every frame, dialogs or not, so a press is never missed.
-    pub(crate) fn paste_key_released(&mut self, ctx: &egui::Context) -> bool {
-        let mut released = false;
-        ctx.input(|inp| {
-            for e in &inp.events {
-                if let egui::Event::Key { key: egui::Key::V, pressed, .. } = e {
-                    released |= !*pressed && !self.v_pressed;
-                    self.v_pressed = *pressed;
-                }
+    /// Whether there is an image in the in-memory clipboard or system clipboard ready to paste.
+    pub fn can_paste_image(&self) -> bool {
+        if let Some(crate::create_ui::Clip::Image { .. }) = self.clipboard_override.as_ref() {
+            return true;
+        }
+        if self.clipboard_override.is_some() {
+            return false;
+        }
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            if self.system_clipboard {
+                return matches!(crate::os_clipboard::for_image_paste(), Some(crate::create_ui::Clip::Image { .. }));
             }
-        });
-        released
+        }
+        self.last_copied_image.is_some() || self.last_copied_file.is_some()
     }
 
-    /// ⌘V / Ctrl+V with a picture on the system clipboard (a screenshot, a picture copied in a
-    /// browser) places it on the current page, as Add Image does.
-    /// Organize Pages keeps ⌘V for pages, Prepare Form for fields, and text fields for text.
-    pub(crate) fn paste_image_key(&mut self, i: usize, ctx: &egui::Context, pasted: bool) {
-        let free = self.dialog.is_none() && !self.palette_open && !ctx.egui_wants_keyboard_input();
-        let Some(view) = self.views.get(i) else { return };
-        if !pasted || !free || view.organize || view.forms.focus.is_some() || self.is_preparing() {
-            return;
+    /// Paste the integration's delivered pixels without rereading a clipboard that may have changed.
+    pub(crate) fn paste_received_image(&mut self, page: usize, image: &egui::ColorImage) -> bool {
+        let [width, height] = image.size;
+        let pixels = width.checked_mul(height);
+        let bytes = pixels.and_then(|n| n.checked_mul(4));
+        if width == 0
+            || height == 0
+            || width > crate::create_ui::MAX_IMAGE_SIDE
+            || height > crate::create_ui::MAX_IMAGE_SIDE
+            || pixels != Some(image.pixels.len())
+            || bytes.is_none_or(|n| n > crate::create_ui::MAX_IMAGE_BYTES)
+        {
+            self.notify_error("the clipboard image is empty, malformed or exceeds size limits");
+            return false;
         }
-        let clip = match self.clipboard_override.clone() {
-            Some(c) => Some(c),
-            #[cfg(not(target_arch = "wasm32"))]
-            None if self.system_clipboard => crate::create_ui::read_clipboard(),
-            None => None,
+        let rgba = image.pixels.iter().flat_map(egui::Color32::to_srgba_unmultiplied).collect();
+        let delivered = crate::create_ui::Clip::Image { width, height, rgba };
+        self.paste_image_with_system(page, None, None, None, false, Some(delivered))
+    }
+
+    /// Paste an image from the clipboard onto `page`.
+    pub fn paste_image(&mut self, page: usize, rect: Option<[f64; 4]>) -> bool {
+        self.paste_image_internal(page, rect, None)
+    }
+
+    /// Paste an image centered at context menu point `at: [f64; 2]` on `page`.
+    pub fn paste_image_at(&mut self, page: usize, at: [f64; 2]) -> bool {
+        self.paste_image_internal(page, None, Some(at))
+    }
+
+    fn paste_image_internal(&mut self, page: usize, rect: Option<[f64; 4]>, at: Option<[f64; 2]>) -> bool {
+        #[cfg(not(target_arch = "wasm32"))]
+        let system = if self.clipboard_override.is_none() && self.system_clipboard { crate::os_clipboard::for_image_paste() } else { None };
+        #[cfg(target_arch = "wasm32")]
+        let system = None;
+        self.paste_image_with_system(
+            page,
+            rect,
+            at,
+            system,
+            cfg!(not(target_arch = "wasm32")) && self.system_clipboard,
+            self.clipboard_override.clone(),
+        )
+    }
+
+    fn paste_image_with_system(
+        &mut self,
+        page: usize,
+        rect: Option<[f64; 4]>,
+        at: Option<[f64; 2]>,
+        system: Option<crate::create_ui::Clip>,
+        system_authoritative: bool,
+        clipboard: Option<crate::create_ui::Clip>,
+    ) -> bool {
+        let Some((i, id)) = self.active_ids() else {
+            return false;
         };
-        let Some(crate::create_ui::Clip::Image { width, height, rgba }) = clip else { return };
-        match crate::create_ui::png_from_rgba(width, height, &rgba) {
-            Ok(png) => self.add_image("Pasted image.png".into(), png),
-            Err(e) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", tl!("Clipboard")), ("e", &e)]),
+        if let Some(doc) = self.session.get(id)
+            && !doc.allows_modification()
+        {
+            self.notify_error(tl!("The document's security settings don't allow this change"));
+            return false;
+        }
+
+        let image_data: Option<(String, Vec<u8>)> = match clipboard {
+            Some(crate::create_ui::Clip::Image { width, height, rgba }) => {
+                let is_same = self
+                    .last_copied_image
+                    .as_ref()
+                    .is_some_and(|(w, h, bytes)| *w as usize == width && *h as usize == height && bytes.as_slice() == rgba.as_slice());
+                if !is_same {
+                    self.last_copied_file = None;
+                    self.last_copied_image = Some((width as u32, height as u32, rgba.clone()));
+                }
+                crate::create_ui::png_from_rgba(width, height, &rgba).ok().map(|b| ("pasted_image.png".to_string(), b))
+            }
+            Some(crate::create_ui::Clip::Text(_)) => None,
+            None => {
+                if matches!(system, Some(crate::create_ui::Clip::Text(_))) || (system_authoritative && system.is_none()) {
+                    self.last_copied_image = None;
+                    self.last_copied_file = None;
+                    self.notify_tr("No image on clipboard to paste");
+                    return false;
+                }
+                let sys_result = match system {
+                    Some(crate::create_ui::Clip::Image { width, height, rgba }) => Some((width, height, rgba)),
+                    _ => None,
+                };
+
+                if let Some((img_width, img_height, img_bytes)) = sys_result {
+                    let is_same_as_last = self
+                        .last_copied_image
+                        .as_ref()
+                        .is_some_and(|(w, h, rgba)| *w as usize == img_width && *h as usize == img_height && rgba.as_slice() == img_bytes.as_slice());
+                    if is_same_as_last && let Some((name, bytes)) = self.last_copied_file.clone() {
+                        Some((name, bytes))
+                    } else if is_same_as_last && let Some((w, h, rgba)) = self.last_copied_image.clone() {
+                        crate::create_ui::png_from_rgba(w as usize, h as usize, &rgba).ok().map(|b| ("pasted_image.png".to_string(), b))
+                    } else {
+                        // System clipboard has a newer / external image!
+                        self.last_copied_file = None;
+                        self.last_copied_image = Some((img_width as u32, img_height as u32, img_bytes.clone()));
+                        crate::create_ui::png_from_rgba(img_width, img_height, &img_bytes).ok().map(|b| ("clipboard_image.png".to_string(), b))
+                    }
+                } else if let Some((name, bytes)) = self.last_copied_file.clone() {
+                    Some((name, bytes))
+                } else if let Some((w, h, rgba)) = self.last_copied_image.clone() {
+                    crate::create_ui::png_from_rgba(w as usize, h as usize, &rgba).ok().map(|b| ("pasted_image.png".to_string(), b))
+                } else {
+                    None
+                }
+            }
+        };
+
+        let Some((name, bytes)) = image_data else {
+            self.notify_tr("No image on clipboard to paste");
+            return false;
+        };
+
+        let target_rect = if let Some(r) = rect {
+            Some(r)
+        } else if let Some(at) = at {
+            let (raw_w, raw_h) = self
+                .last_copied_image
+                .as_ref()
+                .map(|(w, h, _)| (*w as f64, *h as f64))
+                .or_else(|| {
+                    (bytes.len() <= 64_000_000 * 4).then(|| pdfcraft_engine::image_dimensions(&bytes)).flatten().map(|(w, h)| (w as f64, h as f64))
+                })
+                .unwrap_or((100.0, 100.0));
+            let (pw, ph) =
+                self.session.get(id).and_then(|d| d.info.pages.get(page)).map(|p| (p.width as f64, p.height as f64)).unwrap_or((612.0, 792.0));
+            let k = ((pw * 0.8) / raw_w.max(1.0)).min((ph * 0.8) / raw_h.max(1.0)).min(1.0);
+            let (w, h) = (raw_w * k, raw_h * k);
+            let Some(info) = self.session.get(id).and_then(|doc| doc.info.pages.get(page)) else { return false };
+            let view = info.user_to_view(at[0] as f32, at[1] as f32).map(f64::from);
+            // Added content uses the page's bottom-left display origin; rendered view space is y-down.
+            let center = [view[0], f64::from(info.height) - view[1]];
+            Some([center[0] - w * 0.5, center[1] - h * 0.5, center[0] + w * 0.5, center[1] + h * 0.5])
+        } else {
+            None
+        };
+
+        let added_before: std::collections::HashSet<_> =
+            self.session.get(id).into_iter().flat_map(|doc| doc.added()).filter(|item| item.page == page).map(|item| item.obj).collect();
+        if self.apply_edit(pdfcraft_engine::Edit::AddImage { page, rect: target_rect, name, bytes: std::sync::Arc::new(bytes) }) {
+            let selection = self.session.get(id).and_then(|doc| {
+                let mut inserted =
+                    doc.added().iter().filter(|item| item.page == page).enumerate().filter(|(_, item)| !added_before.contains(&item.obj));
+                let (added_idx, item) = inserted.next()?;
+                if inserted.next().is_some() {
+                    return None;
+                }
+                let AddedContent::Image(image) = &item.content else { return None };
+                let pasted_idx = doc.page_images(page).iter().rposition(|placed| placed.object == Some(image.image))?;
+                Some((added_idx, pasted_idx))
+            });
+            if let Some(v) = self.views.get_mut(i) {
+                v.current = page;
+                v.content.selected = selection.map(|(added, _)| (page, added));
+                v.content.select_added = v.content.selected;
+                v.image_selection = selection.map(|(_, image)| crate::edit_text_ui::ImageSelection::at(page, image));
+            }
+            self.quick_tool = crate::QuickTool::EditText;
+            self.notify_tr("Image pasted");
+            true
+        } else {
+            false
         }
     }
 }
@@ -1141,6 +1352,89 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn delivered_pixels_are_bounded_before_cache_or_document_changes() {
+        let mut app = crate::PdfCraftApp::new();
+        app.create_blank();
+        app.last_copied_image = Some((1, 1, vec![0, 255, 0, 255]));
+        let before = app.last_copied_image.clone();
+        for size in [[0, 1], [usize::MAX, 2], [crate::create_ui::MAX_IMAGE_SIDE + 1, 1], [2, 2]] {
+            let mut image = egui::ColorImage::filled([1, 1], egui::Color32::RED);
+            image.size = size;
+            assert!(!app.paste_received_image(0, &image));
+            assert_eq!(app.last_copied_image, before);
+        }
+        assert!(app.session.get(app.views[0].id).unwrap().page_images(0).is_empty());
+    }
+
+    #[test]
+    fn delivered_pixels_keep_unpremultiplied_alpha() {
+        let mut app = crate::PdfCraftApp::new();
+        app.create_blank();
+        let image = egui::ColorImage::from_rgba_unmultiplied([1, 1], &[255, 0, 0, 128]);
+        assert!(app.paste_received_image(0, &image));
+        assert_eq!(app.last_copied_image.unwrap().2, vec![255, 0, 0, 128]);
+    }
+
+    #[test]
+    fn review_web_can_paste_an_internal_image_without_a_native_clipboard() {
+        let mut app = crate::PdfCraftApp::new();
+        app.create_blank();
+        app.system_clipboard = true;
+        app.last_copied_image = Some((1, 1, vec![255, 0, 0, 255]));
+        assert!(app.paste_image_with_system(0, None, None, None, false, None));
+        let id = app.active_ids().unwrap().1;
+        assert_eq!(app.session.get(id).unwrap().page_images(0).len(), 1);
+    }
+
+    #[test]
+    fn review_system_without_supported_formats_does_not_paste_a_cached_image() {
+        let mut app = crate::PdfCraftApp::new();
+        app.create_blank();
+        app.system_clipboard = true;
+        app.last_copied_image = Some((1, 1, vec![255, 0, 0, 255]));
+        assert!(!app.paste_image_with_system(0, None, None, None, true, None));
+    }
+
+    #[test]
+    fn review_cut_checks_modify_permission_before_writing_the_clipboard() {
+        let mut app = crate::PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        let png = crate::create_ui::png_from_rgba(1, 1, &[255, 0, 0, 255]).unwrap();
+        app.add_image("test.png".into(), png);
+        app.apply_edit(Edit::Protect(pdfcraft_engine::Protection {
+            permissions_password: Some("owner".into()),
+            changes: pdfcraft_engine::Changes::None,
+            copy: true,
+            ..Default::default()
+        }));
+        let id = app.active_ids().unwrap().1;
+        let bytes = app.session.save_bytes(id).unwrap();
+        let mut locked = crate::PdfCraftApp::new();
+        locked.system_clipboard = false;
+        locked.open_bytes("locked.pdf", None, bytes.as_ref().clone()).unwrap();
+        assert!(!locked.session.get(locked.active_ids().unwrap().1).unwrap().allows_modification());
+        locked.last_copied_image = Some((1, 1, vec![0, 255, 0, 255]));
+        let before = locked.last_copied_image.clone();
+        assert!(!locked.cut_page_image(0, 0));
+        assert_eq!(locked.last_copied_image, before);
+    }
+
+    #[test]
+    fn system_text_prevents_context_menu_paste_of_a_cached_image() {
+        let mut app = crate::PdfCraftApp::new();
+        app.system_clipboard = false;
+        app.create_blank();
+        let id = app.active_ids().unwrap().1;
+        app.last_copied_image = Some((1, 1, vec![255, 0, 0, 255]));
+        let undo = app.session.get(id).unwrap().can_undo().map(str::to_owned);
+        assert!(!app.paste_image_with_system(0, None, Some([20.0, 20.0]), Some(crate::create_ui::Clip::Text("new text".into())), true, None));
+        assert_eq!(app.session.get(id).unwrap().can_undo().map(str::to_owned), undo);
+        assert!(app.session.get(id).unwrap().page_images(0).is_empty());
+        assert!(app.last_copied_image.is_none());
+    }
+
     /// The image a flip button leaves behind, as the panel returns it.
     fn flipped(tooltip: &str) -> pdfcraft_engine::AddedImage {
         let img = pdfcraft_engine::AddedImage::new([0.0, 0.0, 100.0, 50.0], pdfcraft_cos::ObjRef::new(7, 0));
diff --git a/crates/ui-egui/src/tools/edit_text_ui.rs b/crates/ui-egui/src/tools/edit_text_ui.rs
index 768af2059b..19a165c152 100644
--- a/crates/ui-egui/src/tools/edit_text_ui.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui.rs
@@ -7,7 +7,7 @@
 use std::collections::BTreeMap;
 use std::sync::Arc;
 
-use egui::{Color32, CornerRadius, FontFamily, FontId, Pos2, Rect, Stroke};
+use egui::{Color32, CornerRadius, FontFamily, FontId, Pos2, Rect, Stroke, pos2};
 use pdfcraft_engine::{Edit, ObjectKind, ObjectTarget};
 use pdfcraft_render::DocInfo;
 
@@ -21,14 +21,16 @@ mod image;
 mod layout;
 
 pub(crate) use background::TextBackground;
-pub use image::{CropMode, ImageSelection};
-pub(crate) use image::{ImageAction, ImageCx, body_hit as picture_hit, handle_hit as picture_handle_hit, image_input};
+pub use image::{CropMode, DragTarget, ImageAction, ImageDrag, ImageHandle, ImageSelection, image_menu_id};
+pub(crate) use image::{
+    ImageCx, Matrix, body_hit as picture_hit, handle_hit as picture_handle_hit, image_context_menu, image_input, quad_contains, user_to_screen,
+};
 #[cfg(test)]
-use image::{rotate_knob, turn_degrees};
+use image::{rotate_knob, turn_degrees, turn_degrees_delta};
 #[cfg(test)]
 use layout::{DARK_EDITOR_FILL, contrast};
 pub(crate) use layout::{caret_color_on, editor_fill, editor_font, install_source_fonts};
-use layout::{color32, editor_galley, editor_job, look_of, luminance, unseen};
+use layout::{color32, editor_galley, editor_job, look_of, luminance, source_look, unseen};
 
 const ACCENT: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
 
@@ -42,7 +44,22 @@ enum TextTarget {
 /// ~1000 tiny images on one page; stroking all of them every frame (plus a hover query
 /// per box) stalls the UI. Past this, only the selected and hovered boxes are outlined:
 /// hit-testing still covers every image, so nothing becomes unselectable.
-const MAX_OUTLINES: usize = 250;
+pub(crate) const MAX_OUTLINES: usize = 250;
+
+/// Format text ▸ Superscript or Subscript on `text`: on the `selection` (bytes of `text`), or all
+/// of it without one ([`pdfcraft_engine::text_script::toggle`]). A selection follows the
+/// converted characters. Whether the text changed.
+pub(crate) fn toggle_script(text: &mut String, selection: &mut Option<std::ops::Range<usize>>, script: pdfcraft_engine::text_script::Script) -> bool {
+    if selection.as_ref().is_some_and(|r| r.is_empty()) {
+        *selection = None;
+    }
+    let Some((toggled, range)) = pdfcraft_engine::text_script::toggle(text, selection.as_ref(), script) else { return false };
+    *text = toggled;
+    if selection.is_some() {
+        *selection = Some(range);
+    }
+    true
+}
 
 /// A paragraph being edited.
 #[derive(Clone, Debug, PartialEq)]
@@ -67,7 +84,7 @@ pub struct LineEditor {
     /// Current screen-space size. Recomputed from the current page transform before painting.
     size: f32,
     /// Take the keyboard focus on the next frame.
-    pub(crate) focus: bool,
+    pub focus: bool,
     /// Whether the text box had the keyboard at the end of the editor's last frame
     /// ([`lost_focus_once`]).
     had_focus: bool,
@@ -78,6 +95,7 @@ pub struct LineEditor {
     /// (Calibri reads as Helvetica) can be the one picked, so comparing `look` with `look0` alone
     /// would miss the choice.
     family_chosen: bool,
+    size_chosen: bool,
     /// Underline, line spacing (× size; 0 = the paragraph's own), character spacing (pt) and
     /// horizontal scale (%), and what they were.
     pub extras: Extras,
@@ -226,10 +244,7 @@ impl LineEditor {
         }
         let base = self.source.as_ref().map(|(block, _)| block.base_font.as_str()).unwrap_or_default();
         // "ABCDEF+Calibri" is a subset of Calibri.
-        let name = match base.split_once('+') {
-            Some((tag, rest)) if tag.len() == 6 && tag.bytes().all(|b| b.is_ascii_uppercase()) => rest,
-            _ => base,
-        };
+        let name = pdfcraft_engine::strip_subset_tag(base);
         if name.is_empty() { tl!("Keep source fonts").to_string() } else { name.to_string() }
     }
 
@@ -254,7 +269,7 @@ impl LineEditor {
 
     /// Whether the paragraph with `text` in it differs from what was opened.
     fn changes_with(&self, text: &str) -> bool {
-        text != self.original || self.look != self.look0 || self.extras != self.extras0 || self.family_chosen
+        text != self.original || self.look != self.look0 || self.extras != self.extras0 || self.family_chosen || self.size_chosen
     }
 
     /// Extra width permitted by the editor. Source containers now remain fixed.
@@ -273,7 +288,7 @@ impl LineEditor {
         let mut style = pdfcraft_engine::BlockStyle {
             resource: self.font_resource.clone(),
             family: (l.family != o.family || self.family_chosen || l.bold != o.bold || l.italic != o.italic).then_some((l.family, l.bold, l.italic)),
-            size: (l.size != o.size).then_some(l.size),
+            size: (self.size_chosen || l.size != o.size).then_some(l.size),
             color: (l.color != o.color).then_some(l.color),
             // The whole paragraph's alignment when it was picked, or when the rows' own were
             // dropped for it (the rows are where those put them, so leaving it out keeps them there).
@@ -314,14 +329,22 @@ impl LineEditor {
         style
     }
 
-    /// After applying formatting: the paragraph now has it. The selection stays, as the box still
-    /// shows it, so a second alignment or format picked for it applies to the same rows.
+    /// An explicit size commit also normalizes a mixed selection to the displayed value.
+    pub(crate) fn choose_size(&mut self, size: f64) {
+        self.look.size = size;
+        self.size_chosen = true;
+    }
+
+    /// After applying formatting: the paragraph now has it. Its old byte selection is cleared;
+    /// the rewritten paragraph may have different text or geometry.
     pub fn applied(&mut self) {
+        self.size_chosen = false;
         self.font_resource = None;
         self.family_chosen = false;
         self.look0 = self.look.clone();
         self.extras0 = self.extras;
         self.original = self.text.clone();
+        self.selection = None;
         // The page now has this text: the box's history restarts, even when the format left the
         // text as it was, so a Redo from before can't put undone typing back on top of it.
         self.typing_from = None;
@@ -348,6 +371,120 @@ impl LineEditor {
         self.original = self.text.clone();
     }
 
+    fn current_formatting(&self, sources: &[(String, String)]) -> SelectionFormatting {
+        SelectionFormatting {
+            font_shown: self.font_shown(sources),
+            size: Some(self.look.size),
+            family: Some(self.look.family),
+            bold: Some(self.look.bold),
+            italic: Some(self.look.italic),
+            color: Some(self.look.color),
+        }
+    }
+
+    pub fn selection_formatting(&self, sources: &[(String, String)]) -> SelectionFormatting {
+        let Some((block, lines)) = &self.source else {
+            return self.current_formatting(sources);
+        };
+
+        let spans = block.edited_spans(&self.text);
+        let matching_lines: Vec<&pdfcraft_engine::TextLine> = match &self.selection {
+            Some(range) if range.start < range.end => {
+                spans.iter().filter(|(span, _)| span.start < range.end && span.end > range.start).filter_map(|(_, idx)| lines.get(*idx)).collect()
+            }
+            _ => spans.iter().filter_map(|(_, idx)| lines.get(*idx)).collect(),
+        };
+
+        let Some(first) = matching_lines.first().copied() else {
+            return self.current_formatting(sources);
+        };
+
+        let line_font = |l: &pdfcraft_engine::TextLine| -> String {
+            if let Some((_, face)) = sources.iter().find(|(res, _)| res == &l.font) {
+                return face.clone();
+            }
+            let base = l.base_font.as_str();
+            let name = pdfcraft_engine::strip_subset_tag(base);
+            if let Some((_, face)) = sources.iter().find(|(_, face)| face.as_str() == name) {
+                return face.clone();
+            }
+            let look = look_of_line(l);
+            let lower = name.to_ascii_lowercase();
+            if ["times", "serif", "roman", "courier", "helvetica", "arial"].iter().any(|s| lower.contains(s)) {
+                return look.family.label().to_string();
+            }
+            if name.is_empty() { tl!("Keep source fonts").to_string() } else { name.to_string() }
+        };
+
+        let first_font = line_font(first);
+        let same_font = matching_lines.iter().skip(1).all(|l| line_font(l) == first_font);
+        let font_shown = if same_font {
+            if self.font_resource.is_some() || self.look.family != self.look0.family || self.family_chosen {
+                self.font_shown(sources)
+            } else {
+                first_font
+            }
+        } else {
+            tl!("Mixed").to_string()
+        };
+
+        let first_size = (first.size * 10.0).round() / 10.0;
+        let same_size = matching_lines.iter().skip(1).all(|l| ((l.size * 10.0).round() / 10.0 - first_size).abs() < 0.05);
+        let size = if same_size { Some(first_size) } else { None };
+
+        let first_look = look_of_line(first);
+        let same_family = matching_lines.iter().skip(1).all(|l| look_of_line(l).family == first_look.family);
+        let family = if same_family { Some(first_look.family) } else { None };
+        let same_bold = matching_lines.iter().skip(1).all(|l| l.bold == first.bold);
+        let bold = if same_bold { Some(first.bold) } else { None };
+        let same_italic = matching_lines.iter().skip(1).all(|l| l.italic == first.italic);
+        let italic = if same_italic { Some(first.italic) } else { None };
+        let same_color = matching_lines.iter().skip(1).all(|l| l.color == first.color);
+        let color = if same_color { Some(first.color) } else { None };
+
+        SelectionFormatting { font_shown, size, family, bold, italic, color }
+    }
+
+    pub(crate) fn sync_selection_look(&mut self, fmt: &SelectionFormatting) {
+        if let Some(sz) = fmt.size {
+            self.look.size = sz;
+            self.look0.size = sz;
+        } else {
+            if self.look.size <= 0.0 {
+                self.look.size = 12.0;
+            }
+            self.look0.size = self.look.size;
+        }
+        if let Some(f) = fmt.family {
+            self.look.family = f;
+            self.look0.family = f;
+        }
+        match fmt.bold {
+            Some(b) => {
+                self.look.bold = b;
+                self.look0.bold = b;
+            }
+            None => {
+                self.look.bold = false;
+                self.look0.bold = false;
+            }
+        }
+        match fmt.italic {
+            Some(it) => {
+                self.look.italic = it;
+                self.look0.italic = it;
+            }
+            None => {
+                self.look.italic = false;
+                self.look0.italic = false;
+            }
+        }
+        if let Some(c) = fmt.color {
+            self.look.color = c;
+            self.look0.color = c;
+        }
+    }
+
     /// The text changed from `before` through the box's own typing (typing, Undo, Redo): rows
     /// aligned on their own keep their alignment, and a row Undo brings back gets its own back.
     pub(crate) fn follow_typed_rows(&mut self, ctx: &egui::Context, before: &str) {
@@ -362,6 +499,20 @@ impl LineEditor {
     }
 }
 
+#[derive(Clone, Debug, PartialEq)]
+pub struct SelectionFormatting {
+    pub font_shown: String,
+    pub size: Option<f64>,
+    pub family: Option<pdfcraft_engine::FontFamily>,
+    pub bold: Option<bool>,
+    pub italic: Option<bool>,
+    pub color: Option<[f64; 3]>,
+}
+
+fn look_of_line(l: &pdfcraft_engine::TextLine) -> pdfcraft_engine::AddedText {
+    source_look(&l.base_font, l.size, l.color, l.bold, l.italic)
+}
+
 /// What a drag on a paragraph box takes hold of.
 #[derive(Clone, Copy, Debug, PartialEq)]
 enum Grip {
@@ -458,7 +609,7 @@ pub(crate) fn hit(xf: &PageXform, info: &DocInfo, page: usize, lines: &[pdfcraft
     })
 }
 
-fn user_box(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
+pub(crate) fn user_box(xf: &PageXform, info: &DocInfo, page: usize, r: Rect) -> [f64; 4] {
     let p = &info.pages[page];
     let (a, b) = (xf.screen_to_view(r.min), xf.screen_to_view(r.max));
     let (u, v) = (p.view_to_user(a.0, a.1), p.view_to_user(b.0, b.1));
@@ -500,6 +651,7 @@ fn open_editor(cx: PageToolContext<'_>, lines: &[pdfcraft_engine::TextBlock], bo
         look: look_of(l),
         look0: look_of(l),
         family_chosen: false,
+        size_chosen: false,
         extras: Extras::default(),
         extras0: Extras::default(),
         typing_from: None,
@@ -794,23 +946,26 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
                     }
                 }
                 look = Some((Arc::clone(&output.galley), output.galley_pos));
-                if let Some(cursor) = output.cursor_range {
-                    let selected = cursor.as_sorted_char_range();
-                    let byte = |index| ed.text.char_indices().nth(index).map_or(ed.text.len(), |(at, _)| at);
-                    ed.selection = (!selected.is_empty()).then(|| byte(selected.start.into())..byte(selected.end.into()));
-                }
                 let r = output.response;
-                if r.changed() {
-                    ed.follow_typed_rows(ctx, &before);
-                    // The next pass measures the updated draft with the Apply/Save rewrite.
-                    ctx.request_repaint();
-                }
                 if ed.focus {
                     r.request_focus();
                     if let Some(range) = &ed.selection {
                         reselect(ui.ctx(), input, &ed.text, range);
                     }
                     ed.focus = false;
+                } else if r.has_focus() {
+                    if let Some(cursor) = output.cursor_range {
+                        let selected = cursor.as_sorted_char_range();
+                        let byte = |index| ed.text.char_indices().nth(index).map_or(ed.text.len(), |(at, _)| at);
+                        ed.selection = (!selected.is_empty()).then(|| byte(selected.start.into())..byte(selected.end.into()));
+                    } else {
+                        ed.selection = None;
+                    }
+                }
+                if r.changed() {
+                    ed.follow_typed_rows(ctx, &before);
+                    // The next pass measures the updated draft with the Apply/Save rewrite.
+                    ctx.request_repaint();
                 }
                 let lost = lost_focus_once(&r, &mut ed.had_focus);
                 let esc = ui.input(|i| i.key_pressed(egui::Key::Escape));
@@ -1003,6 +1158,22 @@ C", &picked
         assert_eq!(at(f32::NAN, 5.0), 0.0);
     }
 
+    #[test]
+    fn the_rotate_knob_measures_clockwise_delta_from_drag_start() {
+        let c = Pos2::new(100.0, 100.0);
+        // Start dragging at 45° clockwise from top:
+        let r = 50.0_f32;
+        let start = c + egui::vec2(r * 45.0_f32.to_radians().sin(), -r * 45.0_f32.to_radians().cos());
+        // At start position, delta is 0:
+        assert!(turn_degrees_delta(c, start, start, false).abs() < 1e-3);
+        // Move by +15° (to 60°):
+        let p_60 = c + egui::vec2(r * 60.0_f32.to_radians().sin(), -r * 60.0_f32.to_radians().cos());
+        assert!((turn_degrees_delta(c, start, p_60, false) - 15.0).abs() < 1e-2);
+        // Move by -10° (to 35°):
+        let p_35 = c + egui::vec2(r * 35.0_f32.to_radians().sin(), -r * 35.0_f32.to_radians().cos());
+        assert!((turn_degrees_delta(c, start, p_35, false) + 10.0).abs() < 1e-2);
+    }
+
     /// An app with one text document open, and an editor on its first paragraph.
     fn preview_app() -> (crate::PdfCraftApp, LineEditor) {
         let mut app = crate::PdfCraftApp::new();
@@ -1030,6 +1201,7 @@ C", &picked
             look: look_of(&block),
             look0: look_of(&block),
             family_chosen: false,
+            size_chosen: false,
             extras: Extras::default(),
             extras0: Extras::default(),
             typing_from: None,
@@ -1037,6 +1209,30 @@ C", &picked
         (app, ed)
     }
 
+    #[test]
+    fn review_committing_the_shown_size_applies_it_to_a_mixed_selection() {
+        let (_app, mut ed) = preview_app();
+        ed.selection = Some(0..2);
+        let mut fmt = ed.current_formatting(&[]);
+        fmt.size = None;
+        ed.sync_selection_look(&fmt);
+        let shown = ed.look.size;
+        ed.choose_size(shown);
+        assert!(ed.has_changes());
+        assert_eq!(ed.style().ranges[0].size, Some(shown));
+        ed.applied();
+        assert!(ed.style().ranges.is_empty());
+    }
+
+    #[test]
+    fn review_a_caret_only_script_formats_the_whole_draft() {
+        let mut text = "x2".to_string();
+        let mut caret = Some(1..1);
+        assert!(toggle_script(&mut text, &mut caret, pdfcraft_engine::text_script::Script::Super));
+        assert_eq!(text, "ˣ²");
+        assert_eq!(caret, None);
+    }
+
     #[test]
     fn picking_the_family_the_font_name_reads_as_still_changes_the_font() {
         // A Calibri paragraph reads as Helvetica; picking Helvetica from the list used to leave
@@ -1194,4 +1390,53 @@ C", &picked
         assert_eq!(caret_color_on(Color32::BLACK), Color32::WHITE);
         assert_eq!(caret_color_on(DARK_EDITOR_FILL), Color32::WHITE);
     }
+
+    #[test]
+    fn superscript_and_subscript_conversion() {
+        use pdfcraft_engine::text_script::Script;
+        let (mut text, mut selection) = ("E = mc2".to_string(), Some(6..7));
+        assert!(toggle_script(&mut text, &mut selection, Script::Super));
+        assert_eq!((text.as_str(), selection.clone()), ("E = mc²", Some(6..8)), "the selection follows the converted character");
+        assert!(toggle_script(&mut text, &mut selection, Script::Super));
+        assert_eq!((text.as_str(), selection), ("E = mc2", Some(6..7)));
+
+        // No selection: the whole text. H and O have no subscript form, and it still toggles back.
+        let (mut text, mut none) = ("H2O".to_string(), None);
+        assert!(toggle_script(&mut text, &mut none, Script::Sub));
+        assert_eq!((text.as_str(), none.clone()), ("H₂O", None));
+        assert!(toggle_script(&mut text, &mut none, Script::Sub));
+        assert_eq!(text, "H2O");
+    }
+
+    #[test]
+    fn value_based_line_spacing_in_style() {
+        let ed = LineEditor {
+            page: 0,
+            block: 0,
+            text: "Paragraph text".to_string(),
+            original: "Paragraph text".to_string(),
+            rect: egui::Rect::ZERO,
+            source_rect: [0.0; 4],
+            max_width: 100.0,
+            overflow: false,
+            selection: None,
+            font_resource: None,
+            fonts: std::collections::BTreeMap::new(),
+            source: None,
+            multiline: false,
+            size: 12.0,
+            family_chosen: false,
+            size_chosen: false,
+            focus: true,
+            had_focus: false,
+            look: pdfcraft_engine::AddedText::default(),
+            look0: pdfcraft_engine::AddedText::default(),
+            extras: Extras { line_spacing: 1.33, underline: true, ..Default::default() },
+            extras0: Extras::default(),
+            typing_from: None,
+        };
+        let style = ed.style();
+        assert_eq!(style.line_spacing, Some(1.33));
+        assert_eq!(style.underline, Some(true));
+    }
 }
diff --git a/crates/ui-egui/src/tools/edit_text_ui/image.rs b/crates/ui-egui/src/tools/edit_text_ui/image.rs
index 6956e656af..281f7de80e 100644
--- a/crates/ui-egui/src/tools/edit_text_ui/image.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui/image.rs
@@ -1,53 +1,9 @@
-use super::{ACCENT, Color32, CornerRadius, DocInfo, DocView, Edit, MAX_OUTLINES, PagePointer, PageXform, Pos2, Rect, Stroke, user_box};
+use super::{ACCENT, Color32, CornerRadius, DocInfo, DocView, Edit, MAX_OUTLINES, PagePointer, PageXform, Pos2, Rect, Stroke, pos2, user_box};
+use crate::canvas::{ImageObb, PainterExt, image_screen_rect};
+use crate::image_engine::{CROP_ACCENT, apply_crop, apply_resize, apply_resize_proportional, draw_handle, draw_rule_of_thirds};
 use crate::page_cursor::Layer;
 use crate::page_router::{Hit, Owner, PicturePart};
 
-/// A selected page image, and what the pointer is doing to it.
-#[derive(Clone, Debug, PartialEq)]
-pub struct ImageSelection {
-    pub page: usize,
-    pub index: usize,
-    /// Dragging: the start point and, for a corner, the opposite corner (screen).
-    drag: Option<(Pos2, Option<Pos2>)>,
-    /// Crop mode (Acrobat's crop handles): the box kept so far.
-    pub crop: Option<CropMode>,
-    /// The drag is turning the picture by its rotate handle (the `drag` start is then unused).
-    turning: bool,
-    /// A move or resize applied on release: the frame it had and the one it got, in the page's
-    /// 0..1 coordinates, while the page raster still has the picture where it was.
-    settled: Option<(Rect, Rect)>,
-}
-
-impl ImageSelection {
-    /// Cancel an in-progress text, rotation or crop drag and restore the crop it was previewing.
-    pub(crate) fn cancel_pointer_gesture(&mut self) {
-        self.drag = None;
-        self.turning = false;
-        if let Some(crop) = &mut self.crop
-            && let Some((_, _, before)) = crop.drag.take()
-        {
-            crop.keep = before;
-        }
-    }
-}
-
-/// Cropping a page image: the handles trim instead of resizing, the part that will go is
-/// dimmed, Enter or Done applies and Esc or Cancel leaves it.
-#[derive(Clone, Debug, PartialEq)]
-pub struct CropMode {
-    /// The box to keep (user space).
-    pub keep: [f64; 4],
-    /// A drag in progress: the grip (0–3 corners, 4–7 edges, 8 the inside), where it started
-    /// and the box then.
-    drag: Option<(usize, Pos2, [f64; 4])>,
-}
-
-impl CropMode {
-    pub fn new(keep: [f64; 4]) -> Self {
-        Self { keep, drag: None }
-    }
-}
-
 /// What the pointer and the page are, for the image tools on one page.
 #[derive(Clone, Copy)]
 pub(crate) struct ImageCx<'a> {
@@ -60,141 +16,441 @@ pub(crate) struct ImageCx<'a> {
     pub allow_interaction: bool,
 }
 
-/// The screen boxes of the crop's eight handles: corners, then the top, right, bottom and left
-/// edge midpoints.
+/// The 8 resize handles on an image (4 corners + 4 edge centers).
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum ImageHandle {
+    TopLeft,
+    TopCenter,
+    TopRight,
+    RightCenter,
+    BottomRight,
+    BottomCenter,
+    BottomLeft,
+    LeftCenter,
+}
+
+impl ImageHandle {
+    /// The resize cursor for this handle on an upright box.
+    pub(crate) fn cursor_icon(self) -> egui::CursorIcon {
+        match self {
+            ImageHandle::TopLeft | ImageHandle::BottomRight => egui::CursorIcon::ResizeNwSe,
+            ImageHandle::TopRight | ImageHandle::BottomLeft => egui::CursorIcon::ResizeNeSw,
+            ImageHandle::TopCenter | ImageHandle::BottomCenter => egui::CursorIcon::ResizeVertical,
+            ImageHandle::LeftCenter | ImageHandle::RightCenter => egui::CursorIcon::ResizeHorizontal,
+        }
+    }
+}
+
+/// The handles in the order [`crop_handles`] places them: corners, then the top, right, bottom
+/// and left edge midpoints.
+const GRIPS: [ImageHandle; 8] = [
+    ImageHandle::TopLeft,
+    ImageHandle::TopRight,
+    ImageHandle::BottomLeft,
+    ImageHandle::BottomRight,
+    ImageHandle::TopCenter,
+    ImageHandle::RightCenter,
+    ImageHandle::BottomCenter,
+    ImageHandle::LeftCenter,
+];
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum DragTarget {
+    Move,
+    Handle(ImageHandle),
+    Rotate,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct ImageDrag {
+    pub start: Pos2,
+    pub target: DragTarget,
+    pub initial_rect: Rect,
+    /// Captured user-space frame: the visible crop for resizing, full placement for moving.
+    pub initial_matrix: [f64; 6],
+}
+
+/// A selected page image, and what the pointer is doing to it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct ImageSelection {
+    pub page: usize,
+    pub index: usize,
+    /// Dragging in progress.
+    pub drag: Option<ImageDrag>,
+    /// Crop mode: the box kept so far.
+    pub crop: Option<CropMode>,
+    /// The drag is turning the picture by its rotate handle (the `drag` start is then unused).
+    pub turning: bool,
+    /// A move or resize applied on release: the frame it had and the one it got, in the page's
+    /// 0..1 coordinates, while the page raster still has the picture where it was.
+    pub settled: Option<(Rect, Rect)>,
+}
+
+impl ImageSelection {
+    /// Select a page image without an active gesture.
+    pub fn at(page: usize, index: usize) -> Self {
+        Self { page, index, drag: None, crop: None, turning: false, settled: None }
+    }
+
+    /// Cancel an in-progress text, rotation or crop drag and restore the crop it was previewing.
+    pub(crate) fn cancel_pointer_gesture(&mut self) {
+        self.drag = None;
+        self.turning = false;
+        if let Some(crop) = &mut self.crop
+            && let Some((_, _, before)) = crop.drag.take()
+        {
+            crop.keep = before;
+        }
+    }
+
+    pub(crate) fn dragging(&self) -> bool {
+        self.drag.is_some()
+    }
+}
+
+/// Cropping a page image: the handles trim instead of resizing, the part that will go is
+/// dimmed, Enter or Done applies and Esc or Cancel leaves it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct CropMode {
+    /// The box to keep (user space or normalized UV).
+    pub keep: [f64; 4],
+    /// A drag in progress: the grip (0–7 handles, 8 inside), where it started and the box then.
+    pub(crate) drag: Option<(usize, Pos2, [f64; 4])>,
+}
+
+impl CropMode {
+    pub fn new(keep: [f64; 4]) -> Self {
+        Self { keep, drag: None }
+    }
+}
+
+pub(crate) use pdfcraft_content::Matrix;
+
+/// The displayed crop frame, expressed in page user space, rather than the full image placement.
+fn resize_frame(obb: &ImageObb, xf: &PageXform, info: &DocInfo, page: usize) -> Matrix {
+    let p00 = screen_to_user(xf, info, page, obb.s00);
+    let p10 = screen_to_user(xf, info, page, obb.s10);
+    let p01 = screen_to_user(xf, info, page, obb.s01);
+    Matrix([p10.0 - p00.0, p10.1 - p00.1, p01.0 - p00.0, p01.1 - p00.1, p00.0, p00.1])
+}
+
+/// Resize from the captured press displacement in the frame's actual affine basis.
+fn resize_affine_frame(frame: Matrix, handle: ImageHandle, delta: (f64, f64), proportional: bool) -> Option<Matrix> {
+    if !frame.0.iter().all(|v| v.is_finite()) || !delta.0.is_finite() || !delta.1.is_finite() {
+        return None;
+    }
+    if delta == (0.0, 0.0) {
+        return Some(frame);
+    }
+    let [a, b, c, d, _, _] = frame.0;
+    let inverse_basis = Matrix([a, b, c, d, 0.0, 0.0]).invert()?;
+    let (du, dv) = inverse_basis.apply(delta.0, delta.1);
+    if !du.is_finite() || !dv.is_finite() {
+        return None;
+    }
+    let (u, v) = match handle {
+        ImageHandle::TopRight => (1.0, 1.0),
+        ImageHandle::TopLeft => (-1.0, 1.0),
+        ImageHandle::BottomLeft => (-1.0, -1.0),
+        ImageHandle::BottomRight => (1.0, -1.0),
+        ImageHandle::RightCenter => (1.0, 0.0),
+        ImageHandle::LeftCenter => (-1.0, 0.0),
+        ImageHandle::TopCenter => (0.0, 1.0),
+        ImageHandle::BottomCenter => (0.0, -1.0),
+    };
+    let (minimum_u, minimum_v) = (5.0 / a.hypot(b), 5.0 / c.hypot(d));
+    let (mut su, mut sv) = (1.0 + u * du, 1.0 + v * dv);
+    if proportional && u != 0.0 && v != 0.0 {
+        let scale = if (su - 1.0).abs() >= (sv - 1.0).abs() { su } else { sv };
+        su = scale.max(minimum_u).max(minimum_v);
+        sv = su;
+    } else {
+        if u != 0.0 {
+            su = su.max(minimum_u);
+        }
+        if v != 0.0 {
+            sv = sv.max(minimum_v);
+        }
+    }
+    let local = Matrix([su, 0.0, 0.0, sv, if u < 0.0 { 1.0 - su } else { 0.0 }, if v < 0.0 { 1.0 - sv } else { 0.0 }]);
+    let resized = local.then(&frame);
+    resized.0.iter().all(|v| v.is_finite()).then_some(resized)
+}
+
+pub(crate) fn user_to_screen(xf: &PageXform, info: &DocInfo, page: usize, x: f64, y: f64) -> Pos2 {
+    let Some(p) = info.pages.get(page) else { return Pos2::ZERO };
+    let v = p.user_to_view(x as f32, y as f32);
+    xf.norm_to_screen(v[0] / xf.pw, v[1] / xf.ph)
+}
+
+fn screen_to_user(xf: &PageXform, info: &DocInfo, page: usize, pt: Pos2) -> (f64, f64) {
+    let (vx, vy) = xf.screen_to_view(pt);
+    let Some(p) = info.pages.get(page) else { return (0.0, 0.0) };
+    let u = p.view_to_user(vx, vy);
+    (f64::from(u[0]), f64::from(u[1]))
+}
+
+pub(crate) fn quad_contains(quad: [Pos2; 4], p: Pos2) -> bool {
+    if !p.x.is_finite() || !p.y.is_finite() || quad.iter().any(|pt| !pt.x.is_finite() || !pt.y.is_finite()) {
+        return false;
+    }
+    let mut sign = 0;
+    for i in 0..4 {
+        let p1 = quad[i];
+        let p2 = quad[(i + 1) % 4];
+        let cross = (p2.x - p1.x) * (p.y - p1.y) - (p2.y - p1.y) * (p.x - p1.x);
+        if cross.abs() > 1e-4 {
+            let s = if cross > 0.0 { 1 } else { -1 };
+            if sign == 0 {
+                sign = s;
+            } else if sign != s {
+                return false;
+            }
+        }
+    }
+    sign != 0
+}
+
+/// The screen positions of the crop's eight handles: corners, then the top, right, bottom and left edge midpoints.
 fn crop_handles(k: Rect) -> [Pos2; 8] {
     [k.left_top(), k.right_top(), k.left_bottom(), k.right_bottom(), k.center_top(), k.right_center(), k.center_bottom(), k.left_center()]
 }
 
+// Keep a dragged crop inside the image, including images smaller than six screen pixels.
+fn clamp_crop(b: Rect, new_screen: Rect) -> Rect {
+    if !b.is_finite() || !b.is_positive() || !b.size().is_finite() || !new_screen.is_finite() {
+        return new_screen;
+    }
+    let (min_w, min_h) = (6.0_f32.min(b.width()), 6.0_f32.min(b.height()));
+    Rect::from_min_max(
+        pos2(new_screen.min.x.clamp(b.min.x, b.max.x - min_w), new_screen.min.y.clamp(b.min.y, b.max.y - min_h)),
+        pos2(new_screen.max.x.clamp(b.min.x + min_w, b.max.x), new_screen.max.y.clamp(b.min.y + min_h, b.max.y)),
+    )
+}
+
+#[cfg(test)]
+mod crop_bounds_tests {
+    use super::*;
+
+    #[test]
+    fn crop_drag_rejects_nonfinite_bounds() {
+        for value in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY] {
+            let bounds = Rect { min: pos2(value, 0.0), max: pos2(100.0, 100.0) };
+            let keep = Rect::from_min_max(pos2(10.0, 10.0), pos2(50.0, 50.0));
+            assert_eq!(clamp_crop(bounds, keep), keep);
+        }
+    }
+}
+
+fn same_rect(a: [f64; 4], b: [f64; 4]) -> bool {
+    a.into_iter().zip(b).all(|(a, b)| (a - b).abs() < 1e-3)
+}
+
 /// Crop mode for the selected image `i` whose visible frame is `b` (screen). Returns `true`
 /// (the pointer and keys are the crop's while it lasts).
-fn crop_input(cx: &ImageCx<'_>, view: &mut DocView, i: usize, b: Rect) -> bool {
+#[allow(clippy::cognitive_complexity)]
+fn crop_input(cx: &ImageCx<'_>, view: &mut DocView, i: usize, image: &pdfcraft_engine::PageImage) -> bool {
     let ImageCx { ui, resp, xf, ptr, page, info, allow_interaction } = *cx;
     let painter = ui.painter();
     let Some(mode) = view.image_selection.as_mut().and_then(|s| s.crop.as_mut()) else { return false };
     let hover_pos = ptr.pos;
+    let full_b = xf.user_rect(info, page, image.rect.map(|v| v as f32));
+    let b = if full_b.is_positive() { full_b } else { xf.user_rect(info, page, image.visible_rect.unwrap_or(image.rect).map(|v| v as f32)) };
     let keep_screen = |keep: [f64; 4]| xf.user_rect(info, page, keep.map(|v| v as f32)).intersect(b);
-    // A drag in progress moves a grip; the box stays inside the picture and at least 6 px.
+    let k = keep_screen(mode.keep);
+    if !b.is_finite() || !b.is_positive() || !b.size().is_finite() || !k.is_finite() || !k.is_positive() {
+        mode.drag = None;
+        return true;
+    }
+
     if allow_interaction
         && resp.drag_started()
         && let Some(o) = ptr.origin
     {
-        let k = keep_screen(mode.keep);
-        let grip = crop_handles(k).iter().position(|h| h.distance(o) < 8.0).or_else(|| k.contains(o).then_some(8));
+        let grip = crop_handles(k).iter().position(|h| h.distance(o) < 10.0).or_else(|| k.contains(o).then_some(8));
         if let Some(g) = grip {
             mode.drag = Some((g, o, mode.keep));
         }
     }
+
     if let Some((grip, start, at_start)) = mode.drag
         && let Some(p) = hover_pos
     {
         let d = p - start;
         let k0 = keep_screen(at_start);
-        let (mut min, mut max) = (k0.min, k0.max);
-        match grip {
-            0 => {
-                min.x += d.x;
-                min.y += d.y;
-            }
-            1 => {
-                max.x += d.x;
-                min.y += d.y;
-            }
-            2 => {
-                min.x += d.x;
-                max.y += d.y;
-            }
-            3 => {
-                max.x += d.x;
-                max.y += d.y;
-            }
-            4 => min.y += d.y,
-            5 => max.x += d.x,
-            6 => max.y += d.y,
-            7 => min.x += d.x,
-            _ => {
-                let shift = egui::vec2(d.x.clamp(b.min.x - k0.min.x, b.max.x - k0.max.x), d.y.clamp(b.min.y - k0.min.y, b.max.y - k0.max.y));
-                min += shift;
-                max += shift;
-            }
+        if !d.is_finite() || !k0.is_finite() || !k0.is_positive() {
+            mode.drag = None;
+            return true;
+        }
+        if let Some(&handle) = GRIPS.get(grip) {
+            let uv0 = if b.width() > 0.0 && b.height() > 0.0 {
+                Rect::from_min_max(
+                    pos2(((k0.min.x - b.min.x) / b.width()).clamp(0.0, 1.0), ((k0.min.y - b.min.y) / b.height()).clamp(0.0, 1.0)),
+                    pos2(((k0.max.x - b.min.x) / b.width()).clamp(0.0, 1.0), ((k0.max.y - b.min.y) / b.height()).clamp(0.0, 1.0)),
+                )
+            } else {
+                Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0))
+            };
+            let (new_screen, _) = apply_crop(k0, uv0, handle, d);
+            let clamped = clamp_crop(b, new_screen);
+            mode.keep = user_box(xf, info, page, clamped);
+        } else {
+            let shift = egui::vec2(d.x.clamp(b.min.x - k0.min.x, b.max.x - k0.max.x), d.y.clamp(b.min.y - k0.min.y, b.max.y - k0.max.y));
+            mode.keep = user_box(xf, info, page, Rect::from_min_max(k0.min + shift, k0.max + shift));
         }
-        let (min_w, min_h) = (6.0_f32.min(b.width()), 6.0_f32.min(b.height()));
-        min.x = min.x.clamp(b.min.x, b.max.x - min_w);
-        min.y = min.y.clamp(b.min.y, b.max.y - min_h);
-        max.x = max.x.clamp(min.x + min_w, b.max.x);
-        max.y = max.y.clamp(min.y + min_h, b.max.y);
-        mode.keep = user_box(xf, info, page, Rect::from_min_max(min, max));
         if resp.drag_stopped() || !ptr.primary_down {
             mode.drag = None;
         }
     }
-    let k = keep_screen(mode.keep);
-    // What goes is dimmed; what stays keeps its frame and handles.
+
+    // Faint ghost outline of the full uncropped image underneath
+    painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.0, Color32::from_rgba_unmultiplied(200, 200, 200, 80)), egui::StrokeKind::Outside);
+
+    // Dim outer excluded bands
     let dim = Color32::from_black_alpha(96);
-    for r in [
-        Rect::from_min_max(b.min, Pos2::new(b.max.x, k.min.y)),
-        Rect::from_min_max(Pos2::new(b.min.x, k.max.y), b.max),
-        Rect::from_min_max(Pos2::new(b.min.x, k.min.y), Pos2::new(k.min.x, k.max.y)),
-        Rect::from_min_max(Pos2::new(k.max.x, k.min.y), Pos2::new(b.max.x, k.max.y)),
-    ] {
-        if r.is_positive() {
-            painter.rect_filled(r.intersect(xf.rect), CornerRadius::ZERO, dim);
-        }
+    if k.min.y > b.min.y {
+        painter.rect_filled(Rect::from_min_max(b.min, Pos2::new(b.max.x, k.min.y)), CornerRadius::ZERO, dim);
     }
-    painter.rect_stroke(k, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-    for h in crop_handles(k) {
-        painter.rect(
-            Rect::from_center_size(h, egui::vec2(8.0, 8.0)),
-            CornerRadius::ZERO,
-            Color32::WHITE,
-            Stroke::new(1.0, ACCENT),
-            egui::StrokeKind::Middle,
-        );
+    if k.max.y < b.max.y {
+        painter.rect_filled(Rect::from_min_max(Pos2::new(b.min.x, k.max.y), b.max), CornerRadius::ZERO, dim);
     }
-    // Done and Cancel, painted under the box (above it near the bottom of the view).
+    if k.min.x > b.min.x {
+        painter.rect_filled(Rect::from_min_max(Pos2::new(b.min.x, k.min.y), Pos2::new(k.min.x, k.max.y)), CornerRadius::ZERO, dim);
+    }
+    if k.max.x < b.max.x {
+        painter.rect_filled(Rect::from_min_max(Pos2::new(k.max.x, k.min.y), Pos2::new(b.max.x, k.max.y)), CornerRadius::ZERO, dim);
+    }
+
+    // Rule-of-Thirds Grid inside crop area
+    draw_rule_of_thirds(painter, k, Stroke::new(1.0, CROP_ACCENT.gamma_multiply(0.45)));
+
+    // Crop border stroke
+    painter.rect_stroke(k, CornerRadius::ZERO, Stroke::new(1.5, CROP_ACCENT), egui::StrokeKind::Outside);
+
+    // Crop handles
+    for (idx, h) in crop_handles(k).iter().enumerate() {
+        let is_active = mode.drag.as_ref().is_some_and(|d| d.0 == idx);
+        let is_hovered = hover_pos.is_some_and(|p| p.distance(*h) < 10.0);
+        draw_handle(painter, *h, is_active, is_hovered, true, CROP_ACCENT);
+    }
+
+    // Action pills
     let font = egui::FontId::proportional(12.5);
-    let pill = |label: &str, right: f32, y: f32| -> Rect {
-        let w = painter.layout_no_wrap(label.to_string(), font.clone(), Color32::WHITE).size().x + 20.0;
-        Rect::from_min_size(Pos2::new(right - w, y), egui::vec2(w, 22.0))
+    let done_w = painter.layout_no_wrap(tl!("Done").to_string(), font.clone(), Color32::WHITE).size().x + 22.0;
+    let cancel_w = painter.layout_no_wrap(tl!("Cancel").to_string(), font.clone(), Color32::WHITE).size().x + 22.0;
+    let initial_keep = image.visible_rect.unwrap_or(image.rect);
+    let has_crop = image.has_editor_crop() || !same_rect(mode.keep, initial_keep);
+    let reset_w =
+        if has_crop { Some(painter.layout_no_wrap(tl!("Remove Crop").to_string(), font.clone(), Color32::WHITE).size().x + 22.0) } else { None };
+    let spacing = 6.0;
+    let total_w = done_w + spacing + cancel_w + reset_w.map_or(0.0, |w| w + spacing);
+
+    // Position pills below crop box if there's room, otherwise above
+    let y = if k.max.y + 32.0 < xf.rect.max.y {
+        k.max.y + 6.0
+    } else if k.min.y - 28.0 > xf.rect.min.y {
+        k.min.y - 28.0
+    } else {
+        k.max.y + 6.0
     };
-    let y = if k.max.y + 30.0 < xf.rect.max.y { k.max.y + 6.0 } else { k.min.y - 28.0 };
-    let done = pill(tl!("Done"), k.max.x, y);
-    let cancel = pill(tl!("Cancel"), done.min.x - 6.0, y);
+
+    // Right-align pills with k.max.x, clamped inside the page bounds
+    let mut right = k.max.x.min(xf.rect.max.x - 8.0);
+    if right - total_w < xf.rect.min.x + 8.0 {
+        right = (xf.rect.min.x + 8.0 + total_w).min(xf.rect.max.x - 8.0);
+    }
+
+    let done = Rect::from_min_size(Pos2::new(right - done_w, y), egui::vec2(done_w, 22.0));
+    let cancel = Rect::from_min_size(Pos2::new(done.min.x - spacing - cancel_w, y), egui::vec2(cancel_w, 22.0));
+    let reset = reset_w.map(|w| Rect::from_min_size(Pos2::new(cancel.min.x - spacing - w, y), egui::vec2(w, 22.0)));
+
+    let done_id = ui.scope_id().with("crop_pill_done").with(page).with(i);
+    let cancel_id = ui.scope_id().with("crop_pill_cancel").with(page).with(i);
+    let reset_id = ui.scope_id().with("crop_pill_reset").with(page).with(i);
+
+    let done_resp = ui.interact(done, done_id, egui::Sense::click());
+    let cancel_resp = ui.interact(cancel, cancel_id, egui::Sense::click());
+    let reset_resp = reset.map(|r| ui.interact(r, reset_id, egui::Sense::click()));
+    done_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, allow_interaction, tl!("Done")));
+    cancel_resp.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, allow_interaction, tl!("Cancel")));
+    if let Some(response) = &reset_resp {
+        response.widget_info(|| egui::WidgetInfo::labeled(egui::Role::Button, allow_interaction, tl!("Remove Crop")));
+    }
+
     let t = crate::theme::Tokens::get(ui.ctx());
-    painter.rect_filled(done, CornerRadius::same(11), ACCENT);
+
+    // Done button (accent colored)
+    let done_bg = if done_resp.is_pointer_button_down_on() {
+        ACCENT.gamma_multiply(0.8)
+    } else if done_resp.hovered() {
+        Color32::from_rgb(40, 145, 255)
+    } else {
+        ACCENT
+    };
+    painter.rect_filled(done, CornerRadius::same(11), done_bg);
     painter.text(done.center(), egui::Align2::CENTER_CENTER, tl!("Done"), font.clone(), Color32::WHITE);
-    painter.rect(cancel, CornerRadius::same(11), t.panel, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
-    painter.text(cancel.center(), egui::Align2::CENTER_CENTER, tl!("Cancel"), font, t.text);
-    // Cropping takes over its page's cursor, and the buttons' wherever they are; other pages
-    // keep theirs.
-    if let Some(p) = hover_pos.filter(|p| xf.rect.contains(*p) || done.contains(*p) || cancel.contains(*p)) {
-        let icon = if let Some(g) = crop_handles(k).iter().position(|h| h.distance(p) < 8.0) {
-            match g {
-                0 | 3 => egui::CursorIcon::ResizeNwSe,
-                1 | 2 => egui::CursorIcon::ResizeNeSw,
-                4 | 6 => egui::CursorIcon::ResizeVertical,
-                _ => egui::CursorIcon::ResizeHorizontal,
-            }
-        } else if done.contains(p) || cancel.contains(p) {
+
+    let neutral_pill = |r: Rect, response: &egui::Response, label: &str| {
+        let background = if response.is_pointer_button_down_on() {
+            t.pressed
+        } else if response.hovered() {
+            t.hover
+        } else {
+            t.card
+        };
+        let border = Stroke::new(1.0, if response.hovered() { ACCENT } else { t.border });
+        let text = if response.hovered() { ACCENT } else { t.text };
+        painter.rect(r, CornerRadius::same(11), background, border, egui::StrokeKind::Inside);
+        painter.text(r.center(), egui::Align2::CENTER_CENTER, label, font.clone(), text);
+    };
+    neutral_pill(cancel, &cancel_resp, tl!("Cancel"));
+    if let (Some(r), Some(response)) = (reset, reset_resp.as_ref()) {
+        neutral_pill(r, response, tl!("Remove Crop"));
+    }
+
+    if let Some(p) = hover_pos {
+        let icon = if done_resp.hovered()
+            || cancel_resp.hovered()
+            || reset_resp.as_ref().is_some_and(|r| r.hovered())
+            || done.contains(p)
+            || cancel.contains(p)
+            || reset.is_some_and(|r| r.contains(p))
+        {
             egui::CursorIcon::PointingHand
+        } else if let Some(&g) = crop_handles(k).iter().position(|h| h.distance(p) < 8.0).and_then(|g| GRIPS.get(g)) {
+            g.cursor_icon()
         } else if k.contains(p) {
-            egui::CursorIcon::Move
+            if mode.drag.is_some() { egui::CursorIcon::Grabbing } else { egui::CursorIcon::Grab }
         } else {
             egui::CursorIcon::Default
         };
         view.cursor.claim(Layer::Editor, icon);
     }
-    let clicked = |r: Rect| allow_interaction && resp.clicked() && hover_pos.is_some_and(|p| r.contains(p));
+
     let keys = |key: egui::Key| allow_interaction && ui.input(|inp| inp.key_pressed(key)) && !ui.ctx().egui_wants_keyboard_input();
-    if clicked(done) || keys(egui::Key::Enter) {
+    let done_clicked = allow_interaction && (done_resp.clicked() || (resp.clicked() && hover_pos.is_some_and(|p| done.contains(p))));
+    let cancel_clicked = allow_interaction && (cancel_resp.clicked() || (resp.clicked() && hover_pos.is_some_and(|p| cancel.contains(p))));
+    let reset_clicked = allow_interaction
+        && reset
+            .is_some_and(|r| reset_resp.as_ref().is_some_and(|res| res.clicked()) || (resp.clicked() && hover_pos.is_some_and(|p| r.contains(p))));
+
+    if reset_clicked {
+        mode.keep = if image.has_editor_crop() { image.rect } else { initial_keep };
+        mode.drag = None;
+    } else if done_clicked || keys(egui::Key::Enter) {
         let keep = mode.keep;
         if let Some(s) = view.image_selection.as_mut() {
             s.crop = None;
         }
-        if keep_screen(keep) != b {
+        let is_full = same_rect(keep, image.rect);
+        if is_full {
+            if image.has_editor_crop() {
+                view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::RemoveCrop });
+            }
+        } else if image.visible_rect != Some(keep) {
             view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Crop(keep) });
         }
-    } else if (clicked(cancel) || keys(egui::Key::Escape))
+    } else if (cancel_clicked || keys(egui::Key::Escape))
         && let Some(s) = view.image_selection.as_mut()
     {
         s.crop = None;
@@ -202,12 +458,6 @@ fn crop_input(cx: &ImageCx<'_>, view: &mut DocView, i: usize, b: Rect) -> bool {
     true
 }
 
-impl ImageSelection {
-    pub(crate) fn dragging(&self) -> bool {
-        self.drag.is_some()
-    }
-}
-
 /// The page raster's picture of the box `from`, stretched into `to`, over blanks at `blank` (where
 /// the screen may still show the picture).
 fn stretched_picture(painter: &egui::Painter, xf: &PageXform, tex: egui::TextureId, blank: &[Rect], from: Rect, to: Rect) {
@@ -215,19 +465,32 @@ fn stretched_picture(painter: &egui::Painter, xf: &PageXform, tex: egui::Texture
     for r in blank {
         clipped.rect_filled(*r, CornerRadius::ZERO, Color32::WHITE);
     }
+    mapped_picture(
+        &clipped,
+        xf,
+        tex,
+        [from.left_top(), from.right_top(), from.right_bottom(), from.left_bottom()],
+        [to.left_top(), to.right_top(), to.right_bottom(), to.left_bottom()],
+    );
+}
+
+fn mapped_picture(painter: &egui::Painter, xf: &PageXform, tex: egui::TextureId, from: [Pos2; 4], to: [Pos2; 4]) {
     let mut mesh = egui::Mesh::with_texture(tex);
-    for (a, b) in [
-        (from.left_top(), to.left_top()),
-        (from.right_top(), to.right_top()),
-        (from.right_bottom(), to.right_bottom()),
-        (from.left_bottom(), to.left_bottom()),
-    ] {
-        let (u, v) = xf.screen_to_norm(a);
-        mesh.vertices.push(egui::epaint::Vertex { pos: b, uv: Pos2::new(u, v), color: Color32::WHITE });
+    for (from, to) in from.into_iter().zip(to) {
+        let (u, v) = xf.screen_to_norm(from);
+        mesh.vertices.push(egui::epaint::Vertex { pos: to, uv: Pos2::new(u, v), color: Color32::WHITE });
     }
     mesh.add_triangle(0, 1, 2);
     mesh.add_triangle(0, 2, 3);
-    clipped.add(egui::Shape::mesh(mesh));
+    painter.add(egui::Shape::mesh(mesh));
+}
+
+fn picture_frame(painter: &egui::Painter, obb: &ImageObb, upright: Rect, fill: Color32, stroke: Stroke) {
+    if obb.is_rotated {
+        painter.polygon(obb.corners().to_vec(), fill, stroke);
+    } else if upright.is_positive() {
+        painter.rect(upright, CornerRadius::ZERO, fill, stroke, egui::StrokeKind::Outside);
+    }
 }
 
 /// The selected picture's grips under `p`: its corners and its rotate knob. They are asked after
@@ -244,14 +507,16 @@ pub(crate) fn handle_hit(
     p: Pos2,
 ) -> Option<Hit> {
     let s = view.image_selection.as_ref().filter(|s| s.page == page && s.crop.is_none())?;
-    let b = images.get(s.index)?.visible_rect.map(|r| xf.user_rect(info, page, r.map(|v| v as f32)))?;
+    let image = images.get(s.index)?;
+    let b = image_screen_rect(image, xf, info, page);
+    let obb = ImageObb::from_image(image, xf, info, page);
     let picture = |part| Owner::Picture { index: s.index, part };
-    if rotate_knob(b, clip).0.distance(p) < 8.0 {
+    let knob = if obb.is_rotated { obb.s_rot } else { rotate_knob(b, clip).0 };
+    if knob.distance(p) < 8.0 {
         return Some(Hit::new(picture(PicturePart::Knob), Layer::Handle, egui::CursorIcon::Grab));
     }
-    let corner = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()].iter().position(|c| c.distance(p) < 8.0)?;
-    let icon = if matches!(corner, 0 | 3) { egui::CursorIcon::ResizeNwSe } else { egui::CursorIcon::ResizeNeSw };
-    Some(Hit::new(picture(PicturePart::Corner(corner)), Layer::Handle, icon))
+    let (grip, (handle, _)) = obb.handles().into_iter().enumerate().find(|(_, (_, point))| point.distance(p) < 8.0)?;
+    Some(Hit::new(picture(PicturePart::Corner(grip)), Layer::Handle, obb.handle_cursor(handle)))
 }
 
 /// The picture under `p` (its shape, not only its box): a click selects it, a drag moves the
@@ -273,7 +538,7 @@ pub(crate) fn body_hit(xf: &PageXform, page: usize, info: &DocInfo, images: &[pd
 
 /// What a right-click on a selected image asks for.
 #[derive(Clone, Copy, Debug, PartialEq)]
-pub(crate) enum ImageAction {
+pub enum ImageAction {
     Replace(usize, usize),
     Save(usize, usize),
     Copy(usize, usize),
@@ -286,6 +551,9 @@ pub(crate) enum ImageAction {
     Link(usize, usize),
     /// Open Recognize Text for the picture's page.
     Recognize(usize),
+    Paste(usize, Option<[f64; 2]>),
+    DrawFreehand,
+    AddComment(usize, usize),
 }
 
 /// Where the rotate knob sits, and the edge point its stem starts from: above the middle of the
@@ -295,196 +563,43 @@ pub(super) fn rotate_knob(b: Rect, view: Rect) -> (Pos2, Pos2) {
     if above.y - 6.0 >= view.top() { (above, b.center_top()) } else { (b.center_bottom() + egui::vec2(0.0, 22.0), b.center_bottom()) }
 }
 
-/// Degrees clockwise (-180..=180) that turn "straight up" from `centre` onto the pointer; `snap`
+/// Degrees clockwise (-180..=180) that turn from `start` onto `pointer` around `centre`; `snap`
 /// rounds to steps of 15 degrees (Shift). A pointer on the centre turns nothing.
-pub(super) fn turn_degrees(centre: Pos2, pointer: Pos2, snap: bool) -> f32 {
-    let v = pointer - centre;
-    if !(v.x.is_finite() && v.y.is_finite()) || v.length() < 4.0 {
+pub(super) fn turn_degrees_delta(centre: Pos2, start: Pos2, pointer: Pos2, snap: bool) -> f32 {
+    let v_start = start - centre;
+    let v_curr = pointer - centre;
+    if !(v_curr.x.is_finite() && v_curr.y.is_finite())
+        || v_curr.length() < 4.0
+        || !(v_start.x.is_finite() && v_start.y.is_finite())
+        || v_start.length() < 4.0
+    {
         return 0.0;
     }
     // Screen y points down: up is (0, -1); clockwise is atan2(x, -y).
-    let d = v.x.atan2(-v.y).to_degrees();
+    let theta_start = v_start.x.atan2(-v_start.y).to_degrees();
+    let theta_curr = v_curr.x.atan2(-v_curr.y).to_degrees();
+    let mut d = theta_curr - theta_start;
+    d = ((d + 180.0).rem_euclid(360.0)) - 180.0;
     if snap { (d / 15.0).round() * 15.0 } else { d }
 }
 
-/// Which boxes are outlined on the page, and why.
-struct OutlineState {
-    selected: Option<usize>,
-    hovered_box: Option<usize>,
-    /// The picture being dragged, whose outline would trail behind until the release.
-    moving: Option<usize>,
-    dragging: bool,
-    /// Few images: faint outlines for all of them.
-    faint_all: bool,
+/// Degrees clockwise (-180..=180) that turn "straight up" from `centre` onto the pointer; `snap`
+/// rounds to steps of 15 degrees (Shift). A pointer on the centre turns nothing.
+#[cfg(test)]
+pub(super) fn turn_degrees(centre: Pos2, pointer: Pos2, snap: bool) -> f32 {
+    turn_degrees_delta(centre, centre - egui::vec2(0.0, 10.0), pointer, snap)
 }
 
-/// Outlines the images: all of them faintly when there are few, else the selected and hovered
-/// ones; the hovered or selected one is emphasised.
-fn draw_outlines(painter: &egui::Painter, boxes: &[Rect], state: OutlineState) {
-    let OutlineState { selected, hovered_box, moving, dragging, faint_all } = state;
-    if faint_all {
-        for (_, b) in boxes.iter().enumerate().filter(|(i, b)| b.is_positive() && moving != Some(*i)) {
-            painter.rect_stroke(*b, CornerRadius::ZERO, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
-        }
-    }
-    if !faint_all {
-        for i in selected.filter(|_| moving.is_none()).into_iter().chain(hovered_box.filter(|h| Some(*h) != selected)) {
-            if let Some(b) = boxes.get(i).filter(|b| b.is_positive()) {
-                painter.rect_stroke(*b, CornerRadius::ZERO, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
-            }
-        }
-    }
-    for i in selected.into_iter().chain(hovered_box).collect::<Vec<_>>() {
-        let Some(b) = boxes.get(i).copied().filter(|b| b.is_positive()) else { continue };
-        if selected == Some(i) {
-            // The selected frame and handles are drawn below (or the drag preview instead).
-            if !dragging {
-                painter.rect_filled(b, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
-            }
-        } else {
-            painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
-        }
-    }
-}
-
-fn draw_handles(painter: &egui::Painter, rect: Rect) {
-    for c in [rect.left_top(), rect.right_top(), rect.left_bottom(), rect.right_bottom()] {
-        painter.rect(
-            Rect::from_center_size(c, egui::vec2(8.0, 8.0)),
-            CornerRadius::ZERO,
-            Color32::WHITE,
-            Stroke::new(1.0, ACCENT),
-            egui::StrokeKind::Middle,
-        );
-    }
-}
-
-/// Turning the picture by its rotate handle: the turned outline as a preview (the engine redraws
-/// the pixels on release).
-fn turn_preview(cx: &ImageCx<'_>, view: &mut DocView, i: usize, b: Rect, knob: Pos2) {
-    let ImageCx { ui, resp, ptr, page, .. } = *cx;
-    let painter = ui.painter();
-    let hover_pos = ptr.pos;
-    let shift = ui.input(|i| i.modifiers.shift);
-    let degrees = hover_pos.map_or(0.0, |p| turn_degrees(b.center(), p, shift));
-    // The turned outline as a preview; the engine redraws the pixels on release.
-    let centre = b.center();
-    let (sin, cos) = degrees.to_radians().sin_cos();
-    let turn = |c: Pos2| {
-        let v = c - centre;
-        centre + egui::vec2(v.x * cos - v.y * sin, v.x * sin + v.y * cos)
-    };
-    let outline = [b.left_top(), b.right_top(), b.right_bottom(), b.left_bottom()].map(turn).to_vec();
-    painter.add(egui::Shape::closed_line(outline, Stroke::new(1.5, ACCENT)));
-    let galley = painter.layout_no_wrap(format!("{degrees:.0}\u{b0}"), egui::FontId::proportional(12.0), ACCENT);
-    let label = Rect::from_center_size(turn(knob) - egui::vec2(0.0, 14.0), galley.size() + egui::vec2(8.0, 4.0));
-    painter.rect(label, CornerRadius::same(3), Color32::WHITE, Stroke::new(1.0, ACCENT), egui::StrokeKind::Middle);
-    painter.galley(label.center() - galley.size() / 2.0, galley, ACCENT);
-    view.cursor.claim(Layer::Drag, egui::CursorIcon::Grabbing);
-    if resp.drag_stopped() || !ptr.primary_down {
-        if let Some(s) = view.image_selection.as_mut() {
-            s.drag = None;
-            s.turning = false;
-        }
-        if degrees.abs() >= 0.05 {
-            view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::RotateBy(f64::from(degrees)) });
-        }
-    }
-}
-
-/// Where the screen may still show the picture from before an applied move, and whether the
-/// page's whole raster is the old one.
-#[derive(Clone, Copy)]
-struct Blanked {
-    left_at: Option<Rect>,
-    raster_old: bool,
-}
-
-/// A frame of the picture being moved or resized: the stretched picture, its frame and handles,
-/// and on release the edit.
-fn drag_preview(
-    cx: &ImageCx<'_>,
-    images: &[pdfcraft_engine::PageImage],
-    view: &mut DocView,
-    (i, b): (usize, Rect),
-    (start, opposite, p): (Pos2, Option<Pos2>, Pos2),
-    blanked: Blanked,
-) {
-    let ImageCx { ui, resp, xf, ptr, page, info, .. } = *cx;
-    let painter = ui.painter();
-    let Blanked { left_at, raster_old } = blanked;
-    let screen = |r: Rect| Rect::from_two_pos(xf.norm_to_screen(r.min.x, r.min.y), xf.norm_to_screen(r.max.x, r.max.y));
-    let preview = match opposite {
-        // Resize from the opposite corner, keeping the aspect ratio.
-        Some(fixed) => {
-            let (w0, h0) = (b.width().max(1.0), b.height().max(1.0));
-            // Use the axis with the larger relative pointer change. Taking the maximum
-            // absolute size freezes shrinking when the other axis hasn't moved. Measure
-            // from the press point so grabbing a handle off-centre cannot cause a jump.
-            let horizontal = (p.x - start.x) * (start.x - fixed.x).signum() / w0;
-            let vertical = (p.y - start.y) * (start.y - fixed.y).signum() / h0;
-            let delta = if horizontal.abs() > vertical.abs() { horizontal } else { vertical };
-            let k = (1.0 + delta).max(0.05);
-            let (w, h) = (w0 * k, h0 * k);
-            let x = if start.x < fixed.x { fixed.x - w } else { fixed.x };
-            let y = if start.y < fixed.y { fixed.y - h } else { fixed.y };
-            Rect::from_min_size(Pos2::new(x, y), egui::vec2(w, h))
-        }
-        None => b.translate(p - start),
-    };
-    // Move/resize the full placement by the visible frame's change. The engine
-    // transforms an isolated crop together with its image, preserving its contents.
-    let raw = images.get(i).map_or(b, |im| xf.user_rect(info, page, im.rect.map(|v| v as f32)));
-    // A zero-width or zero-height visible frame (or a degenerate ratio) keeps the
-    // placement's scale instead of producing inf/NaN.
-    let ratio = |new: f32, old: f32| if old.abs() > 1e-3 && (new / old).is_finite() { new / old } else { 1.0 };
-    let factor = egui::vec2(ratio(preview.width(), b.width()), ratio(preview.height(), b.height()));
-    let target = Rect::from_min_max(preview.min + (raw.min - b.min) * factor, preview.min + (raw.max - b.min) * factor);
-    let visible = preview.intersect(xf.rect);
-    if visible.is_positive() {
-        // The pixels follow the frame: the page raster's picture of the image, stretched
-        // into the preview over a blank where it was. Re-rendering every frame of a drag
-        // would lag; the edit renders it properly on release.
-        if preview != b
-            && let Some(tex) = view.page_raster(page)
-        {
-            // Its pixels: where the whole-page raster has it.
-            let source = left_at.filter(|_| raster_old).map_or(b, screen);
-            let blank: Vec<Rect> = left_at.map(screen).into_iter().chain(std::iter::once(b)).collect();
-            stretched_picture(painter, xf, tex, &blank, source, preview);
-        }
-        painter.rect_filled(visible, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
-        painter.rect_stroke(visible, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-        draw_handles(painter, preview);
-    }
-    if resp.drag_stopped() || !ptr.primary_down {
-        if let Some(s) = view.image_selection.as_mut() {
-            s.drag = None;
-            let norm = |r: Rect| {
-                let ((u0, v0), (u1, v1)) = (xf.screen_to_norm(r.min), xf.screen_to_norm(r.max));
-                Rect::from_two_pos(Pos2::new(u0, v0), Pos2::new(u1, v1))
-            };
-            s.settled = (preview != b).then(|| (left_at.unwrap_or_else(|| norm(b)), norm(preview)));
-        }
-        if preview != b {
-            view.pending_edit =
-                Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Move(user_box(xf, info, page, target)) });
-        }
-    }
-    view.cursor.claim(
-        Layer::Drag,
-        match opposite {
-            Some(fixed) if (start.x - fixed.x) * (start.y - fixed.y) < 0.0 => egui::CursorIcon::ResizeNeSw,
-            Some(_) => egui::CursorIcon::ResizeNwSe,
-            None => egui::CursorIcon::Move,
-        },
-    );
+#[doc(hidden)]
+pub fn image_menu_id() -> egui::Id {
+    egui::Id::unique("image-menu")
 }
 
 /// Images on a page: select, move, resize, right-click. Returns `true` when the pointer was used.
-pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage], view: &mut DocView, action: &mut Option<ImageAction>) -> bool {
+#[allow(clippy::cognitive_complexity)]
+pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage], view: &mut DocView) -> bool {
     let ImageCx { ui, resp, xf, ptr, page, info, allow_interaction } = *cx;
-    let boxes: Vec<Rect> = images.iter().map(|im| im.visible_rect.map_or(Rect::NOTHING, |r| xf.user_rect(info, page, r.map(|v| v as f32)))).collect();
+    let boxes: Vec<Rect> = images.iter().map(|im| crate::canvas::image_screen_rect(im, xf, info, page)).collect();
     let painter = ui.painter();
     let hover_pos = ptr.pos;
     let image_contains = |index: usize, point: Pos2| {
@@ -495,32 +610,58 @@ pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage
     };
     let selected = view.image_selection.as_ref().filter(|s| s.page == page).map(|s| s.index).filter(|i| *i < boxes.len());
     let dragging = view.image_selection.as_ref().is_some_and(|s| s.drag.is_some());
-    // Few images: faint outlines for all of them, as before. Many: only the selected and
-    // hovered boxes, so a ~1000-image CAD page stays interactive in Edit text & images.
-    // Fully clipped placements (empty visible frames) get no outline.
     let faint_all = boxes.len() <= MAX_OUTLINES;
-    // The picture being dragged has its frame at the pointer; its outline where it was would
-    // trail behind until the release.
     let moving = selected.filter(|_| dragging);
-    let hovered_box = hover_pos.and_then(|p| boxes.iter().enumerate().rposition(|(i, b)| b.is_positive() && b.contains(p) && image_contains(i, p)));
-    draw_outlines(painter, &boxes, OutlineState { selected, hovered_box, moving, dragging, faint_all });
+    if faint_all {
+        for (idx, im) in images.iter().enumerate() {
+            if moving == Some(idx) {
+                continue;
+            }
+            if let Some(b) = boxes.get(idx).filter(|b| b.is_positive()) {
+                let obb = ImageObb::from_image(im, xf, info, page);
+                if obb.is_rotated {
+                    let pts = obb.corners();
+                    for k in 0..4 {
+                        painter.line_segment([pts[k], pts[(k + 1) % 4]], Stroke::new(0.75, ACCENT.gamma_multiply(0.35)));
+                    }
+                } else {
+                    painter.rect_stroke(*b, CornerRadius::ZERO, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)), egui::StrokeKind::Outside);
+                }
+            }
+        }
+    }
+    let hovered_box = hover_pos.and_then(|p| {
+        boxes.iter().enumerate().rposition(|(i, b)| {
+            b.is_positive() && images.get(i).is_some_and(|img| ImageObb::from_image(img, xf, info, page).contains(*b, p)) && image_contains(i, p)
+        })
+    });
+    if !faint_all {
+        for i in selected.filter(|_| moving.is_none()).into_iter().chain(hovered_box.filter(|h| Some(*h) != selected)) {
+            if let (Some(b), Some(img)) = (boxes.get(i).filter(|b| b.is_positive()), images.get(i)) {
+                let obb = ImageObb::from_image(img, xf, info, page);
+                picture_frame(painter, &obb, *b, Color32::TRANSPARENT, Stroke::new(0.75, ACCENT.gamma_multiply(0.35)));
+            }
+        }
+    }
+    for i in selected.into_iter().chain(hovered_box).collect::<Vec<_>>() {
+        let (Some(b), Some(img)) = (boxes.get(i).copied().filter(|b| b.is_positive()), images.get(i)) else { continue };
+        let obb = ImageObb::from_image(img, xf, info, page);
+        if selected == Some(i) {
+            if !dragging {
+                picture_frame(painter, &obb, b, ACCENT.gamma_multiply(0.04), Stroke::NONE);
+            }
+        } else {
+            picture_frame(painter, &obb, b, Color32::TRANSPARENT, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)));
+        }
+    }
+
     // The selected image: frame, corner handles, dragging.
     if let Some(i) = selected.filter(|i| boxes.get(*i).is_some_and(|b| b.is_positive())) {
-        let b = boxes[i];
-        if view.image_selection.as_ref().is_some_and(|s| s.crop.is_some()) {
-            return crop_input(cx, view, i, b);
-        }
-        let corners = [b.left_top(), b.right_top(), b.left_bottom(), b.right_bottom()];
-        // Until the page is rendered again its raster has an applied move or resize's picture
-        // where it was: it stays blanked there and drawn where it went.
-        // The whole-page raster and its tiles are replaced separately: the old frame stays blanked
-        // while anything still shows the picture there, but its pixels come from the old frame
-        // only while the whole-page raster itself is the old one. Once that is fresh it has the
-        // picture where it went, and that is where they come from.
+        let Some(b) = boxes.get(i).copied() else { return false };
+        let Some(image) = images.get(i) else { return false };
+        let obb = ImageObb::from_image(image, xf, info, page);
         let (out_of_date, raster_old, raster) = (view.page_out_of_date(page), view.page_raster_out_of_date(page), view.page_raster(page));
         let screen = |r: Rect| Rect::from_two_pos(xf.norm_to_screen(r.min.x, r.min.y), xf.norm_to_screen(r.max.x, r.max.y));
-        // Where the screen may still show the picture from before an applied move, while the page
-        // isn't drawn again yet. Another drag keeps it blanked too.
         let left_at = view.image_selection.as_ref().and_then(|s| s.settled).filter(|_| out_of_date).map(|(from, _)| from);
         if let Some(s) = view.image_selection.as_mut().filter(|s| s.drag.is_none()) {
             match (s.settled, raster) {
@@ -528,45 +669,254 @@ pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage
                     let source = if raster_old { from } else { to };
                     stretched_picture(painter, xf, tex, &[screen(from)], screen(source), screen(to));
                 }
-                _ => s.settled = None,
+                _ if !out_of_date => s.settled = None,
+                _ => {}
             }
         }
-        if view.image_selection.as_ref().is_some_and(|s| s.drag.is_none()) {
-            painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
-            draw_handles(painter, b);
+
+        if view.image_selection.as_ref().is_some_and(|s| s.crop.is_some()) {
+            return crop_input(cx, view, i, image);
         }
-        // The rotate handle: a knob above the top edge, joined to it by a short stem.
         let (knob, stem) = rotate_knob(b, ui.clip_rect());
+        let shown_knob = if obb.is_rotated { obb.s_rot } else { knob };
         if view.image_selection.as_ref().is_some_and(|s| s.drag.is_none()) {
-            painter.line_segment([stem, knob], Stroke::new(1.0, ACCENT));
-            painter.circle(knob, 5.0, Color32::WHITE, Stroke::new(1.0, ACCENT));
+            picture_frame(painter, &obb, b, Color32::TRANSPARENT, Stroke::new(1.5, ACCENT));
+            if obb.is_rotated {
+                painter.line_segment([obb.s_tc, obb.s_rot], Stroke::new(1.2, ACCENT));
+                painter.circle(obb.s_rot, 4.5, Color32::WHITE, Stroke::new(1.0, ACCENT));
+            } else {
+                painter.line_segment([stem, knob], Stroke::new(1.0, ACCENT));
+                painter.circle(knob, 5.0, Color32::WHITE, Stroke::new(1.0, ACCENT));
+            }
+            for (_, h) in obb.handles() {
+                let is_hovered = hover_pos.is_some_and(|p| p.distance(h) < 10.0);
+                draw_handle(painter, h, false, is_hovered, false, ACCENT);
+            }
         }
-        // A drag on what the press was on ([`handle_hit`], [`body_hit`]): the knob turns the
-        // picture, a corner resizes it from the opposite one, the picture itself moves.
-        if allow_interaction
-            && resp.drag_started()
-            && let Some(o) = ptr.origin
-            && let Some(Owner::Picture { index, part }) = view.router.owner(page)
-            && index == i
-            && let Some(s) = view.image_selection.as_mut()
-        {
-            match part {
-                PicturePart::Knob => {
-                    s.drag = Some((o, None));
+
+        let mut handle_drag = None;
+        for (h, h_pos) in obb.handles() {
+            let handle_rect = Rect::from_center_size(h_pos, egui::vec2(18.0, 18.0));
+            let handle_resp = ui.interact(handle_rect, ui.scope_id().with("img_handle").with(h), egui::Sense::drag());
+            if allow_interaction && handle_resp.drag_started() {
+                handle_drag = Some(h);
+            }
+        }
+        let rot_id = ui.scope_id().with("img_handle").with(8);
+        let rot_rect = Rect::from_center_size(shown_knob, egui::vec2(12.0, 12.0));
+        let rot_resp = ui.interact(rot_rect, rot_id, egui::Sense::drag());
+        let rot_drag = allow_interaction && rot_resp.drag_started();
+
+        if allow_interaction && let Some(p) = hover_pos {
+            if shown_knob.distance(p) < 8.0 {
+                view.cursor.claim(Layer::Handle, egui::CursorIcon::Grab);
+            } else if let Some((h, _)) = obb.handles().iter().find(|(_, pos)| pos.distance(p) < 8.0) {
+                let icon = obb.handle_cursor(*h);
+                view.cursor.claim(Layer::Handle, icon);
+            }
+        }
+
+        let origin = ptr.origin;
+        if allow_interaction {
+            if let Some(h) = handle_drag {
+                if let Some(s) = view.image_selection.as_mut() {
+                    let o = origin.unwrap_or_else(|| obb.handle_pos(h));
+                    s.drag = Some(ImageDrag {
+                        start: o,
+                        target: DragTarget::Handle(h),
+                        initial_rect: b,
+                        initial_matrix: resize_frame(&obb, xf, info, page).0,
+                    });
+                }
+            } else if rot_drag {
+                if let Some(s) = view.image_selection.as_mut() {
+                    let o = origin.unwrap_or(shown_knob);
+                    s.drag = Some(ImageDrag { start: o, target: DragTarget::Rotate, initial_rect: b, initial_matrix: image.matrix });
                     s.turning = true;
                 }
-                PicturePart::Corner(k) => s.drag = Some((o, 3usize.checked_sub(k).and_then(|opposite| corners.get(opposite)).copied())),
-                PicturePart::Body => s.drag = Some((o, None)),
+            } else if resp.drag_started()
+                && let Some(o) = origin
+            {
+                if shown_knob.distance(o) < 8.0 {
+                    if let Some(s) = view.image_selection.as_mut() {
+                        s.drag = Some(ImageDrag { start: o, target: DragTarget::Rotate, initial_rect: b, initial_matrix: image.matrix });
+                        s.turning = true;
+                    }
+                } else if let Some((h, _)) = obb.handles().iter().find(|(_, pos)| pos.distance(o) < 8.0) {
+                    if let Some(s) = view.image_selection.as_mut() {
+                        s.drag = Some(ImageDrag {
+                            start: o,
+                            target: DragTarget::Handle(*h),
+                            initial_rect: b,
+                            initial_matrix: resize_frame(&obb, xf, info, page).0,
+                        });
+                    }
+                } else if (image_contains(i, o) || quad_contains(obb.corners(), o))
+                    && let Some(s) = view.image_selection.as_mut()
+                {
+                    s.drag = Some(ImageDrag { start: o, target: DragTarget::Move, initial_rect: b, initial_matrix: image.matrix });
+                }
             }
         }
+
         if view.image_selection.as_ref().is_some_and(|s| s.turning) {
-            turn_preview(cx, view, i, b, knob);
+            let shift = ui.input(|i| i.modifiers.shift);
+            let visible = image.visible_rect.unwrap_or(image.rect);
+            let centre = user_to_screen(xf, info, page, visible[0] * 0.5 + visible[2] * 0.5, visible[1] * 0.5 + visible[3] * 0.5);
+            let rot_knob = shown_knob;
+            let drag_start = view.image_selection.as_ref().and_then(|s| s.drag).map_or(rot_knob, |d| d.start);
+            let degrees = hover_pos.map_or(0.0, |p| turn_degrees_delta(centre, drag_start, p, shift));
+            let (sin, cos) = degrees.to_radians().sin_cos();
+            let turn = |c: Pos2| {
+                let v = c - centre;
+                centre + egui::vec2(v.x * cos - v.y * sin, v.x * sin + v.y * cos)
+            };
+            let outline = obb.corners().map(turn).to_vec();
+            painter.add(egui::Shape::closed_line(outline, Stroke::new(1.5, ACCENT)));
+            let galley = painter.layout_no_wrap(format!("{degrees:.0}\u{b0}"), egui::FontId::proportional(12.0), ACCENT);
+            let label = Rect::from_center_size(turn(rot_knob) - egui::vec2(0.0, 14.0), galley.size() + egui::vec2(8.0, 4.0));
+            painter.rect(label, CornerRadius::same(3), Color32::WHITE, Stroke::new(1.0, ACCENT), egui::StrokeKind::Middle);
+            painter.galley(label.center() - galley.size() / 2.0, galley, ACCENT);
+            view.cursor.claim(Layer::Drag, egui::CursorIcon::Grabbing);
+            if resp.drag_stopped() || !ptr.primary_down {
+                if let Some(s) = view.image_selection.as_mut() {
+                    s.drag = None;
+                    s.turning = false;
+                }
+                if degrees.abs() >= 0.05 {
+                    view.pending_edit =
+                        Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::RotateBy(f64::from(degrees)) });
+                }
+            }
             return true;
         }
-        if let Some((start, opposite)) = view.image_selection.as_ref().and_then(|s| s.drag)
+
+        if let Some(drag) = view.image_selection.as_ref().and_then(|s| s.drag)
             && let Some(p) = hover_pos
         {
-            drag_preview(cx, images, view, (i, b), (start, opposite, p), Blanked { left_at, raster_old });
+            if !obb.is_rotated && !matches!(drag.target, DragTarget::Rotate) {
+                let preview = match drag.target {
+                    DragTarget::Handle(handle) => {
+                        let delta = p - drag.start;
+                        let is_corner =
+                            matches!(handle, ImageHandle::TopLeft | ImageHandle::TopRight | ImageHandle::BottomLeft | ImageHandle::BottomRight);
+                        let shift = ui.input(|inp| inp.modifiers.shift);
+                        if is_corner && !shift {
+                            apply_resize_proportional(drag.initial_rect, handle, delta)
+                        } else {
+                            apply_resize(drag.initial_rect, handle, delta)
+                        }
+                    }
+                    DragTarget::Move => drag.initial_rect.translate(p - drag.start),
+                    _ => drag.initial_rect,
+                };
+
+                let raw = images.get(i).map_or(b, |im| xf.user_rect(info, page, im.rect.map(|v| v as f32)));
+                let ratio = |new: f32, old: f32| if old.abs() > 1e-3 && (new / old).is_finite() { new / old } else { 1.0 };
+                let factor = egui::vec2(ratio(preview.width(), b.width()), ratio(preview.height(), b.height()));
+                let f_min = egui::vec2((raw.min.x - b.min.x) * factor.x, (raw.min.y - b.min.y) * factor.y);
+                let f_max = egui::vec2((raw.max.x - b.min.x) * factor.x, (raw.max.y - b.min.y) * factor.y);
+                let target = Rect::from_min_max(preview.min + f_min, preview.min + f_max);
+                let visible = preview.intersect(xf.rect);
+
+                if visible.is_positive() {
+                    if preview != b
+                        && let Some(tex) = raster
+                    {
+                        let source = left_at.filter(|_| raster_old).map_or(b, screen);
+                        let blank: Vec<Rect> = left_at.map(screen).into_iter().chain(std::iter::once(b)).collect();
+                        stretched_picture(painter, xf, tex, &blank, source, preview);
+                    }
+                    painter.rect_filled(visible, CornerRadius::ZERO, ACCENT.gamma_multiply(0.04));
+                    painter.rect_stroke(visible, CornerRadius::ZERO, Stroke::new(1.5, ACCENT), egui::StrokeKind::Outside);
+                    for h in [
+                        preview.left_top(),
+                        preview.right_top(),
+                        preview.left_bottom(),
+                        preview.right_bottom(),
+                        preview.center_top(),
+                        preview.right_center(),
+                        preview.center_bottom(),
+                        preview.left_center(),
+                    ] {
+                        draw_handle(painter, h, false, false, false, ACCENT);
+                    }
+                }
+
+                if resp.drag_stopped() || !ptr.primary_down {
+                    if let Some(s) = view.image_selection.as_mut() {
+                        s.drag = None;
+                        let norm = |r: Rect| {
+                            let ((u0, v0), (u1, v1)) = (xf.screen_to_norm(r.min), xf.screen_to_norm(r.max));
+                            Rect::from_two_pos(Pos2::new(u0, v0), Pos2::new(u1, v1))
+                        };
+                        s.settled = (preview != b).then(|| (left_at.unwrap_or_else(|| norm(b)), norm(preview)));
+                    }
+                    if preview != b {
+                        view.pending_edit =
+                            Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Move(user_box(xf, info, page, target)) });
+                    }
+                }
+
+                let icon = match drag.target {
+                    DragTarget::Handle(handle) => obb.handle_cursor(handle),
+                    DragTarget::Move => egui::CursorIcon::Grabbing,
+                    _ => egui::CursorIcon::Move,
+                };
+                view.cursor.claim(Layer::Drag, icon);
+                return true;
+            }
+            let m_init = Matrix(drag.initial_matrix);
+            let [a0, b0, c0, d0, e0, f0] = drag.initial_matrix;
+            let (sx, sy) = screen_to_user(xf, info, page, drag.start);
+            let (px, py) = screen_to_user(xf, info, page, p);
+
+            let (m_new, cursor_icon) = match drag.target {
+                DragTarget::Move => {
+                    let (dx, dy) = (px - sx, py - sy);
+                    (Matrix([a0, b0, c0, d0, e0 + dx, f0 + dy]), egui::CursorIcon::Move)
+                }
+                DragTarget::Handle(handle) => {
+                    let proportional = !ui.input(|input| input.modifiers.shift);
+                    let resized = resize_affine_frame(m_init, handle, (px - sx, py - sy), proportional).unwrap_or(m_init);
+                    (resized, obb.handle_cursor(handle))
+                }
+                // Turning is handled above.
+                DragTarget::Rotate => (m_init, egui::CursorIcon::Default),
+            };
+
+            let preview_obb = ImageObb::from_matrix(m_new.0, xf, info, page);
+            if let Some(tex) = view.page_raster(page) {
+                let clipped = painter.with_clip_rect(painter.clip_rect().intersect(xf.rect));
+                let mut from = obb.corners();
+                let mut to = preview_obb.corners();
+                from.reverse();
+                to.reverse();
+                mapped_picture(&clipped, xf, tex, from, to);
+            }
+
+            let visible = Rect::from_two_pos(preview_obb.s01, preview_obb.s10).intersect(xf.rect);
+            picture_frame(painter, &preview_obb, visible, ACCENT.gamma_multiply(0.04), Stroke::new(1.5, ACCENT));
+            for (_, h) in preview_obb.handles() {
+                draw_handle(painter, h, false, false, false, ACCENT);
+            }
+
+            if resp.drag_stopped() || !ptr.primary_down {
+                if let Some(s) = view.image_selection.as_mut() {
+                    s.drag = None;
+                }
+                if m_new.0 != drag.initial_matrix {
+                    if matches!(drag.target, DragTarget::Move) {
+                        let (dx, dy) = (px - sx, py - sy);
+                        let new_rect = [image.rect[0] + dx, image.rect[1] + dy, image.rect[2] + dx, image.rect[3] + dy];
+                        view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Move(new_rect) });
+                    } else if let Some(inv) = Matrix(drag.initial_matrix).invert() {
+                        let t = inv.then(&m_new);
+                        view.pending_edit = Some(Edit::EditPageImage { page, index: i, change: pdfcraft_engine::ImageEdit::Transform(t.0) });
+                    }
+                }
+            }
+            view.cursor.claim(Layer::Drag, cursor_icon);
             return true;
         }
         if allow_interaction
@@ -581,120 +931,201 @@ pub(crate) fn image_input(cx: &ImageCx<'_>, images: &[pdfcraft_engine::PageImage
     if !allow_interaction {
         return false;
     }
-    // An open menu stays drawn wherever the pointer is: most of its items lie outside the picture
-    // (a logo is smaller than its menu), and a menu that is not drawn for a frame cannot be clicked.
-    // Only a menu opened by a right-click on the picture: one opened over text or empty page while
-    // a picture stays selected is the page's own menu.
-    let menu_key = resp.id.with("image-menu");
-    if resp.secondary_clicked() {
-        ui.ctx().data_mut(|d| d.insert_temp(menu_key, false));
-    }
-    let mut menu_drawn = false;
-    if let Some(sel) = selected
-        && resp.context_menu_opened()
-        && ui.ctx().data(|d| d.get_temp::<bool>(menu_key)).unwrap_or(false)
-    {
-        resp.context_menu(|ui| image_menu(ui, page, sel, images, view, action));
-        menu_drawn = true;
-    }
+    let menu_key = image_menu_id();
     let Some(p) = hover_pos.filter(|p| xf.rect.contains(*p)) else { return false };
-    let Some(hit) = boxes.iter().enumerate().rposition(|(i, b)| b.contains(p) && image_contains(i, p)) else { return false };
+    let Some(hit) = boxes.iter().enumerate().rposition(|(i, b)| {
+        b.is_positive() && images.get(i).is_some_and(|img| ImageObb::from_image(img, xf, info, page).contains(*b, p)) && image_contains(i, p)
+    }) else {
+        if resp.secondary_clicked() || resp.clicked() {
+            view.image_selection = None;
+            ui.ctx().data_mut(|d| d.insert_temp(menu_key, false));
+        }
+        return false;
+    };
+    let Some(hit_img) = images.get(hit) else { return false };
+    let hit_obb = ImageObb::from_image(hit_img, xf, info, page);
     if selected != Some(hit) {
-        painter.rect_stroke(boxes[hit], CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
+        if hit_obb.is_rotated {
+            let pts = hit_obb.corners();
+            for k in 0..4 {
+                painter.line_segment([pts[k], pts[(k + 1) % 4]], Stroke::new(1.5, ACCENT.gamma_multiply(0.7)));
+            }
+        } else if let Some(b) = boxes.get(hit).copied() {
+            painter.rect_stroke(b, CornerRadius::ZERO, Stroke::new(1.5, ACCENT.gamma_multiply(0.7)), egui::StrokeKind::Outside);
+        }
     }
-    // A click selects the picture the press was on; a right-click the one under the pointer.
+    let grip = hit_obb.handles().into_iter().find(|(_, point)| point.distance(p) < 10.0);
+    let cursor = if selected == Some(hit) {
+        grip.map_or(egui::CursorIcon::Grab, |(handle, _)| hit_obb.handle_cursor(handle))
+    } else {
+        egui::CursorIcon::PointingHand
+    };
+    view.cursor.claim(Layer::Text, cursor);
     let clicked = match view.router.owner(page) {
         Some(Owner::Picture { index, .. }) if resp.clicked() => Some(index),
-        _ => resp.secondary_clicked().then_some(hit),
+        _ => (resp.clicked() || resp.secondary_clicked()).then_some(hit),
     };
     if let Some(index) = clicked {
-        view.image_selection = Some(ImageSelection { page, index, drag: None, crop: None, turning: false, settled: None });
+        view.image_selection = Some(ImageSelection::at(page, index));
     }
     if resp.secondary_clicked() {
         ui.ctx().data_mut(|d| d.insert_temp(menu_key, true));
     }
-    if selected == Some(hit) && !menu_drawn {
-        resp.context_menu(|ui| image_menu(ui, page, hit, images, view, action));
-    }
     true
 }
 
-/// The right-click menu of the picture `hit` (its rotate, flip, replace, copy, cut, redact, link,
-/// recognize and delete items).
-fn image_menu(
+/// The right-click context menu for a selected image.
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn image_context_menu(
     ui: &mut egui::Ui,
+    view: &mut DocView,
+    images: &[pdfcraft_engine::PageImage],
     page: usize,
     hit: usize,
-    images: &[pdfcraft_engine::PageImage],
-    view: &mut DocView,
+    can_paste: bool,
     action: &mut Option<ImageAction>,
+    at: Option<[f64; 2]>,
+    rotation: u16,
 ) {
+    let Some(img) = images.get(hit) else { return };
     use pdfcraft_engine::ImageEdit as E;
-    let items: [(&str, Option<E>); 4] = [
-        (tl!("Rotate Clockwise"), Some(E::Rotate(1))),
-        (tl!("Rotate Counterclockwise"), Some(E::Rotate(3))),
-        (tl!("Flip Horizontal"), Some(E::Flip { horizontal: true })),
-        (tl!("Flip Vertical"), Some(E::Flip { horizontal: false })),
-    ];
-    for (label, change) in items {
-        if ui.button(label).clicked() {
-            view.pending_edit = change.map(|c| Edit::EditPageImage { page, index: hit, change: c });
+    let raster = !img.is_form;
+
+    // Whether `entry` was clicked; a click closes the menu.
+    let picked = |ui: &mut egui::Ui, entry: egui::Response| {
+        let clicked = entry.clicked();
+        if clicked {
+            ui.ctx().data_mut(|d| d.insert_temp(image_menu_id(), false));
+            egui::Popup::close_all(ui.ctx());
             ui.close();
         }
-    }
-    // Crop: the handles trim instead of resizing until Done.
-    if ui.button(tl!("Crop Image")).clicked() {
-        if let (Some(s), Some(im)) = (view.image_selection.as_mut(), images.get(hit)) {
-            s.crop = Some(CropMode::new(im.visible_rect.unwrap_or(im.rect)));
+        clicked
+    };
+    let item = |ui: &mut egui::Ui, enabled: bool, label: &str| {
+        let entry = ui.add_enabled(enabled, egui::Button::new(label));
+        picked(ui, entry)
+    };
+    let edit = |change| Some(Edit::EditPageImage { page, index: hit, change });
+
+    // Top horizontal icon bar: Comment, Crop, Rotate CCW, Rotate CW
+    ui.horizontal(|ui| {
+        ui.spacing_mut().item_spacing.x = 4.0;
+        let icon = |ui: &mut egui::Ui, name: &str, tip: &str| {
+            let entry = crate::icons::button(ui, name, 24.0, false, tip);
+            picked(ui, entry)
+        };
+        if icon(ui, "message-square", tl!("Add a sticky note here")) {
+            *action = Some(ImageAction::AddComment(page, hit));
         }
-        ui.close();
-    }
-    let cropped = images.get(hit).is_some_and(|im| im.visible_rect.is_some_and(|v| v.iter().zip(im.rect.iter()).any(|(a, b)| (a - b).abs() > 0.01)));
-    if ui.add_enabled(cropped, egui::Button::new(tl!("Remove Crop"))).clicked() {
-        if let Some(im) = images.get(hit) {
-            view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Crop(im.rect) });
+        if raster
+            && icon(ui, "crop", tl!("Crop"))
+            && let Some(s) = view.image_selection.as_mut()
+        {
+            s.crop = Some(CropMode::new(img.visible_rect.unwrap_or(img.rect)));
         }
-        ui.close();
-    }
-    let raster = images.get(hit).is_some_and(|image| !image.is_form);
-    if ui.add_enabled(raster, egui::Button::new(tl!("Replace Image…"))).clicked() {
-        *action = Some(ImageAction::Replace(page, hit));
-        ui.close();
-    }
-    if ui.add_enabled(raster, egui::Button::new(tl!("Save Image As…"))).clicked() {
-        *action = Some(ImageAction::Save(page, hit));
-        ui.close();
-    }
-    // Cutting and copying also find the picture inside grouped Form artwork.
-    if ui.button(tl!("Cut Image")).clicked() {
+        if icon(ui, "rotate-ccw", tl!("Rotate Counterclockwise")) {
+            view.pending_edit = edit(E::Rotate(3));
+        }
+        if icon(ui, "rotate-cw", tl!("Rotate Clockwise")) {
+            view.pending_edit = edit(E::Rotate(1));
+        }
+    });
+
+    ui.separator();
+
+    if item(ui, true, tl!("Cut Image")) {
         *action = Some(ImageAction::Cut(page, hit));
-        ui.close();
     }
-    if ui.button(tl!("Copy Image")).clicked() {
+    if item(ui, true, tl!("Copy Image")) {
         *action = Some(ImageAction::Copy(page, hit));
-        ui.close();
     }
-    if ui.button(tl!("Copy Image in Original Format")).clicked() {
-        *action = Some(ImageAction::CopyFile(page, hit));
-        ui.close();
+    if item(ui, can_paste, tl!("Paste")) {
+        *action = Some(ImageAction::Paste(page, at));
     }
+
     ui.separator();
-    if ui.button(tl!("Redact Image")).clicked() {
+
+    if raster && img.has_editor_crop() && item(ui, true, tl!("Remove crop")) {
+        view.pending_edit = edit(E::RemoveCrop);
+    }
+    if item(ui, true, tl!("Flip horizontal")) {
+        view.pending_edit = edit(E::Flip { horizontal: flip_user_axis(true, rotation) });
+    }
+    if item(ui, true, tl!("Flip vertical")) {
+        view.pending_edit = edit(E::Flip { horizontal: flip_user_axis(false, rotation) });
+    }
+
+    ui.menu_button(tl!("Arrange image"), |ui| {
+        use pdfcraft_engine::ArrangeOrder as A;
+        for (order, label) in [
+            (A::BringToFront, tl!("Bring to front")),
+            (A::SendToBack, tl!("Send to back")),
+            (A::BringForward, tl!("Bring forward")),
+            (A::SendBackward, tl!("Send backward")),
+        ] {
+            if item(ui, true, label) {
+                view.pending_edit = edit(E::Arrange(order));
+            }
+        }
+    });
+
+    if item(ui, raster, tl!("Replace image")) {
+        *action = Some(ImageAction::Replace(page, hit));
+    }
+    if item(ui, raster, tl!("Save Image As…")) {
+        *action = Some(ImageAction::Save(page, hit));
+    }
+
+    ui.separator();
+
+    if item(ui, true, tl!("Draw freehand")) {
+        *action = Some(ImageAction::DrawFreehand);
+    }
+    if item(ui, true, tl!("Redact Image")) {
         *action = Some(ImageAction::Redact(page, hit));
-        ui.close();
-    }
-    if ui.button(tl!("Create Link…")).clicked() {
-        *action = Some(ImageAction::Link(page, hit));
-        ui.close();
-    }
-    if ui.button(tl!("Recognize Text…")).clicked() {
-        *action = Some(ImageAction::Recognize(page));
-        ui.close();
     }
+
     ui.separator();
-    if ui.button(tl!("Delete")).clicked() {
+
+    if item(ui, true, tl!("Create Link…")) {
+        *action = Some(ImageAction::Link(page, hit));
+    }
+    if item(ui, true, tl!("Recognize Text…")) {
+        *action = Some(ImageAction::Recognize(page));
+    }
+
+    ui.separator();
+
+    if item(ui, true, tl!("Delete")) {
         view.image_selection = None;
-        view.pending_edit = Some(Edit::EditPageImage { page, index: hit, change: E::Delete });
-        ui.close();
+        view.pending_edit = edit(E::Delete);
+    }
+}
+
+fn flip_user_axis(horizontal: bool, rotation: u16) -> bool {
+    horizontal ^ (rotation % 180 == 90)
+}
+
+#[cfg(test)]
+mod screen_orientation_tests {
+    use super::*;
+
+    #[test]
+    fn affine_resize_rejects_degenerate_or_nonfinite_frames() {
+        for frame in [[1.0, 1.0, 1.0, 1.0, 0.0, 0.0], [1.0, 1.0, 1.0, 1.0 + 1e-13, 0.0, 0.0], [f64::INFINITY, 0.0, 0.0, 1.0, 0.0, 0.0]] {
+            assert!(resize_affine_frame(Matrix(frame), ImageHandle::TopRight, (1.0, 1.0), true).is_none(), "{frame:?}");
+        }
+        let frame = Matrix([100.0, 0.0, 50.0, 100.0, 100.0, 100.0]);
+        assert!(resize_affine_frame(frame, ImageHandle::TopRight, (10.0, 10.0), true).is_some());
+        assert!(resize_affine_frame(frame, ImageHandle::TopRight, (f64::NAN, 0.0), true).is_none());
+        assert!(resize_affine_frame(frame, ImageHandle::TopRight, (0.0, f64::INFINITY), true).is_none());
+    }
+
+    #[test]
+    fn flip_labels_follow_the_screen_axis() {
+        for rotation in [0, 90, 180, 270] {
+            assert_eq!(flip_user_axis(true, rotation), rotation % 180 == 0);
+            assert_eq!(flip_user_axis(false, rotation), rotation % 180 != 0);
+        }
     }
 }
diff --git a/crates/ui-egui/src/tools/edit_text_ui/layout.rs b/crates/ui-egui/src/tools/edit_text_ui/layout.rs
index ef004403be..1946519203 100644
--- a/crates/ui-egui/src/tools/edit_text_ui/layout.rs
+++ b/crates/ui-egui/src/tools/edit_text_ui/layout.rs
@@ -1,7 +1,7 @@
 use super::{Arc, BTreeMap, Color32, FontFamily, FontId, LineEditor, Rect};
 
 /// The look shown for a paragraph: the family and weight guessed from its PDF font name.
-fn source_look(base_font: &str, size: f64, color: [f64; 3], detected_bold: bool, detected_italic: bool) -> pdfcraft_engine::AddedText {
+pub(super) fn source_look(base_font: &str, size: f64, color: [f64; 3], detected_bold: bool, detected_italic: bool) -> pdfcraft_engine::AddedText {
     use pdfcraft_engine::FontFamily as F;
     let name = base_font.to_ascii_lowercase();
     let family = if ["courier", "mono", "consolas", "menlo", "monaco", "lucida console"].iter().any(|s| name.contains(s)) {
diff --git a/crates/ui-egui/src/tools/object_ui.rs b/crates/ui-egui/src/tools/object_ui.rs
index 17aea394fe..67a077bc7b 100644
--- a/crates/ui-egui/src/tools/object_ui.rs
+++ b/crates/ui-egui/src/tools/object_ui.rs
@@ -198,10 +198,13 @@ pub(crate) fn hit(view: &DocView, xf: &PageXform, info: &DocInfo, page: usize, o
 /// Returns true while group selection owns the interaction. Ordinary clicks still reach the
 /// single-object text/resize tools. A text draft is finished or discarded through its editor.
 pub(crate) fn page_input(cx: PageToolContext<'_>, view: &mut DocView) -> bool {
-    let PageToolContext { ui, xf, ptr, page, .. } = cx;
+    let PageToolContext { ui, resp, xf, ptr, page, .. } = cx;
     if view.objects.input_blocked {
         return true;
     }
+    if resp.context_menu_opened() || egui::Popup::is_any_open(ui.ctx()) {
+        return false;
+    }
     if view.content.draft.is_some() || view.line_editor.as_ref().is_some_and(|e| e.has_changes()) {
         let blocked = view.objects.blocked_page == Some(page);
         let modifier_press = ptr.pressed().is_some() && modified(ui) && ptr.pos.is_some_and(|p| xf.rect.contains(p) && ui.clip_rect().contains(p));
diff --git a/crates/ui-egui/src/tools/redact_ui.rs b/crates/ui-egui/src/tools/redact_ui.rs
index 96b544b4d0..e55dd8c5c3 100644
--- a/crates/ui-egui/src/tools/redact_ui.rs
+++ b/crates/ui-egui/src/tools/redact_ui.rs
@@ -360,16 +360,24 @@ pub(crate) fn pages_body(ui: &mut egui::Ui, d: &mut PagesDraft, pages: usize, _t
     ui.label(egui::RichText::new(tl!("Mark Page Range")).font(crate::theme::semibold(18.0)));
     ui.add_space(8.0);
     widgets::radio_value(ui, &mut d.current, true, tl!("Current page"));
-    ui.horizontal(|ui| {
-        widgets::radio_value(ui, &mut d.current, false, tl!("Pages from"));
-        ui.add_enabled(!d.current, egui::DragValue::new(&mut d.from).range(1..=pages));
-        ui.label(tl!("to"));
-        ui.add_enabled(!d.current, egui::DragValue::new(&mut d.to).range(1..=pages));
-        ui.label(crate::i18n::fmt(tl!("of {name}"), &[("name", &pages.to_string())]));
-    });
-    d.to = d.to.max(d.from);
+    let to_field = ui
+        .horizontal(|ui| {
+            let from_label = widgets::radio_value(ui, &mut d.current, false, tl!("Pages from"));
+            ui.add_enabled(!d.current, egui::DragValue::new(&mut d.from).range(1..=pages)).labelled_by(from_label.id);
+            let to_label = ui.label(tl!("to"));
+            let to_field = ui.add_enabled(!d.current, egui::DragValue::new(&mut d.to).range(1..=pages)).labelled_by(to_label.id);
+            ui.label(crate::i18n::fmt(tl!("of {name}"), &[("name", &pages.to_string())]));
+            to_field
+        })
+        .inner;
+    widgets::keep_range_ordered(d.from, &mut d.to, widgets::typing_into(&to_field));
     ui.add_space(12.0);
-    buttons(ui, "OK", true)
+    let (ok, cancel) = buttons(ui, "OK", true);
+    if ok {
+        // OK while the end is still being typed (a screen reader can press it).
+        widgets::keep_range_ordered(d.from, &mut d.to, false);
+    }
+    (ok, cancel)
 }
 
 /// Find text and redact. Returns (search, cancel, import a word list).
@@ -675,3 +683,106 @@ pub(crate) fn sanitize_body(ui: &mut egui::Ui, t: &Tokens) -> (bool, bool) {
     ui.add_space(12.0);
     buttons(ui, "Sanitize", true)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use egui::accesskit::Role;
+    use egui_kittest::kittest::Queryable;
+
+    fn key(key: egui::Key, modifiers: egui::Modifiers) -> egui::Event {
+        egui::Event::Key { key, physical_key: None, pressed: true, repeat: false, modifiers }
+    }
+
+    /// #5574: typing "12" into the end of 5 to 5 came out as 5. The end was raised to the start
+    /// after every keystroke, so the half-typed "1" was replaced before the "2" arrived.
+    #[test]
+    fn typing_the_last_page_keeps_what_is_typed() {
+        let mut fonts = false;
+        let mut h = egui_kittest::Harness::new_ui_state(
+            move |ui, d: &mut PagesDraft| {
+                // The app's fonts (the semibold heading) take effect from the next frame.
+                if !fonts {
+                    ui.ctx().set_fonts(crate::theme::font_definitions());
+                    fonts = true;
+                    return;
+                }
+                let t = Tokens::get(ui.ctx());
+                pages_body(ui, d, 20, &t);
+            },
+            PagesDraft { current: false, from: 5, to: 5 },
+        );
+        h.run();
+        for (typed, expected) in [("12", 12), ("3", 5)] {
+            h.get_by_role_and_label(Role::SpinButton, "to").click();
+            h.run();
+            h.event(key(egui::Key::A, egui::Modifiers::COMMAND));
+            for c in typed.chars() {
+                h.event(egui::Event::Text(c.to_string()));
+                h.run_steps(2);
+            }
+            h.event(key(egui::Key::Enter, egui::Modifiers::NONE));
+            h.run_steps(2);
+            assert_eq!(*h.state(), PagesDraft { current: false, from: 5, to: expected }, "typed {typed:?}");
+        }
+    }
+
+    /// The dialog with its OK result kept: (draft, OK pressed).
+    fn dialog() -> egui_kittest::Harness<'static, (PagesDraft, bool)> {
+        let mut fonts = false;
+        let mut h = egui_kittest::Harness::new_ui_state(
+            move |ui, (d, ok): &mut (PagesDraft, bool)| {
+                if !fonts {
+                    ui.ctx().set_fonts(crate::theme::font_definitions());
+                    fonts = true;
+                    return;
+                }
+                let t = Tokens::get(ui.ctx());
+                *ok |= pages_body(ui, d, 20, &t).0;
+            },
+            (PagesDraft { current: false, from: 5, to: 5 }, false),
+        );
+        h.run();
+        h
+    }
+
+    fn type_last_page(h: &mut egui_kittest::Harness<'static, (PagesDraft, bool)>, typed: &str) {
+        h.get_by_role_and_label(Role::SpinButton, "to").click();
+        h.run();
+        h.event(key(egui::Key::A, egui::Modifiers::COMMAND));
+        for c in typed.chars() {
+            h.event(egui::Event::Text(c.to_string()));
+            h.run_steps(2);
+        }
+    }
+
+    /// OK pressed while the end is still being typed (a screen reader's click leaves the field
+    /// focused) orders the range, so a reversed one never reaches the edit.
+    #[test]
+    fn ok_while_the_last_page_is_typed_orders_the_range() {
+        let mut h = dialog();
+        type_last_page(&mut h, "3");
+        assert_eq!(h.state().0.to, 3, "still typing");
+        h.get_by_label("OK").click_accesskit();
+        h.run_steps(2);
+        assert_eq!(*h.state(), (PagesDraft { current: false, from: 5, to: 5 }, true));
+    }
+
+    /// Switching to another window halfway through "12" leaves the typed "1" alone: the field
+    /// still has the keyboard when the window comes back.
+    #[test]
+    fn switching_windows_mid_number_keeps_what_is_typed() {
+        let mut h = dialog();
+        type_last_page(&mut h, "1");
+        h.input_mut().focused = false;
+        h.run_steps(2);
+        assert_eq!(h.state().0.to, 1, "the typed 1 stays while the window is in the background");
+        h.input_mut().focused = true;
+        h.run_steps(2);
+        h.event(egui::Event::Text("2".into()));
+        h.run_steps(2);
+        h.event(key(egui::Key::Enter, egui::Modifiers::NONE));
+        h.run_steps(2);
+        assert_eq!(h.state().0.to, 12);
+    }
+}
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 1c688b9bb3..5e33f9cd9a 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -70,7 +70,7 @@ pub fn line(text: &mut dyn egui::TextBuffer) -> egui::TextEdit<'_> {
     egui::TextEdit::singleline(text).margin(FIELD_MARGIN).min_size(vec2(0.0, FIELD_MIN_HEIGHT))
 }
 
-/// A multiline field with the same horizontal inset as [`line`].
+/// A multiline field with the same horizontal inset as [`line()`].
 pub fn block(text: &mut dyn egui::TextBuffer) -> egui::TextEdit<'_> {
     egui::TextEdit::multiline(text).margin(egui::Margin::symmetric(10, 6))
 }
@@ -254,6 +254,23 @@ pub fn radio_value<'a, V: PartialEq>(ui: &mut egui::Ui, current: &mut V, alterna
     response
 }
 
+/// Keeps the end of a "from … to …" page range at or after its start, but not while `typing` into the
+/// end's `DragValue` ([`typing_into`]): the half-typed "1" of "12" is below `from`, and raising it
+/// then replaced what the user was typing with `from` (#5574). A dialog's OK orders it whatever has
+/// the keyboard (`typing` false), so a range left reversed never reaches the edit.
+pub fn keep_range_ordered(from: usize, to: &mut usize, typing: bool) {
+    if !typing {
+        *to = (*to).max(from);
+    }
+}
+
+/// Whether `field` is being typed into: it has the keyboard focus in egui's memory. Unlike
+/// `Response::has_focus` this stays true while the window is in the background, so switching to
+/// another app mid-number doesn't end the typing.
+pub fn typing_into(field: &Response) -> bool {
+    field.ctx.memory(|m| m.has_focus(field.id))
+}
+
 /// The box of a checkbox or the circle of a radio button. egui draws it with the widgets' visuals
 /// and has no style of its own for it, so it is set in a scope around the widget, keeping what
 /// the caller set (dialogs and the search panel already outline theirs):
diff --git a/crates/ui-egui/src/workflows/create_ui.rs b/crates/ui-egui/src/workflows/create_ui.rs
index 6dceb50657..5a6c9caf7b 100644
--- a/crates/ui-egui/src/workflows/create_ui.rs
+++ b/crates/ui-egui/src/workflows/create_ui.rs
@@ -57,19 +57,36 @@ pub enum Clip {
 }
 
 /// An image on the system clipboard, or else its text.
+pub(crate) const MAX_IMAGE_SIDE: usize = 16384;
+pub(crate) const MAX_IMAGE_BYTES: usize = 64 * 1024 * 1024;
+
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) fn read_clipboard() -> Option<Clip> {
-    let mut cb = arboard::Clipboard::new().ok()?;
-    if let Ok(img) = cb.get_image() {
-        return Some(Clip::Image { width: img.width, height: img.height, rgba: img.bytes.into_owned() });
-    }
-    cb.get_text().ok().filter(|t| !t.trim().is_empty()).map(Clip::Text)
+    crate::os_clipboard::with(|cb| {
+        if let Ok(img) = cb.get_image() {
+            let expected_len = img.width.checked_mul(img.height).and_then(|px| px.checked_mul(4));
+            if img.width > 0
+                && img.height > 0
+                && img.width <= MAX_IMAGE_SIDE
+                && img.height <= MAX_IMAGE_SIDE
+                && expected_len == Some(img.bytes.len())
+                && img.bytes.len() <= MAX_IMAGE_BYTES
+            {
+                return Ok(Some(Clip::Image { width: img.width, height: img.height, rgba: img.bytes.into_owned() }));
+            }
+            return Ok(None);
+        }
+        Ok(cb.get_text().ok().filter(|t| !t.trim().is_empty()).map(Clip::Text))
+    })
+    .ok()
+    .flatten()
 }
 
 pub(crate) fn png_from_rgba(width: usize, height: usize, rgba: &[u8]) -> Result<Vec<u8>, String> {
     let (w, h) = (u32::try_from(width).map_err(|e| e.to_string())?, u32::try_from(height).map_err(|e| e.to_string())?);
-    if w == 0 || h == 0 || rgba.len() != width * height * 4 {
-        return Err("the clipboard image is empty or malformed".into());
+    let expected = width.checked_mul(height).and_then(|p| p.checked_mul(4));
+    if w == 0 || h == 0 || width > MAX_IMAGE_SIDE || height > MAX_IMAGE_SIDE || expected != Some(rgba.len()) || rgba.len() > MAX_IMAGE_BYTES {
+        return Err("the clipboard image is empty, malformed or exceeds size limits".into());
     }
     let mut out = Vec::new();
     let mut enc = png::Encoder::new(&mut out, w, h);
@@ -141,9 +158,10 @@ impl PdfCraftApp {
         self.open_created_bytes("Clipboard.pdf", created.map_err(|e| e.to_string()))
     }
 
-    /// Create ▸ Blank page: a new untitled US Letter document.
+    /// Create ▸ Blank page: a new untitled document on the system region's paper (#5644).
     pub(crate) fn create_blank(&mut self) {
-        let created = self.session.create_blank(612.0, 792.0, 1).map_err(|e| e.to_string());
+        let (w, h) = self.blank_paper.points();
+        let created = self.session.create_blank(w, h, 1).map_err(|e| e.to_string());
         if let Err(e) = self.open_created_bytes("Untitled.pdf", created) {
             self.notify_fmt("Couldn't create a PDF: {e}", &[("e", &e.to_string())]);
         }
diff --git a/crates/ui-egui/src/workflows/files.rs b/crates/ui-egui/src/workflows/files.rs
index a9313a4714..adb5e2f0dd 100644
--- a/crates/ui-egui/src/workflows/files.rs
+++ b/crates/ui-egui/src/workflows/files.rs
@@ -28,33 +28,65 @@ pub enum FilePurpose {
     RedactWords,
 }
 
-/// Discover installed document fonts off the GUI thread, only when the picker is opened.
 #[cfg(not(target_arch = "wasm32"))]
-pub(crate) fn installed_font_files(ctx: &egui::Context) -> Option<Vec<pdfcraft_engine::text_fonts::FontFile>> {
+fn discover_fonts_safely(
+    discover: impl FnOnce() -> Vec<pdfcraft_engine::text_fonts::FontFile> + std::panic::UnwindSafe,
+) -> Vec<pdfcraft_engine::text_fonts::FontFile> {
+    std::panic::catch_unwind(discover).unwrap_or_default()
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+#[derive(Default)]
+struct FontScanCache {
+    files: Option<Vec<pdfcraft_engine::text_fonts::FontFile>>,
+    loading: bool,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl FontScanCache {
+    fn begin(&mut self, reload: bool) -> bool {
+        if self.loading || (!reload && self.files.is_some()) {
+            return false;
+        }
+        self.loading = true;
+        self.files = None;
+        true
+    }
+
+    fn finish(&mut self, files: Vec<pdfcraft_engine::text_fonts::FontFile>) {
+        self.files = Some(files);
+        self.loading = false;
+    }
+}
+
+/// Discover installed document fonts off the GUI thread. Reload permits retrying a
+/// failed scan or discovering newly installed fonts without restarting the app.
+#[cfg(not(target_arch = "wasm32"))]
+pub(crate) fn installed_font_files(ctx: &egui::Context, reload: bool) -> Option<Vec<pdfcraft_engine::text_fonts::FontFile>> {
     use std::sync::{Mutex, OnceLock};
-    type Files = Arc<Mutex<Option<Vec<pdfcraft_engine::text_fonts::FontFile>>>>;
+    type Files = Arc<Mutex<FontScanCache>>;
     static CACHE: OnceLock<Files> = OnceLock::new();
-    let files = CACHE.get_or_init(|| {
-        let files: Files = Arc::new(Mutex::new(None));
+    let files = CACHE.get_or_init(|| Arc::new(Mutex::new(FontScanCache::default())));
+    let start = files.lock().is_ok_and(|mut state| state.begin(reload));
+    if start {
         let result = files.clone();
         let ctx = ctx.clone();
         if std::thread::Builder::new()
             .name("document-font-discovery".into())
             .spawn(move || {
-                let fonts = pdfcraft_engine::text_fonts::discover(&pdfcraft_engine::text_fonts::installed_directories());
+                let fonts = discover_fonts_safely(|| pdfcraft_engine::text_fonts::discover(&pdfcraft_engine::text_fonts::installed_directories()));
                 if let Ok(mut result) = result.lock() {
-                    *result = Some(fonts);
+                    result.finish(fonts);
                 }
                 ctx.request_repaint();
             })
             .is_err()
             && let Ok(mut result) = files.lock()
         {
-            *result = Some(Vec::new());
+            result.finish(Vec::new());
         }
-        files
-    });
-    files.lock().ok().and_then(|f| f.clone())
+    }
+    files.lock().ok().and_then(|f| f.files.clone())
 }
 
 /// The picker for `purpose`: PDFs, and for Create and Insert also what they convert.
@@ -1177,3 +1209,28 @@ mod stem_tests {
         out
     }
 }
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod font_scan_tests {
+    #[test]
+    fn completed_and_failed_font_scans_can_be_reloaded_without_duplicate_workers() {
+        let mut cache = super::FontScanCache::default();
+        assert!(cache.begin(false));
+        assert!(!cache.begin(true), "a reload during discovery must not start another worker");
+        cache.finish(Vec::new());
+        assert!(!cache.begin(false), "reuse a finished scan until explicitly reloaded");
+        assert!(cache.begin(true), "an empty or failed scan can be retried");
+        cache.finish(vec![pdfcraft_engine::text_fonts::FontFile {
+            path: "installed.ttf".into(),
+            family: "Installed".into(),
+            face: "Installed".into(),
+        }]);
+        assert!(cache.begin(true), "a populated scan can discover newly installed fonts");
+        assert!(cache.files.is_none());
+    }
+
+    #[test]
+    fn a_panicking_font_scan_finishes_with_an_empty_list() {
+        assert!(super::discover_fonts_safely(|| panic!("synthetic font scan failure")).is_empty());
+    }
+}
diff --git a/crates/ui-egui/src/workflows/js_ui.rs b/crates/ui-egui/src/workflows/js_ui.rs
index b8f5d51cc6..4c99ee1db8 100644
--- a/crates/ui-egui/src/workflows/js_ui.rs
+++ b/crates/ui-egui/src/workflows/js_ui.rs
@@ -355,6 +355,10 @@ fn date_language_picker_name(l: &pdfcraft_engine::dates::DateLanguage, drawable:
 /// area; [`preferences_buttons`] goes below it, outside the scroll, so OK is always in reach.
 pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
     ui.label(egui::RichText::new(tl!("Preferences")).font(theme::semibold(18.0)));
+    ui.label(egui::RichText::new(tl!("Appearance")).font(theme::semibold(13.0)));
+    if ui.add(widgets::checkbox(&mut app.show_page_edge_shadows, tl!("Show Page Edge Shadows"))).changed() {
+        ui.ctx().request_repaint();
+    }
     ui.horizontal(|ui| {
         let label = ui.label(tl!("Interface language"));
         // A native name is only drawn when these fonts can draw it; otherwise the English name
@@ -488,6 +492,15 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
         }
     });
     ui.label(egui::RichText::new(tl!("For page sizes and margins.")).small().color(t.text_muted));
+    // The web build has no file paths to list.
+    #[cfg(not(target_arch = "wasm32"))]
+    {
+        ui.horizontal(|ui| {
+            let label = ui.label(tl!("Recent files to keep"));
+            ui.add(egui::DragValue::new(&mut app.recent_limit).range(0..=crate::RECENT_FILES_MAX)).labelled_by(label.id);
+        });
+        ui.label(egui::RichText::new(tl!("Lowering this forgets the oldest files. At 0 there is no list.")).small().color(t.text_muted));
+    }
     // The web build has no file paths to reopen.
     #[cfg(not(target_arch = "wasm32"))]
     ui.add(widgets::checkbox(&mut app.reopen_last_session, tl!("Reopen the files that were open when PdfCraft last closed")));
diff --git a/crates/ui-egui/tests/it/comments.rs b/crates/ui-egui/tests/it/comments.rs
index 664f61733e..057663a76c 100644
--- a/crates/ui-egui/tests/it/comments.rs
+++ b/crates/ui-egui/tests/it/comments.rs
@@ -3022,3 +3022,73 @@ fn an_upright_comment_on_a_turned_page_is_drawn_where_it_goes_before_release() {
     h.drop_at(from + delta);
     h.run_steps(3);
 }
+
+/// `n` pages with one comment each, "Card 1" to "Card n".
+fn one_comment_per_page(n: usize) -> Vec<u8> {
+    let mut objs = vec!["<< /Type /Catalog /Pages 2 0 R >>".to_string()];
+    let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", 3 + 2 * i)).collect();
+    objs.push(format!("<< /Type /Pages /Kids [{}] /Count {n} /MediaBox [0 0 300 200] >>", kids.join(" ")));
+    for i in 0..n {
+        objs.push(format!("<< /Type /Page /Parent 2 0 R /Annots [{} 0 R] >>", 4 + 2 * i));
+        objs.push(format!("<< /Type /Annot /Subtype /Square /Rect [20 20 80 80] /C [1 0 0] /T (Ada) /Contents (Card {}) >>", i + 1));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    for (i, o) in objs.iter().enumerate() {
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    out.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
+    out
+}
+
+/// #5488: the panel laid out every card on every frame, which put a few hundred comments over the
+/// frame budget. Cards out of view now only take up their height, and the selected one is still
+/// drawn wherever it is, so it can scroll into view.
+#[test]
+fn the_comments_panel_lays_out_only_the_cards_in_view() {
+    let mut h = harness_with_bytes(one_comment_per_page(120), |app| app.set_option("panel", "comments").unwrap());
+    h.run_steps(4);
+    let drawn = h.query_all_by_label_contains("Card ").count();
+    assert!((1..40).contains(&drawn), "{drawn} of 120 cards laid out");
+    h.state_mut().views[0].comments.selected = Some((100, 0));
+    h.state_mut().views[0].comments.reveal = true;
+    h.run_steps(4);
+    assert!(h.query_by_label("Card 101").is_some(), "the selected card is drawn and scrolled to");
+    assert!(h.query_by_label("Card 1").is_none(), "the top of the list scrolled out of view");
+}
+
+/// CodeRabbit on #5583: a card's measured height belongs to what it showed. Card 1, far above the
+/// cards in view, grows by two replies; the cards in view move down by its growth, not stay where
+/// card 1's old height would put them.
+#[test]
+fn a_card_out_of_view_that_grows_moves_the_cards_below_it() {
+    let mut h = harness_with_bytes(one_comment_per_page(120), |app| app.set_option("panel", "comments").unwrap());
+    h.run_steps(4);
+    h.state_mut().views[0].comments.selected = Some((60, 0));
+    h.state_mut().views[0].comments.reveal = true;
+    h.run_steps(4);
+    assert!(h.query_by_label("Card 1").is_none(), "card 1 is out of view");
+    let before = h.get_by_label("Card 61").rect().top();
+    for text in ["A first reply", "A second reply"] {
+        h.state_mut().apply_edit(pdfcraft_engine::Edit::ReplyToAnnotation { page: 0, index: 0, text: text.into(), author: "Bo".into() });
+    }
+    h.run_steps(4);
+    let after = h.get_by_label("Card 61").rect().top();
+    assert!(after > before + 40.0, "the cards below a grown card move down: {before} → {after}");
+}
+
+/// CodeRabbit on #5583: a card with an editor open on it is drawn wherever it is, so the cards
+/// below it make room for the editor rather than keep the card's height from before it opened.
+#[test]
+fn a_card_with_an_editor_open_out_of_view_is_drawn_at_its_size() {
+    let mut h = harness_with_bytes(one_comment_per_page(120), |app| app.set_option("panel", "comments").unwrap());
+    h.run_steps(4);
+    h.state_mut().views[0].comments.selected = Some((60, 0));
+    h.state_mut().views[0].comments.reveal = true;
+    h.run_steps(4);
+    assert!(h.query_by_label("Card 1").is_none(), "card 1 is out of view");
+    let before = h.get_by_label("Card 61").rect().top();
+    h.state_mut().views[0].comments.editing = Some((0, 0, "Card 1".into()));
+    h.run_steps(4);
+    let after = h.get_by_label("Card 61").rect().top();
+    assert!(after > before + 20.0, "the cards below make room for card 1's editor: {before} → {after}");
+}
diff --git a/crates/ui-egui/tests/it/content.rs b/crates/ui-egui/tests/it/content.rs
index cb29ba99be..ccc3945aaf 100644
--- a/crates/ui-egui/tests/it/content.rs
+++ b/crates/ui-egui/tests/it/content.rs
@@ -272,7 +272,8 @@ fn typing_moving_styling_and_deleting_added_content() {
 #[test]
 fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
     use pdfcraft_ui_egui::Clip;
-    let mut h = harness();
+    // Three frames between modifier releases represent a short real key gesture.
+    let mut h = harness_with_step_dt(1.0 / 60.0);
     let v = |pressed, modifiers| egui::Event::Key { key: egui::Key::V, physical_key: None, pressed, repeat: false, modifiers };
     let images = |h: &Harness<'static, PdfCraftApp>| added(h).iter().filter(|a| matches!(a.content, pdfcraft_engine::AddedContent::Image(_))).count();
     // Text on the clipboard: egui gets a Paste event instead of the press; nothing lands on the page.
@@ -288,9 +289,8 @@ fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
     h.event(v(false, egui::Modifiers::NONE));
     h.run_steps(3);
     assert_eq!(images(&h), 0, "a plain V doesn't paste");
-    // A picture alone: egui-winit sends no Paste event and swallows the press, so only the
-    // release of V arrives.
-    h.event(v(false, egui::Modifiers::COMMAND));
+    // The integration delivers image pixels and consumes the native shortcut keys.
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([30, 20], egui::Color32::GRAY))));
     h.run_steps(3);
     let a = added(&h);
     assert_eq!(a.len(), 1);
@@ -301,14 +301,17 @@ fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
         let s = h.state();
         assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), Some("Add image"));
     }
-    // Ctrl let go a moment before V: the release comes without the modifier, and still pastes.
+    // Modifier release order does not change delivery of the next image paste.
+    h.event(egui::Event::ModifiersChanged(egui::Modifiers::COMMAND));
+    h.event(egui::Event::ModifiersChanged(egui::Modifiers::NONE));
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([30, 20], egui::Color32::GRAY))));
     h.event(v(false, egui::Modifiers::NONE));
     h.run_steps(3);
     assert_eq!(images(&h), 2, "Ctrl released first");
     // A text field with the keyboard keeps ⌘V for itself.
     assert!(h.state_mut().execute("edit.find"));
     h.run_steps(3);
-    h.event(v(false, egui::Modifiers::COMMAND));
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([30, 20], egui::Color32::GRAY))));
     h.run_steps(3);
     assert_eq!(images(&h), 2, "the Find field has the keyboard");
     h.key_press(egui::Key::Escape);
@@ -317,7 +320,7 @@ fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
     assert!(h.state_mut().execute("page.organize"));
     h.run_steps(4);
     assert!(h.state().views[0].organize);
-    h.event(v(false, egui::Modifiers::COMMAND));
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([30, 20], egui::Color32::GRAY))));
     h.run_steps(3);
     assert_eq!(images(&h), 2, "Organize Pages pastes pages");
     h.state_mut().views[0].organize = false;
@@ -326,7 +329,7 @@ fn a_picture_on_the_clipboard_is_pasted_onto_the_page() {
     assert!(h.state_mut().execute("form.prepare"));
     h.run_steps(3);
     assert!(h.state().is_preparing());
-    h.event(v(false, egui::Modifiers::COMMAND));
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([30, 20], egui::Color32::GRAY))));
     h.run_steps(3);
     assert_eq!(images(&h), 2, "Prepare Form pastes fields");
 }
diff --git a/crates/ui-egui/tests/it/control.rs b/crates/ui-egui/tests/it/control.rs
index e1a7e1f1db..6a0abd749b 100644
--- a/crates/ui-egui/tests/it/control.rs
+++ b/crates/ui-egui/tests/it/control.rs
@@ -140,6 +140,25 @@ fn thumbnail_size_is_settable_and_inspectable_through_the_control_channel() {
     assert!(ok(&mut h, &c, "ui.state", json!({}))["active"]["thumbnail_zoom"].as_f64().unwrap() > 0.75);
 }
 
+#[test]
+fn page_shadows_are_an_observable_app_wide_preference() {
+    let (mut h, c) = harness();
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], true);
+    for value in ["false", "true"] {
+        ok(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": value }));
+        assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], value == "true");
+    }
+    for value in ["off", "1", "False", ""] {
+        assert!(call(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": value })).is_err());
+        assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], true);
+    }
+    ok(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": false }));
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], false);
+    h.state_mut().active = None;
+    ok(&mut h, &c, "ui.set", json!({ "key": "show_page_edge_shadows", "value": "false" }));
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["show_page_edge_shadows"], false);
+}
+
 #[test]
 fn control_resize_reports_observed_dimensions_and_rejects_invalid_sizes() {
     let (mut h, c) = harness();
@@ -2070,3 +2089,43 @@ fn routine_continuous_scrolling_does_not_add_navigation_history() {
     assert!(h.state().views[0].back.is_empty());
     assert!(h.state().views[0].forward.is_empty());
 }
+
+#[test]
+fn accessible_labels_on_format_text_and_pin_dialog() {
+    let (mut h, c) = harness();
+
+    // 1. Check Dialog::PinTool accessibility labels
+    h.state_mut().dialog = Some(pdfcraft_ui_egui::Dialog::PinTool);
+    h.run_steps(3);
+
+    let search = ok(&mut h, &c, "ui.inspect", json!({"role": "TextInput", "query": "Search tools…"}));
+    assert!(search["count"].as_u64().unwrap() >= 1, "search box has accessible label: {search}");
+
+    let result_rows = ok(&mut h, &c, "ui.inspect", json!({"query": "Organize Pages"}));
+    assert!(result_rows["count"].as_u64().unwrap() >= 1, "result row has accessible label: {result_rows}");
+
+    let pin_toggles = ok(&mut h, &c, "ui.inspect", json!({"query": "Pin"}));
+    assert!(pin_toggles["count"].as_u64().unwrap() >= 1, "pin toggle has accessible label: {pin_toggles}");
+
+    h.state_mut().dialog = None;
+    h.run_steps(2);
+
+    // 2. Open Add Text so Format text panel is visible
+    ok(&mut h, &c, "ui.command", json!({"id": "edit.text"}));
+    h.run_steps(3);
+
+    let font_combo = ok(&mut h, &c, "ui.inspect", json!({"query": "Font", "role": "ComboBox"}));
+    assert!(font_combo["count"].as_u64().unwrap() >= 1, "format-font has accessible label: {font_combo}");
+
+    let size_combo = ok(&mut h, &c, "ui.inspect", json!({"query": "Font size"}));
+    assert!(size_combo["count"].as_u64().unwrap() >= 1, "format-size has accessible label: {size_combo}");
+
+    let line_spacing_combo = ok(&mut h, &c, "ui.inspect", json!({"query": "Line spacing", "role": "ComboBox"}));
+    assert!(line_spacing_combo["count"].as_u64().unwrap() >= 1, "format-line-spacing has accessible label: {line_spacing_combo}");
+
+    let scale_spin = ok(&mut h, &c, "ui.inspect", json!({"query": "Horizontal scale", "role": "SpinButton"}));
+    assert!(scale_spin["count"].as_u64().unwrap() >= 1, "horizontal scale spin button has accessible label: {scale_spin}");
+
+    let char_spin = ok(&mut h, &c, "ui.inspect", json!({"query": "Character spacing", "role": "SpinButton"}));
+    assert!(char_spin["count"].as_u64().unwrap() >= 1, "character spacing spin button has accessible label: {char_spin}");
+}
diff --git a/crates/ui-egui/tests/it/create.rs b/crates/ui-egui/tests/it/create.rs
index 1c9a757651..7260dd816b 100644
--- a/crates/ui-egui/tests/it/create.rs
+++ b/crates/ui-egui/tests/it/create.rs
@@ -380,3 +380,24 @@ fn multiple_files_past_a_thousand_are_all_used() {
     let doc = app.session.get(app.views[0].id).unwrap();
     assert_eq!(doc.info.pages.len(), 1001, "every picked file is used, in order");
 }
+
+/// Create ▸ Blank page uses the system region's paper, not always US Letter (#5644): the app
+/// starts with the system's, and a blank page is on A4 and on Letter as the paper says
+/// (CodeRabbit on #5651: a Letter host alone would not tell a hard-coded Letter apart).
+#[test]
+fn a_blank_page_is_on_the_system_regions_paper() {
+    use pdfcraft_ui_egui::paper::Paper;
+    assert_eq!(PdfCraftApp::new().blank_paper, Paper::system());
+    for paper in [Paper::A4, Paper::Letter] {
+        let mut app = PdfCraftApp::new();
+        app.blank_paper = paper;
+        assert!(app.execute("create.blank"));
+        let docs = app.session.docs();
+        let crop = docs.last().and_then(|d| d.info.pages.first()).map(|p| p.crop).unwrap();
+        let (w, h) = paper.points();
+        assert!(
+            ((crop[2] - crop[0]) as f64 - w).abs() < 0.01 && ((crop[3] - crop[1]) as f64 - h).abs() < 0.01,
+            "{paper:?}: {crop:?} is not {w} × {h}"
+        );
+    }
+}
diff --git a/crates/ui-egui/tests/it/editing.rs b/crates/ui-egui/tests/it/editing.rs
index bdb0720dde..7b245a5a9e 100644
--- a/crates/ui-egui/tests/it/editing.rs
+++ b/crates/ui-egui/tests/it/editing.rs
@@ -2602,6 +2602,131 @@ fn encrypted(bytes: Vec<u8>, algorithm: pdfcraft_cos::Algorithm, user: &str, own
     pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
 }
 
+#[test]
+fn launch_display_override_survives_password_retry_without_changing_defaults() {
+    use pdfcraft_ui_egui::canvas::PageLayout;
+    use std::io::Write as _;
+    let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+    let path = temp_path(&format!("startup-layout-{nonce}.pdf"));
+    let mut file = std::fs::OpenOptions::new().write(true).create_new(true).open(&path).unwrap();
+    file.write_all(&protected("reader", "owner", -4)).unwrap();
+    drop(file);
+    let mut app = PdfCraftApp::new();
+    app.set_option("default-layout", "continuous").unwrap();
+    app.open_path_with_display(path.to_str().unwrap(), PageLayout::TwoUp, false);
+    assert!(app.views.is_empty() && app.password_prompt.is_some());
+    app.submit_password(Some("wrong".into()));
+    assert!(app.views.is_empty() && app.password_prompt.is_some());
+    app.submit_password(Some("reader".into()));
+    assert_eq!(app.views.len(), 1);
+    assert_eq!(app.views[0].layout, PageLayout::TwoUp);
+    assert!(!app.views[0].continuous());
+    let persisted: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+    assert_eq!(persisted["default_layout"], "continuous");
+    std::fs::remove_file(path).unwrap();
+}
+
+#[test]
+fn asynchronous_launch_display_override_survives_retries_and_cancel() {
+    asynchronous_launch_display(false);
+}
+
+#[test]
+fn asynchronous_launch_display_explicit_layout_survives_retries_and_cancel() {
+    asynchronous_launch_display(true);
+}
+
+fn asynchronous_launch_display(explicit: bool) {
+    use pdfcraft_ui_egui::canvas::PageLayout;
+    fn wait(h: &mut Harness<'static, PdfCraftApp>, stage: &str, ready: impl Fn(&PdfCraftApp) -> bool) {
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+        while !ready(h.state()) {
+            assert!(
+                std::time::Instant::now() < deadline,
+                "{stage}: views={}, prompt={}, error={}, notice={}",
+                h.state().views.len(),
+                h.state().password_prompt.is_some(),
+                h.state().password_prompt.as_ref().is_some_and(|p| p.error.is_some()),
+                h.state().toast.is_some()
+            );
+            h.run_steps(2);
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+    }
+    let path = temp_path(&format!("async-startup-layout-{explicit}.pdf"));
+    std::fs::write(&path, protected("reader", "owner", -4)).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.set_option("default-layout", "continuous").unwrap();
+        app.open_bytes("other.pdf", None, fixture(2)).unwrap();
+        app
+    });
+    h.run_steps(2);
+    assert!(!h.state().run_inline, "exercise upstream's actual background-opening path");
+    let other = h.state().views[0].id;
+    h.state_mut().open_path_with_display(path.to_str().unwrap(), PageLayout::TwoUp, false);
+    if explicit {
+        h.state_mut().set_launch_layout("single").unwrap();
+    }
+    wait(&mut h, "password prompt", |app| app.password_prompt.is_some());
+    // The existing document keeps its default view while this request is pending.
+    h.state_mut().submit_password(Some("wrong".into()));
+    wait(&mut h, "wrong-password result", |app| app.password_prompt.as_ref().is_some_and(|p| p.error.is_some()));
+    assert_eq!(h.state().views.len(), 1);
+    h.state_mut().submit_password(Some("reader".into()));
+    wait(&mut h, "first unlock", |app| app.views.len() == 2);
+    assert_eq!(h.state().views[0].id, other);
+    assert_eq!(h.state().views[0].layout, PageLayout::Single);
+    assert!(h.state().views[0].continuous());
+    assert_eq!(h.state().views[1].layout, if explicit { PageLayout::Single } else { PageLayout::TwoUp });
+    assert!(!h.state().views[1].continuous());
+    let second_path = path.with_extension("second.pdf");
+    std::fs::copy(&path, &second_path).unwrap();
+    h.state_mut().open_path_with_display(second_path.to_str().unwrap(), PageLayout::TwoUp, false);
+    wait(&mut h, "password prompt", |app| app.password_prompt.is_some());
+    h.state_mut().submit_password(None);
+    h.state_mut().open_path(second_path.to_str().unwrap());
+    wait(&mut h, "password prompt", |app| app.password_prompt.is_some());
+    h.state_mut().submit_password(Some("reader".into()));
+    wait(&mut h, "normal unlock after cancel", |app| app.views.len() == 3);
+    assert_eq!(h.state().views[2].layout, PageLayout::Single);
+    assert!(h.state().views[2].continuous());
+    let persisted: serde_json::Value = serde_json::from_str(&h.state().persist()).unwrap();
+    assert_eq!(persisted["default_layout"], "continuous");
+    std::fs::remove_file(path).unwrap();
+    std::fs::remove_file(second_path).unwrap();
+}
+
+#[test]
+fn canceling_launch_display_override_does_not_affect_later_documents() {
+    use pdfcraft_ui_egui::canvas::PageLayout;
+    use std::io::Write as _;
+    let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
+    let path = temp_path(&format!("startup-cancel-layout-{nonce}.pdf"));
+    let mut file = std::fs::OpenOptions::new().write(true).create_new(true).open(&path).unwrap();
+    file.write_all(&protected("reader", "owner", -4)).unwrap();
+    drop(file);
+    let mut app = PdfCraftApp::new();
+    app.set_option("default-layout", "continuous").unwrap();
+    app.open_path_with_display(path.to_str().unwrap(), PageLayout::TwoUp, false);
+    assert!(app.views.is_empty() && app.password_prompt.is_some());
+    app.submit_password(None);
+    assert!(app.views.is_empty() && app.password_prompt.is_none());
+    app.open_bytes("next.pdf", None, fixture(2)).unwrap();
+    assert_eq!(app.views[0].layout, PageLayout::Single);
+    assert!(app.views[0].continuous());
+    // Reopening the same protected file normally must not resurrect the canceled override.
+    app.open_path(path.to_str().unwrap());
+    app.submit_password(Some("reader".into()));
+    assert_eq!(app.views.len(), 2);
+    assert_eq!(app.views[1].layout, PageLayout::Single);
+    assert!(app.views[1].continuous());
+    let persisted: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+    assert_eq!(persisted["default_layout"], "continuous");
+    std::fs::remove_file(path).unwrap();
+}
+
 #[test]
 fn password_prompt_opens_and_security_tab_reports_the_details() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
@@ -3010,6 +3135,37 @@ fn extract_options_and_rotate_pages_dialog() {
     assert_eq!(d.info.pages.iter().map(|p| p.rotation).collect::<Vec<_>>(), [90, 0]);
 }
 
+/// #5579: typing the last page of Rotate Pages' range keeps what is typed (croquete1): "12" after
+/// a first page of 5 rotates pages 5–12, not page 5 alone. An end typed below the start and left
+/// by clicking OK is raised to the start as the field lets go: page 5, not nothing.
+#[test]
+fn rotate_pages_keeps_a_typed_last_page() {
+    use egui::accesskit::Role;
+    for (typed, rotated) in [("12", 5..13), ("3", 5..6)] {
+        let mut h = organize(20);
+        h.state_mut().run_command("page.rotate_dialog");
+        h.run_steps(2);
+        let d = &mut h.state_mut().rotate_draft;
+        (d.which, d.from, d.to) = (2, 5, 5);
+        h.run_steps(1);
+        h.get_by_role_and_label(Role::SpinButton, "to").click();
+        h.run_steps(2);
+        // As events, not `key_press`: its `run` checks the dialog's unnamed combo boxes.
+        h.event(egui::Event::Key { key: egui::Key::A, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND });
+        for c in typed.chars() {
+            h.event(egui::Event::Text(c.to_string()));
+            h.run_steps(2);
+        }
+        // OK at once, the end still being typed.
+        h.get_by_label("OK").click();
+        h.run_steps(3);
+        let s = h.state();
+        let d = s.session.get(s.views[0].id).unwrap();
+        let turned: Vec<usize> = d.info.pages.iter().enumerate().filter(|(_, p)| p.rotation != 0).map(|(i, _)| i + 1).collect();
+        assert_eq!(turned, rotated.collect::<Vec<usize>>(), "typed {typed:?}");
+    }
+}
+
 #[test]
 fn dragging_thumbnails_reorders_pages() {
     let mut h = organize(4);
@@ -4306,6 +4462,83 @@ fn dragging_the_rotate_knob_turns_a_page_image() {
     assert!((turned[2] - turned[0] - hh).abs() < 1.5 && (turned[3] - turned[1] - w).abs() < 1.5, "{before:?} -> {turned:?}");
 }
 
+#[test]
+fn dragging_rotate_knob_on_already_rotated_image_applies_delta_only() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+
+    // Center picture
+    let full = h.state().session.get(id).unwrap().page_images(0)[0].rect;
+    let (qw, qh) = ((full[2] - full[0]) / 4.0, (full[3] - full[1]) / 4.0);
+    let (mx, my) = ((full[0] + full[2]) / 2.0, (full[1] + full[3]) / 2.0);
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 0,
+        change: pdfcraft_engine::ImageEdit::Move([mx - qw, my - qh, mx + qw, my + qh]),
+    });
+    h.run_steps(4);
+
+    // Rotate the image by 45° clockwise initially
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 0, change: pdfcraft_engine::ImageEdit::RotateBy(45.0) });
+    h.run_steps(4);
+
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // Select the picture
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    let initial_img = &h.state().session.get(id).unwrap().page_images(0)[0];
+    let initial_matrix = initial_img.matrix;
+    let xf = h.state().views[0].page_xform(0).expect("page 0 xform");
+    let doc_info = &h.state().session.get(id).unwrap().info;
+    let obb = pdfcraft_ui_egui::canvas::ImageObb::from_matrix(initial_matrix, &xf, doc_info, 0);
+    let knob = obb.s_rot;
+    let center = obb.screen_center;
+    let radius = (knob - center).length();
+
+    // Hover at the rotated knob position:
+    h.hover_at(knob);
+    h.run_steps(1);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grab, "knob offers Grab cursor on 45° rotated image");
+
+    // Rotate clockwise by a small delta of 15° (from 45° to 60°):
+    let to_angle = (45.0 + 15.0_f32).to_radians();
+    let to = center + egui::vec2(radius * to_angle.sin(), -radius * to_angle.cos());
+
+    h.drag_at(knob);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(knob + (to - knob) * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::Grabbing);
+    h.drop_at(to);
+    h.run_steps(4);
+
+    let doc = h.state().session.get(id).unwrap();
+    let final_img = &doc.page_images(0)[0];
+    let angle_deg = (-final_img.matrix[1]).atan2(final_img.matrix[0]).to_degrees();
+    let angle_deg = (angle_deg % 360.0 + 360.0) % 360.0;
+    assert!((angle_deg - 60.0).abs() < 2.0, "expected ~60° total rotation, got {angle_deg}°");
+}
+
 #[test]
 fn editing_existing_form_artwork_on_the_page() {
     use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
@@ -4372,6 +4605,284 @@ fn check_existing_artwork(name: &'static str, bytes: Vec<u8>) {
     assert!(h.state().session.get(id).unwrap().page_images(0).is_empty());
 }
 
+#[test]
+fn image_right_click_context_menu_items_and_actions() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    // Select image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    // Right-click image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some());
+
+    for item in [
+        "Cut",
+        "Copy",
+        "Paste",
+        "Flip horizontal",
+        "Flip vertical",
+        "Arrange image",
+        "Replace image",
+        "Draw freehand",
+        "Redact Image",
+        "Create Link",
+        "Recognize Text",
+    ] {
+        h.get_by_label_contains(item);
+    }
+
+    // Top horizontal icon buttons
+    h.get_by_label("Rotate Counterclockwise");
+    h.get_by_label("Rotate Clockwise");
+    h.get_by_label("Delete");
+
+    // Flip horizontal via context menu item
+    h.get_by_label("Flip horizontal").click();
+    h.run_steps(3);
+    let id = h.state().views[0].id;
+    let doc = h.state().session.get(id).unwrap();
+    assert_eq!(doc.can_undo(), Some("Flip image"));
+
+    // Undo flip
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::Z);
+    h.run_steps(3);
+    let doc = h.state().session.get(id).unwrap();
+    assert_eq!(doc.can_undo(), None);
+}
+
+#[test]
+fn default_page_context_menu_when_not_in_edit_mode() {
+    let mut h = harness(1, |_| {});
+    h.run_steps(4);
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::Select);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    // Right click on page in Select mode
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // Verify default page context menu items
+    h.get_by_label("Rotate view counterclockwise");
+    h.get_by_label("Print");
+    h.get_by_label("Select Tool");
+    h.get_by_label("Hand Tool");
+    h.get_by_label("Marquee Zoom");
+
+    for item in ["Add bookmark", "Take a snapshot", "Edit this PDF", "Delete page", "Export this PDF", "Find text or tools", "Document properties…"]
+    {
+        h.get_by_label_contains(item);
+    }
+    h.get_by_label("Rotate view clockwise");
+    assert!(h.query_all_by_label("Add comment").next().is_some());
+    assert!(h.query_all_by_label("Add text").next().is_some());
+    assert!(h.query_all_by_label("Add image").next().is_some());
+    assert!(h.query_all_by_label_contains("Copy").next().is_some());
+    assert!(h.query_all_by_label_contains("Paste").next().is_some());
+
+    // Clicking "Edit this PDF" enters edit mode
+    h.get_by_label("Edit this PDF").click();
+    h.run_steps(2);
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::EditText);
+}
+
+#[test]
+fn page_context_menu_items_disabled_on_protected_pdf() {
+    let bytes = protected("", "owner", 0b0100);
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("protected.pdf", None, bytes.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::Select);
+
+    let doc_id = h.state().views[0].id;
+    let doc = h.state().session.get(doc_id).unwrap();
+    assert!(!doc.allows_modification());
+    assert!(!doc.allows_assembly());
+    assert!(!doc.allows_annotation());
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    // Right click on page in Select mode
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    let is_disabled =
+        |h: &mut Harness<'static, PdfCraftApp>, label: &str| h.query_by(|n| n.label().as_deref() == Some(label) && n.is_disabled()).is_some();
+
+    // Context menu is open; check restricted items are greyed out (disabled)
+    assert!(is_disabled(&mut h, "Edit this PDF"), "Edit this PDF should be disabled on protected document");
+    assert!(is_disabled(&mut h, "Add text"), "Add text should be disabled");
+    assert!(is_disabled(&mut h, "Add image"), "Add image should be disabled");
+    assert!(is_disabled(&mut h, "Delete page"), "Delete page should be disabled");
+    assert!(is_disabled(&mut h, "Add comment"), "Add comment should be disabled");
+    assert!(is_disabled(&mut h, "Add bookmark"), "Add bookmark should be disabled");
+
+    // View-only items should still be enabled
+    assert!(!is_disabled(&mut h, "Select Tool"));
+    assert!(!is_disabled(&mut h, "Hand Tool"));
+    assert!(!is_disabled(&mut h, "Find text or tools"));
+}
+
+#[test]
+fn image_edge_handle_stretch_and_crop_mode() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(100, 100, image::Rgb([100, 150, 200]))
+        .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+        .unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("square.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    // Select image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some());
+
+    // Enter crop mode via context menu
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.get_by_label("Crop").click();
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_some()));
+
+    // Set smaller crop rect
+    let smaller = egui::Rect::from_center_size(c, egui::vec2(50.0, 50.0));
+    set_crop_box(&mut h, smaller);
+
+    // Confirm crop with Enter key
+    h.key_press(egui::Key::Enter);
+    h.run_steps(4);
+    assert!(!h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_some()));
+    let doc_id = h.state().views[0].id;
+    let images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_eq!(images.len(), 1, "image still exists: {images:?}");
+    assert!(images[0].visible_rect.is_some(), "cropped image is visible");
+    assert_ne!(images[0].visible_rect, Some(images[0].rect), "image is cropped");
+
+    // Remove crop via context menu
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.get_by_label("Remove crop").click();
+    h.run_steps(4);
+    let images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_eq!(images[0].visible_rect, Some(images[0].rect), "crop is removed");
+}
+
+#[test]
+fn tiny_image_crop_handle_drag_does_not_panic() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(5, 5, image::Rgb([100, 150, 200])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(800.0, 600.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("tiny.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    // Enter crop mode on image 0 with small dimensions (5.0 x 5.0)
+    h.state_mut().views[0].image_selection = Some(pdfcraft_ui_egui::ImageSelection {
+        page: 0,
+        index: 0,
+        drag: None,
+        crop: Some(pdfcraft_ui_egui::CropMode::new([100.0, 100.0, 105.0, 105.0])),
+        turning: false,
+        settled: None,
+    });
+    h.run_steps(1);
+
+    // Hover and drag a handle across a 5.0 x 5.0 image to ensure clamp bounds do not panic
+    h.hover_at(egui::pos2(100.0, 100.0));
+    h.run_steps(1);
+    h.drag_at(egui::pos2(100.0, 100.0));
+    h.run_steps(1);
+    h.hover_at(egui::pos2(105.0, 105.0));
+    h.run_steps(2);
+    h.drop_at(egui::pos2(105.0, 105.0));
+    h.run_steps(2);
+}
+
+#[test]
+fn text_selection_action_icons() {
+    let mut h = harness(1, |_| {});
+    // Dragging selects only once the page's text layer is in, and it comes from the render pool
+    // in the background: under load a fixed number of frames was sometimes not enough.
+    support::wait_until(&mut h, "page 1's text layer", |app| app.views[0].has_page_text(0));
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let p0 = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+    let p1 = egui::pos2(r.left() + 100.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+
+    // Drag to select text
+    h.hover_at(p0);
+    h.run_steps(1);
+    h.drag_at(p0);
+    h.run_steps(1);
+    h.hover_at(p1);
+    h.run_steps(1);
+    h.drop_at(p1);
+    h.run_steps(2);
+
+    assert!(h.state().views[0].selected_text().is_some());
+
+    // Verify all 6 minimalist action icons are present in the floating menu
+    assert!(h.query_all_by_label("Add comment").next().is_some());
+    assert!(h.query_all_by_label("Highlight").next().is_some());
+    assert!(h.query_all_by_label("Underline").next().is_some());
+    assert!(h.query_all_by_label("Strikethrough").next().is_some());
+    assert!(h.query_all_by_label("Replace text").next().is_some());
+    assert!(h.query_all_by_label("Copy").next().is_some());
+}
+
 #[test]
 fn the_format_panel_restyles_the_paragraph_being_edited() {
     let mut h = harness(1, |_| {});
@@ -4404,6 +4915,76 @@ fn the_format_panel_restyles_the_paragraph_being_edited() {
     assert!(s.views[0].line_editor.as_ref().is_some_and(|e| e.extras.underline));
 }
 
+#[test]
+fn the_format_panel_toggles_superscript_and_subscript_on_selection() {
+    let mut h = harness(1, |_| {});
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let at = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 158.0) / 300.0 * r.height());
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    h.run_steps(3);
+    assert!(h.state().views[0].line_editor.is_some());
+
+    // In line editor, select "1" in "Page 1":
+    let ed = h.state_mut().views[0].line_editor.as_mut().unwrap();
+    ed.selection = Some(5..6);
+    ed.focus = true;
+    h.run_steps(1);
+
+    // Click Superscript: "1" becomes "¹"
+    h.get_by_label("FORMAT TEXT");
+    let btn = h.get_by_label("Superscript");
+    btn.click();
+    h.run_steps(4);
+
+    let s = h.state();
+    let doc = s.session.get(s.views[0].id).unwrap();
+    assert_eq!(doc.can_undo(), Some("Edit text"));
+    assert_eq!(doc.text_blocks(0)[0].text, "Page ¹");
+
+    // Select "¹" in "Page ¹" to toggle it back:
+    let ed = h.state_mut().views[0].line_editor.as_mut().unwrap();
+    ed.selection = Some(5..7);
+    ed.focus = true;
+    h.run_steps(1);
+
+    // Click Superscript again: "¹" toggles back to "1"
+    h.get_by_label("Superscript").click();
+    h.run_steps(4);
+    let s2 = h.state();
+    let doc2 = s2.session.get(s2.views[0].id).unwrap();
+    assert_eq!(doc2.text_blocks(0)[0].text, "Page 1");
+
+    // Subscript toggle in added text:
+    h.state_mut().views[0].line_editor = None;
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::AddText;
+    let draft = pdfcraft_ui_egui::TextDraft {
+        page: 0,
+        index: None,
+        rect: [20.0, 20.0, 120.0, 40.0],
+        text: "H2O".into(),
+        style: Default::default(),
+        focus: false,
+        selection: Some(1..2),
+        typing_from: None,
+    };
+    h.state_mut().views[0].content.draft = Some(draft);
+    h.run_steps(2);
+
+    h.get_by_label("Subscript").click();
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("H₂O"));
+
+    h.get_by_label("Subscript").click();
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].content.draft.as_ref().map(|d| d.text.as_str()), Some("H2O"));
+}
+
 /// Horizontal scale and Character spacing take any value in their ranges, not only the listed
 /// ones: values between the listed ones and beyond them, typed in Format text, reach the saved
 /// file as the engine writes them.
@@ -4588,6 +5169,17 @@ fn click_at(h: &mut Harness<'static, PdfCraftApp>, at: egui::Pos2) {
     h.run_steps(4);
 }
 
+/// Sets the open crop's box on page 0 to the screen rectangle `r`, as dragging its handles would.
+fn set_crop_box(h: &mut Harness<'static, PdfCraftApp>, r: egui::Rect) {
+    let view = &h.state().views[0];
+    let page = &h.state().session.get(view.id).unwrap().info.pages[0];
+    let xf = pdfcraft_ui_egui::canvas::PageXform { rect: view.page_screen_rect(0).unwrap(), rot: view.rotation, pw: page.width, ph: page.height };
+    let (a, b) = (xf.screen_to_view(r.min), xf.screen_to_view(r.max));
+    let (u, v) = (page.view_to_user(a.0, a.1), page.view_to_user(b.0, b.1));
+    let keep = [u[0].min(v[0]), u[1].min(v[1]), u[0].max(v[0]), u[1].max(v[1])].map(f64::from);
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop.as_mut().unwrap().keep = keep;
+}
+
 fn press(h: &mut Harness<'static, PdfCraftApp>, modifiers: Modifiers, key: Key) {
     h.key_press_modifiers(modifiers, key);
     h.run_steps(4);
@@ -6799,6 +7391,649 @@ fn leaving_organize_goes_back_to_the_workspace_panel() {
     assert_eq!(h.state().left, LeftPanel::AllTools);
 }
 
+#[test]
+fn image_copy_cut_paste_keyboard_and_context_menu() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(60, 40, image::Rgb([180, 50, 50])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(initial_count, 1, "starts with 1 image");
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // 1. Select the image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "image selected");
+
+    // 2. Copy via keyboard shortcut (COMMAND+C / Event::Copy)
+    h.event(egui::Event::Copy);
+    h.run_steps(2);
+    assert!(h.state().last_copied_image.is_some(), "image copied to clipboard buffer");
+
+    // 3. The integration delivers the copied pixels for the keyboard paste.
+    let (width, height, rgba) = h.state().last_copied_image.clone().unwrap();
+    let image = egui::ColorImage::from_rgba_unmultiplied([width as usize, height as usize], &rgba);
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(image)));
+    h.run_steps(3);
+    let after_paste = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(after_paste, 2, "now has 2 images");
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| s.index), Some(1), "new image is selected");
+
+    // 4. Cut via keyboard shortcut (COMMAND+X / Event::Cut)
+    h.event(egui::Event::Cut);
+    h.run_steps(3);
+    let after_cut = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(after_cut, 1, "cut deleted the pasted image");
+    assert!(h.state().views[0].image_selection.is_none(), "selection cleared after cut");
+
+    // 5. Paste again via context menu on the page
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.get_by_label_contains("Paste").click();
+    h.run_steps(3);
+    let after_paste2 = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(after_paste2, 2, "pasted via context menu");
+}
+
+#[test]
+fn added_and_pasted_image_uses_refactored_image_edits() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 80, image::Rgb([120, 180, 240])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+
+    let mut h = harness(1, |_| {});
+    h.run_steps(4);
+
+    // 1. Add image via add_image
+    h.state_mut().add_image("test_add.png".into(), png);
+    h.run_steps(3);
+
+    // Verify refactored mode is active
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::EditText);
+    let id = h.state().views[0].id;
+    let images = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images.len(), 1, "image is added");
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| (s.page, s.index)), Some((0, 0)), "added image has refactored image_selection");
+
+    // 2. Perform refactored crop on the added image
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.get_by_label("Crop").click();
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_some()), "crop mode entered");
+
+    let smaller = egui::Rect::from_center_size(c, egui::vec2(40.0, 40.0));
+    set_crop_box(&mut h, smaller);
+    h.key_press(egui::Key::Enter);
+    h.run_steps(4);
+    assert!(!h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_some()), "crop mode exited");
+
+    let images_after_crop = h.state().session.get(id).unwrap().page_images(0);
+    assert!(images_after_crop[0].visible_rect.is_some());
+    assert_ne!(images_after_crop[0].visible_rect, Some(images_after_crop[0].rect), "crop applied to added image");
+
+    // 3. Move the cropped added image
+    let orig_rect = images_after_crop[0].rect;
+    let orig_vis = images_after_crop[0].visible_rect.unwrap();
+    let dx = 20.0;
+    let dy = 20.0;
+    let new_rect = [orig_rect[0] + dx, orig_rect[1] + dy, orig_rect[2] + dx, orig_rect[3] + dy];
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 0, change: pdfcraft_engine::ImageEdit::Move(new_rect) });
+    h.run_steps(3);
+
+    let images_after_move = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images_after_move[0].rect, new_rect, "moved rect matches");
+    assert_eq!(
+        images_after_move[0].visible_rect,
+        Some([orig_vis[0] + dx, orig_vis[1] + dy, orig_vis[2] + dx, orig_vis[3] + dy]),
+        "crop preserved after move"
+    );
+}
+
+#[test]
+fn stale_clipboard_plain_text_does_not_paste_image() {
+    let mut h = harness(1, |_| {});
+    h.run_steps(4);
+    // Put an image into internal cache
+    h.state_mut().last_copied_image = Some((10, 10, vec![0; 400]));
+    h.state_mut().last_copied_file = Some(("cached.png".to_string(), vec![1, 2, 3]));
+    // The text arrives in the paste event, as it does from the OS. The real system clipboard is
+    // shared by every test thread, so this test doesn't write it.
+    h.state_mut().system_clipboard = false;
+
+    // A paste event containing plain text clears internal image cache and does not paste image
+    h.event(egui::Event::Paste("just plain text".into()));
+    h.run_steps(2);
+
+    // can_paste_image should now be false because the clipboard has text, not an image!
+    assert!(!h.state().can_paste_image(), "cannot paste image when the clipboard has text");
+
+    // paste_image should fail and return false without pasting
+    assert!(!h.state_mut().paste_image(0, None), "must not paste stale cached image");
+
+    let doc = h.state().session.get(h.state().views[0].id).unwrap();
+    assert_eq!(doc.page_images(0).len(), 0, "no image pasted on the page");
+}
+
+/// Delivered image pixels paste once; accompanying key releases add no second image.
+#[test]
+fn delivered_image_with_key_releases_pastes_once() {
+    let pdf = include_bytes!("../data/form.pdf").to_vec();
+    let mut h = Harness::builder().with_step_dt(1.0 / 60.0).with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("form.pdf", None, pdf.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+
+    h.state_mut().clipboard_override = Some(pdfcraft_ui_egui::Clip::Image { width: 40, height: 20, rgba: [100u8, 200, 100, 255].repeat(40 * 20) });
+
+    // The integration supplies the pixels and consumes native shortcut keys. Extra releases carry no paste authority.
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([40, 20], egui::Color32::GREEN))));
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(3);
+
+    let count = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(count, initial_count + 1, "exactly one image must be pasted for delivered pixels, got {count}");
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+    assert_eq!(h.state().session.get(id).unwrap().page_images(0).len(), initial_count + 1);
+}
+
+/// Win+V release without COMMAND must NOT paste an image.
+#[test]
+fn win_v_does_not_paste_on_open() {
+    let pdf = include_bytes!("../data/form.pdf").to_vec();
+    let mut h = Harness::builder().with_step_dt(1.0 / 60.0).with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("form.pdf", None, pdf.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+
+    h.state_mut().clipboard_override = Some(pdfcraft_ui_egui::Clip::Image { width: 40, height: 20, rgba: [100u8, 200, 100, 255].repeat(40 * 20) });
+
+    // Complete an intentional paste immediately before opening clipboard history.
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([40, 20], egui::Color32::GREEN))));
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(1);
+    assert_eq!(h.state().session.get(id).unwrap().page_images(0).len(), initial_count + 1);
+
+    // Simulate pressing Win+V (opening clipboard history flyout):
+    // The OS intercepts V press, so PdfCraft only sees V release without COMMAND (Modifiers::NONE).
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::NONE });
+    h.run_steps(2);
+
+    let count = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(count, initial_count + 1, "opening Win+V after a completed paste must not paste again");
+
+    // Choosing an item delivers another image, possibly alongside synthetic shortcut events.
+    h.event(egui::Event::PasteImage(std::sync::Arc::new(egui::ColorImage::filled([40, 20], egui::Color32::GREEN))));
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(3);
+
+    let final_count = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(final_count, initial_count + 2, "the two intentional deliveries must paste exactly two images");
+}
+
+/// Normal Ctrl+V press followed by release delivers exactly one image, not two.
+#[test]
+fn paste_press_and_release_delivers_single_image() {
+    let pdf = include_bytes!("../data/form.pdf").to_vec();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("form.pdf", None, pdf.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+
+    h.state_mut().clipboard_override = Some(pdfcraft_ui_egui::Clip::Image { width: 40, height: 20, rgba: [100u8, 200, 100, 255].repeat(40 * 20) });
+
+    // Press V with COMMAND
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: true, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(1);
+
+    // Release V with COMMAND
+    h.event(egui::Event::Key { key: egui::Key::V, physical_key: None, pressed: false, repeat: false, modifiers: egui::Modifiers::COMMAND });
+    h.run_steps(2);
+
+    let count = h.state().session.get(id).unwrap().page_images(0).len();
+    assert_eq!(count, initial_count + 1, "Ctrl+V press and release must deliver exactly one image, got {count}");
+}
+
+/// Issue P1: Paste via context menu at a point away from the centre centers the image at that point.
+#[test]
+fn paste_at_context_menu_point_centers_on_cursor() {
+    let pdf = include_bytes!("../data/form.pdf").to_vec();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("form.pdf", None, pdf.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+
+    h.state_mut().clipboard_override = Some(pdfcraft_ui_egui::Clip::Image { width: 60, height: 40, rgba: [50u8, 150, 250, 255].repeat(60 * 40) });
+
+    let target_at = [120.0, 180.0];
+    assert!(h.state_mut().paste_image_at(0, target_at));
+
+    let images = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images.len(), initial_count + 1);
+    let r = images[initial_count].rect;
+    let center = ((r[0] + r[2]) / 2.0, (r[1] + r[3]) / 2.0);
+    assert!((center.0 - target_at[0]).abs() < 1.0 && (center.1 - target_at[1]).abs() < 1.0, "expected center {target_at:?}, got {center:?}");
+}
+
+/// Issue P2: A newer clipboard override image beats stale in-app copy.
+#[test]
+fn newer_clipboard_override_beats_stale_in_app_copy() {
+    let pdf = include_bytes!("../data/form.pdf").to_vec();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("form.pdf", None, pdf.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+
+    let id = h.state().views[0].id;
+    let initial_count = h.state().session.get(id).unwrap().page_images(0).len();
+
+    // Stale in-app copy: 10x10 red image
+    h.state_mut().last_copied_image = Some((10, 10, [255u8, 0, 0, 255].repeat(100)));
+
+    // Newer clipboard override: 50x50 green image
+    h.state_mut().clipboard_override = Some(pdfcraft_ui_egui::Clip::Image { width: 50, height: 50, rgba: [0u8, 255, 0, 255].repeat(2500) });
+
+    assert!(h.state_mut().paste_image(0, None));
+    let images = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images.len(), initial_count + 1);
+    let r = images[initial_count].rect;
+    let (w, h_dim) = (r[2] - r[0], r[3] - r[1]);
+    assert!((w - 50.0).abs() < 1.0 && (h_dim - 50.0).abs() < 1.0, "expected 50x50 override image, got {w}x{h_dim}");
+}
+
+#[test]
+fn rotated_image_selection_and_crop() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let id = h.state().views[0].id;
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // Select the image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    // Right-click and rotate clockwise
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    h.get_by_label("Rotate Clockwise").click();
+    h.run_steps(3);
+
+    let doc = h.state().session.get(id).unwrap();
+    let im_rotated = &doc.page_images(0)[0];
+    assert!(im_rotated.matrix[1].abs() > 1.0 || im_rotated.matrix[2].abs() > 1.0, "matrix is rotated: {:?}", im_rotated.matrix);
+
+    // Enter crop mode with user-space bounds [0.2..0.8] of rotated image rect
+    let full = im_rotated.rect;
+    let crop_keep = [
+        full[0] + (full[2] - full[0]) * 0.2,
+        full[1] + (full[3] - full[1]) * 0.2,
+        full[0] + (full[2] - full[0]) * 0.8,
+        full[1] + (full[3] - full[1]) * 0.8,
+    ];
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop = Some(pdfcraft_ui_egui::CropMode::new(crop_keep));
+    h.run_steps(2);
+
+    // Apply crop via Enter key
+    h.key_press(egui::Key::Enter);
+    h.run_steps(4);
+
+    let doc = h.state().session.get(id).unwrap();
+    assert_eq!(doc.can_undo(), Some("Crop image"));
+    let im_cropped = &doc.page_images(0)[0];
+    assert!(im_cropped.matrix[1].abs() > 1.0 || im_cropped.matrix[2].abs() > 1.0, "matrix remains rotated: {:?}", im_cropped.matrix);
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_none()), "crop mode ended");
+}
+
+#[test]
+fn test_image_8_handles_render_and_drag() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(100, 100, image::Rgb([100, 150, 200]))
+        .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+        .unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("square.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // Select the image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    let view = &h.state().views[0];
+    let sel = view.image_selection.as_ref().unwrap();
+    let doc = h.state().session.get(view.id).unwrap();
+    let img = &doc.page_images(sel.page)[sel.index];
+    let xf =
+        pdfcraft_ui_egui::canvas::PageXform { rect: r, rot: view.rotation, pw: doc.info.pages[sel.page].width, ph: doc.info.pages[sel.page].height };
+    let obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(img, &xf, &doc.info, sel.page);
+
+    // Assert that exactly 8 unique resize handles (4 corners, 4 midpoints) are generated
+    let handles = obb.handles();
+    assert_eq!(handles.len(), 8, "exactly 8 resize handles generated");
+
+    let corners = [
+        pdfcraft_ui_egui::ImageHandle::TopLeft,
+        pdfcraft_ui_egui::ImageHandle::TopRight,
+        pdfcraft_ui_egui::ImageHandle::BottomRight,
+        pdfcraft_ui_egui::ImageHandle::BottomLeft,
+    ];
+    let midpoints = [
+        pdfcraft_ui_egui::ImageHandle::TopCenter,
+        pdfcraft_ui_egui::ImageHandle::RightCenter,
+        pdfcraft_ui_egui::ImageHandle::BottomCenter,
+        pdfcraft_ui_egui::ImageHandle::LeftCenter,
+    ];
+    for corner in &corners {
+        assert!(handles.iter().any(|(h, _)| h == corner), "missing corner handle: {:?}", corner);
+    }
+    for midpoint in &midpoints {
+        assert!(handles.iter().any(|(h, _)| h == midpoint), "missing midpoint handle: {:?}", midpoint);
+    }
+
+    for i in 0..8 {
+        for j in (i + 1)..8 {
+            assert!((handles[i].1 - handles[j].1).length() > 1.0, "handles {} and {} must be unique positions", i, j);
+        }
+    }
+
+    // Simulate a pointer drag on a corner that shrinks the image to 5x5 pixels and assert it does not panic
+    let tr_pos = obb.handle_pos(pdfcraft_ui_egui::ImageHandle::TopRight);
+    let anchor = obb.s00;
+    let shrink_target = anchor + egui::vec2(5.0, 5.0);
+    h.hover_at(tr_pos);
+    h.run_steps(1);
+    h.drag_at(tr_pos);
+    h.run_steps(1);
+    h.hover_at(shrink_target);
+    h.run_steps(2);
+    h.drop_at(shrink_target);
+    h.run_steps(4);
+}
+
+#[test]
+fn test_image_context_menu_precedence() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+
+    // Select the image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some(), "selected");
+
+    // Simulate a secondary click strictly inside an image's bounds
+    h.hover_at(c);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: c, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // Assert that the image widget consumes the click and the canvas background menu does not trigger
+    h.get_by_label("Rotate Clockwise");
+    h.get_by_label("Flip horizontal");
+    assert!(h.query_all_by_label("Rotate view clockwise").next().is_none(), "canvas background menu must not trigger");
+    assert!(h.query_all_by_label("Add bookmark").next().is_none(), "canvas background menu must not trigger");
+    assert!(h.query_all_by_label("Take a snapshot").next().is_none(), "canvas background menu must not trigger");
+}
+
+#[test]
+fn crop_action_pills_interactive_and_apply_cancel_reset() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(100, 100, image::Rgb([100, 150, 200]))
+        .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+        .unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("square.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let c = r.center();
+    // Select image
+    h.hover_at(c);
+    h.run_steps(1);
+    h.drag_at(c);
+    h.run_steps(1);
+    h.drop_at(c);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some());
+
+    // Enter crop mode
+    let doc_id = h.state().views[0].id;
+    let original_rect = h.state().session.get(doc_id).unwrap().page_images(0)[0].rect;
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop = Some(pdfcraft_ui_egui::CropMode::new(original_rect));
+    h.run_steps(2);
+
+    // Set smaller crop rect (50x50 in center)
+    let smaller = egui::Rect::from_center_size(c, egui::vec2(50.0, 50.0));
+    set_crop_box(&mut h, smaller);
+    h.run_steps(2);
+
+    let pill_y = smaller.max.y + 17.0;
+    let done_pos = egui::pos2(smaller.max.x - 20.0, pill_y);
+    h.hover_at(done_pos);
+    h.run_steps(1);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::PointingHand, "Done pill has PointingHand cursor");
+
+    let cancel_pos = egui::pos2(smaller.max.x - 85.0, pill_y);
+    h.hover_at(cancel_pos);
+    h.run_steps(1);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::PointingHand, "Cancel pill has PointingHand cursor");
+
+    // Click Cancel pill: exits crop mode without applying changes
+    click_at(&mut h, cancel_pos);
+    h.run_steps(3);
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_none()), "Cancel exits crop mode");
+    assert_eq!(h.state().session.get(doc_id).unwrap().page_images(0)[0].visible_rect, Some(original_rect), "image is uncropped");
+
+    // Re-enter crop mode and set crop rect
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop = Some(pdfcraft_ui_egui::CropMode::new(original_rect));
+    set_crop_box(&mut h, smaller);
+    h.run_steps(2);
+
+    // Click "Remove Crop" pill
+    let reset_pos = egui::pos2(smaller.max.x - 170.0, pill_y);
+    h.hover_at(reset_pos);
+    h.run_steps(1);
+    assert_eq!(h.output().platform_output.cursor_icon, egui::CursorIcon::PointingHand, "Remove Crop pill has PointingHand cursor");
+    click_at(&mut h, reset_pos);
+    h.run_steps(2);
+    let current_keep = h.state().views[0].image_selection.as_ref().unwrap().crop.as_ref().unwrap().keep;
+    assert_eq!(current_keep, original_rect, "Remove Crop restored crop to full bounds");
+
+    // Re-set smaller crop and click "Done" pill to apply
+    set_crop_box(&mut h, smaller);
+    h.run_steps(2);
+    let done_pos_after = egui::pos2(smaller.max.x - 20.0, pill_y);
+    click_at(&mut h, done_pos_after);
+    h.run_steps(4);
+
+    assert!(h.state().views[0].image_selection.as_ref().is_some_and(|s| s.crop.is_none()), "Done exits crop mode");
+    let after_images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_ne!(after_images[0].visible_rect, Some(original_rect), "crop was applied");
+}
+
+#[test]
+fn test_cropped_image_selection_and_bounding_box() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(100, 100, image::Rgb([100, 150, 200]))
+        .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+        .unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("square.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let doc_id = h.state().views[0].id;
+    let full_rect = h.state().session.get(doc_id).unwrap().page_images(0)[0].rect;
+
+    // Apply crop to the center quarter: [0.25, 0.25, 0.75, 0.75]
+    let crop_keep = [
+        full_rect[0] + (full_rect[2] - full_rect[0]) * 0.25,
+        full_rect[1] + (full_rect[3] - full_rect[1]) * 0.25,
+        full_rect[0] + (full_rect[2] - full_rect[0]) * 0.75,
+        full_rect[1] + (full_rect[3] - full_rect[1]) * 0.75,
+    ];
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 0, change: pdfcraft_engine::ImageEdit::Crop(crop_keep) });
+    h.run_steps(4);
+
+    let img = &h.state().session.get(doc_id).unwrap().page_images(0)[0];
+    assert_eq!(img.rect, full_rect, "underlying CTM rect is non-destructively preserved");
+    let vis = img.visible_rect.expect("has visible_rect");
+    assert!((vis[0] - crop_keep[0]).abs() < 1e-3);
+    assert!((vis[1] - crop_keep[1]).abs() < 1e-3);
+    assert!((vis[2] - crop_keep[2]).abs() < 1e-3);
+    assert!((vis[3] - crop_keep[3]).abs() < 1e-3);
+
+    // Verify selectable bounds helper gives the cropped intersection
+    assert_eq!(pdfcraft_ui_egui::canvas::image_selectable_bounds(img), vis);
+
+    // Select tool (mouse tool)
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::Select;
+    h.run_steps(2);
+
+    let page_rect = h.state().views[0].page_screen_rect(0).expect("on screen");
+    // Center point is inside the cropped area:
+    let center = page_rect.center();
+    click_at(&mut h, center);
+    h.run_steps(2);
+
+    let picked = h.state().views[0].picked_image.expect("image is picked when clicking inside crop");
+    assert_eq!(picked.page, 0);
+    assert_eq!(picked.index, 0);
+    // The selection bounding box wraps the visible cropped area, NOT the full CTM rect!
+    assert_eq!(picked.rect, vis, "picked rect wraps the cropped bounds");
+
+    // Deselect
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().views[0].picked_image.is_none());
+
+    // Corner point (e.g. top-left corner of the page) is outside the crop box but inside full CTM rect
+    let corner = page_rect.min + egui::vec2(10.0, 10.0);
+    click_at(&mut h, corner);
+    h.run_steps(2);
+    assert!(h.state().views[0].picked_image.is_none(), "clicking cropped-away region must not hit-test or select the image");
+}
+
 /// The Read mode command (not the mode bar) applies a paragraph still open in the editor, as
 /// putting the Edit text tool down does; left open, it would stay drawn in Read mode with no tool.
 #[test]
@@ -6828,6 +8063,215 @@ fn read_mode_shortcut_applies_the_open_paragraph() {
     assert_eq!(s.session.get(s.views[0].id).unwrap().text_lines(0)[0].text, "Chapter One", "the edit is applied");
 }
 
+#[test]
+fn arrange_duplicate_image_clears_selection_when_ambiguous() {
+    use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
+    let mut doc = Document::open(std::sync::Arc::new(fixture(1))).unwrap();
+    let page = pdfcraft_model::pages(&doc)[0].clone();
+    let mut form = Dict::new();
+    form.set(b"Subtype".to_vec(), Object::name("Form"));
+    form.set(b"BBox".to_vec(), Object::Array([0, 0, 200, 300].map(Object::Int).to_vec()));
+    let artwork = doc.add(Object::Stream(Stream::flate(form, b"0.2 0.5 0.9 rg 20 20 160 260 re f")));
+    // Paint two occurrences of the same figure at the exact same position
+    let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), b"q 1 0 0 1 0 0 cm /Figure Do Q q 1 0 0 1 0 0 cm /Figure Do Q")));
+    doc.update_dict(page.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Ref(contents));
+        let mut xo = Dict::new();
+        xo.set(b"Figure".to_vec(), Object::Ref(artwork));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xo));
+        d.set(b"Resources".to_vec(), Object::Dict(resources));
+    })
+    .unwrap();
+    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("dup.pdf", None, bytes.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let doc_id = h.state().views[0].id;
+    let images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_eq!(images.len(), 2, "two duplicate image occurrences exist");
+    assert_eq!(images[0].rect, images[1].rect);
+    assert_eq!(images[0].name, images[1].name);
+
+    // Select the second occurrence (index 1)
+    h.state_mut().views[0].image_selection =
+        Some(pdfcraft_ui_egui::ImageSelection { page: 0, index: 1, drag: None, crop: None, turning: false, settled: None });
+    h.run_steps(2);
+
+    // Arrange send to back
+    let applied = h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 1,
+        change: pdfcraft_engine::ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::SendToBack),
+    });
+    assert!(applied);
+    h.run_steps(2);
+
+    // Because there are duplicate occurrences matching name, object, and rect,
+    // selection must be cleared rather than picking an arbitrary occurrence.
+    assert!(h.state().views[0].image_selection.is_none(), "selection is safely cleared when reordering ambiguous duplicate images");
+}
+
+#[test]
+fn arrange_unique_image_preserves_selection() {
+    use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
+    let mut doc = Document::open(std::sync::Arc::new(fixture(1))).unwrap();
+    let page = pdfcraft_model::pages(&doc)[0].clone();
+    let mut form = Dict::new();
+    form.set(b"Subtype".to_vec(), Object::name("Form"));
+    form.set(b"BBox".to_vec(), Object::Array([0, 0, 200, 300].map(Object::Int).to_vec()));
+    let artwork1 = doc.add(Object::Stream(Stream::flate(form.clone(), b"0.2 0.5 0.9 rg 20 20 160 260 re f")));
+    let artwork2 = doc.add(Object::Stream(Stream::flate(form, b"0.9 0.2 0.5 rg 40 40 100 100 re f")));
+    let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), b"q 1 0 0 1 0 0 cm /FigA Do Q q 1 0 0 1 0 0 cm /FigB Do Q")));
+    doc.update_dict(page.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Ref(contents));
+        let mut xo = Dict::new();
+        xo.set(b"FigA".to_vec(), Object::Ref(artwork1));
+        xo.set(b"FigB".to_vec(), Object::Ref(artwork2));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xo));
+        d.set(b"Resources".to_vec(), Object::Dict(resources));
+    })
+    .unwrap();
+    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("unique.pdf", None, bytes.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let doc_id = h.state().views[0].id;
+    let images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_eq!(images.len(), 2);
+    assert_eq!(images[0].name, "FigA");
+    assert_eq!(images[1].name, "FigB");
+
+    // Select FigA at index 0 and bring it to front (should move after FigB, becoming index 1)
+    h.state_mut().views[0].image_selection =
+        Some(pdfcraft_ui_egui::ImageSelection { page: 0, index: 0, drag: None, crop: None, turning: false, settled: None });
+    h.run_steps(2);
+
+    let applied = h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 0,
+        change: pdfcraft_engine::ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringToFront),
+    });
+    assert!(applied);
+    h.run_steps(2);
+
+    let sel = h.state().views[0].image_selection.as_ref().expect("selection is preserved for unique image");
+    assert_eq!(sel.index, 1, "selection index tracks the unique image's new position");
+}
+
+#[test]
+fn undo_arrange_re_resolves_image_selection_or_clears() {
+    use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
+    let mut doc = Document::open(std::sync::Arc::new(fixture(1))).unwrap();
+    let page = pdfcraft_model::pages(&doc)[0].clone();
+    let mut form = Dict::new();
+    form.set(b"Subtype".to_vec(), Object::name("Form"));
+    form.set(b"BBox".to_vec(), Object::Array([0, 0, 200, 300].map(Object::Int).to_vec()));
+    let artwork1 = doc.add(Object::Stream(Stream::flate(form.clone(), b"0.2 0.5 0.9 rg 20 20 160 260 re f")));
+    let artwork2 = doc.add(Object::Stream(Stream::flate(form, b"0.9 0.2 0.5 rg 40 40 100 100 re f")));
+    let contents = doc.add(Object::Stream(Stream::flate(Dict::new(), b"q 1 0 0 1 0 0 cm /FigA Do Q q 1 0 0 1 0 0 cm /FigB Do Q")));
+    doc.update_dict(page.obj, |d| {
+        d.set(b"Contents".to_vec(), Object::Ref(contents));
+        let mut xo = Dict::new();
+        xo.set(b"FigA".to_vec(), Object::Ref(artwork1));
+        xo.set(b"FigB".to_vec(), Object::Ref(artwork2));
+        let mut resources = Dict::new();
+        resources.set(b"XObject".to_vec(), Object::Dict(xo));
+        d.set(b"Resources".to_vec(), Object::Dict(resources));
+    })
+    .unwrap();
+    let bytes = write_incremental(&doc, &SaveOptions::default()).unwrap();
+
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("undo_arrange.pdf", None, bytes.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let doc_id = h.state().views[0].id;
+    let images = h.state().session.get(doc_id).unwrap().page_images(0);
+    assert_eq!(images.len(), 2);
+    assert_eq!(images[0].name, "FigA");
+    assert_eq!(images[1].name, "FigB");
+
+    // Select FigA (back image, index 0)
+    h.state_mut().views[0].image_selection =
+        Some(pdfcraft_ui_egui::ImageSelection { page: 0, index: 0, drag: None, crop: None, turning: false, settled: None });
+    h.run_steps(2);
+
+    // Bring to front
+    let applied = h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 0,
+        change: pdfcraft_engine::ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringToFront),
+    });
+    assert!(applied);
+    h.run_steps(2);
+
+    // Selection now tracks FigA at index 1
+    let sel = h.state().views[0].image_selection.as_ref().expect("selected after arrange");
+    assert_eq!(sel.index, 1);
+
+    // Undo
+    assert!(h.state_mut().execute("edit.undo"));
+    h.run_steps(2);
+
+    let doc_after = h.state().session.get(doc_id).unwrap();
+    let images_after = doc_after.page_images(0);
+    assert_eq!(images_after[0].name, "FigA");
+    assert_eq!(images_after[1].name, "FigB");
+
+    // After undoing Bring to front, selection must either be FigA (index 0) or None, never FigB (index 1)
+    let sel_after = h.state().views[0].image_selection.as_ref().expect("selection re-resolved to the same image");
+    assert_eq!(sel_after.index, 0, "selection should point to FigA at index 0, not FigB at index 1");
+    assert_eq!(images_after[sel_after.index].name, "FigA");
+
+    // Redo
+    assert!(h.state_mut().execute("edit.redo"));
+    h.run_steps(2);
+
+    let doc_redo = h.state().session.get(doc_id).unwrap();
+    let images_redo = doc_redo.page_images(0);
+    assert_eq!(images_redo[0].name, "FigB");
+    assert_eq!(images_redo[1].name, "FigA");
+
+    let sel_redo = h.state().views[0].image_selection.as_ref().expect("selection re-resolved after redo");
+    assert_eq!(sel_redo.index, 1, "selection should point to FigA at index 1");
+    assert_eq!(images_redo[sel_redo.index].name, "FigA");
+
+    // Bringing to front when already at front is refused, but selection must be preserved
+    let applied_again = h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 1,
+        change: pdfcraft_engine::ImageEdit::Arrange(pdfcraft_engine::ArrangeOrder::BringToFront),
+    });
+    assert!(!applied_again);
+    h.run_steps(2);
+    let sel_refused = h.state().views[0].image_selection.as_ref().expect("selection preserved after refused arrange");
+    assert_eq!(sel_refused.index, 1);
+}
+
 /// #3061: a paragraph running past its page's bottom edge (an HTML converter relying on the
 /// page clip) opens in an editor that draws on its page only. It covered the next page.
 #[test]
@@ -7036,6 +8480,246 @@ fn mode_tabs_keep_the_hand_over_a_paragraph_scrolled_under_them() {
     assert_eq!(h.state().mode, pdfcraft_ui_egui::Mode::Convert, "the tab takes the click, not the paragraph's editor");
 }
 
+#[test]
+fn copy_pasted_image_discards_coordinates_and_moves_without_offset() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(60, 60, image::Rgb([100, 150, 200])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+
+    let mut h = harness(1, |_| {});
+    h.state_mut().system_clipboard = false;
+    h.run_steps(4);
+
+    // 1. Add image to page 0
+    h.state_mut().add_image("test_img.png".into(), png);
+    h.run_steps(3);
+
+    let id = h.state().views[0].id;
+    let images_before = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images_before.len(), 1);
+
+    // 2. Copy the image from page 0
+    assert!(h.state_mut().copy_page_image(0, 0));
+    assert!(h.state().last_copied_image.is_some(), "image pixel data is kept");
+
+    // 3. Paste the image via Ctrl+V (paste_image with rect: None)
+    assert!(h.state_mut().paste_image(0, None));
+    h.run_steps(3);
+
+    let images_after_paste = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images_after_paste.len(), 2, "second image pasted");
+
+    // The pasted image should be centered on the page, not offset by (+20, -20) from the first image
+    let img1 = &images_after_paste[0];
+    let img2 = &images_after_paste[1];
+    assert_eq!(img1.rect, img2.rect, "pasted image placed using natural page centering");
+
+    // 4. Move the pasted image by an explicit Move change
+    let target = [50.0, 50.0, 110.0, 110.0];
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage { page: 0, index: 1, change: pdfcraft_engine::ImageEdit::Move(target) });
+    h.run_steps(3);
+
+    let images_after_move = h.state().session.get(id).unwrap().page_images(0);
+    assert_eq!(images_after_move[1].rect, target, "moved image rect matches target exactly without offset");
+}
+
+#[test]
+fn clicking_after_image_context_menu_action_resets_menu_state_and_updates_selection() {
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(80, 40, image::Rgb([200, 40, 40])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("picture.png", None, png.clone()).expect("opens");
+        app
+    });
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+    // Move the first image to left side: [10.0, 10.0, 30.0, 30.0]
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+        page: 0,
+        index: 0,
+        change: pdfcraft_engine::ImageEdit::Move([10.0, 10.0, 30.0, 30.0]),
+    });
+    // Add second image to right side: [50.0, 10.0, 70.0, 30.0]
+    let mut png2 = Vec::new();
+    image::RgbImage::from_pixel(20, 20, image::Rgb([40, 200, 40])).write_to(&mut std::io::Cursor::new(&mut png2), image::ImageFormat::Png).unwrap();
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::AddImage {
+        page: 0,
+        rect: Some([50.0, 10.0, 70.0, 30.0]),
+        name: "img2.png".into(),
+        bytes: std::sync::Arc::new(png2),
+    });
+    h.run_steps(4);
+
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let info = h.state().session.get(id).unwrap().info.pages[0].clone();
+    let user_to_screen = move |u: [f64; 2]| {
+        let v = info.user_to_view(u[0] as f32, u[1] as f32);
+        let scale = r.width() / info.width;
+        egui::pos2(r.left() + v[0] * scale, r.top() + v[1] * scale)
+    };
+
+    let p0 = user_to_screen([20.0, 20.0]);
+    let p1 = user_to_screen([60.0, 20.0]);
+    let p_empty = user_to_screen([40.0, 35.0]);
+
+    // 1. Select image 0
+    h.hover_at(p0);
+    h.run_steps(1);
+    h.drag_at(p0);
+    h.run_steps(1);
+    h.drop_at(p0);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| s.index), Some(0), "image 0 selected");
+
+    // 2. Select image 1 (switches selection)
+    h.hover_at(p1);
+    h.run_steps(1);
+    h.drag_at(p1);
+    h.run_steps(1);
+    h.drop_at(p1);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| s.index), Some(1), "image 1 selected");
+
+    // 3. Click empty space (clears selection)
+    h.hover_at(p_empty);
+    h.run_steps(1);
+    h.drag_at(p_empty);
+    h.run_steps(1);
+    h.drop_at(p_empty);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_none(), "empty page clears selection");
+
+    // 4. Select image 0 again
+    h.hover_at(p0);
+    h.run_steps(1);
+    h.drag_at(p0);
+    h.run_steps(1);
+    h.drop_at(p0);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| s.index), Some(0), "image 0 selected again");
+
+    // 5. Right-click image 0 to open context menu
+    h.hover_at(p0);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p0, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: p0, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // 6. Click "Flip horizontal"
+    h.get_by_label("Flip horizontal").click();
+    h.run_steps(3);
+
+    assert!(h.query_all_by_label("Flip horizontal").next().is_none(), "the image menu closes after its action");
+
+    // 7. Click image 1: should switch selection to image 1
+    h.hover_at(p1);
+    h.run_steps(1);
+    h.drag_at(p1);
+    h.run_steps(1);
+    h.drop_at(p1);
+    h.run_steps(2);
+    assert_eq!(
+        h.state().views[0].image_selection.as_ref().map(|s| s.index),
+        Some(1),
+        "clicking other image switches selection after context menu action"
+    );
+
+    // 8. Click empty space: should clear selection
+    h.hover_at(p_empty);
+    h.run_steps(1);
+    h.drag_at(p_empty);
+    h.run_steps(1);
+    h.drop_at(p_empty);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_none(), "clicking empty page clears selection after context menu action");
+}
+
+#[test]
+fn format_panel_shows_selection_size_and_updates_after_font_applied() {
+    let mut objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [4 0 R] /Count 1 /MediaBox [0 0 200 300] >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Contents 5 0 R /Resources << /Font << /F1 3 0 R >> >> >>".into(),
+    ];
+    let body = "BT /F1 24 Tf 20 200 Td (Heading) Tj /F1 12 Tf 0 -25 Td (Paragraph) Tj ET";
+    objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+    let mut pdf = Vec::from(b"%PDF-1.7\n");
+    let mut xref = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        xref.push(pdf.len());
+        pdf.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref_pos = pdf.len();
+    pdf.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in xref {
+        pdf.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    pdf.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref_pos}\n%%EOF\n", objs.len() + 1).as_bytes());
+
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("test.pdf", None, pdf).expect("fixture opens");
+        app
+    });
+    h.run_steps(4);
+
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+    let at = egui::pos2(r.left() + 40.0 / 200.0 * r.width(), r.top() + (300.0 - 180.0) / 300.0 * r.height());
+    h.hover_at(at);
+    h.run_steps(1);
+    h.drag_at(at);
+    h.run_steps(1);
+    h.drop_at(at);
+    h.run_steps(3);
+
+    assert!(h.state().views[0].line_editor.is_some(), "editor opened");
+    let text = h.state().views[0].line_editor.as_ref().unwrap().text.clone();
+    assert!(text.contains("Paragraph"), "text is {text}");
+
+    // Select the 12 pt paragraph text "Paragraph" via keyboard selection in the TextEdit
+    h.key_press_modifiers(Modifiers::COMMAND, Key::ArrowRight);
+    h.run_steps(1);
+    for _ in 0.."Paragraph".len() {
+        h.key_press_modifiers(Modifiers::SHIFT, Key::ArrowLeft);
+        h.run_steps(1);
+    }
+    use egui::accesskit::Role;
+    let size_node = h.get_by_role_and_label(Role::TextInput, "Font size:");
+    assert_eq!(size_node.value().as_deref(), Some("12"), "size text input value is 12");
+
+    let font_node = h.get_by_role_and_label(Role::ComboBox, "Font");
+    assert_eq!(font_node.value().as_deref(), Some("Helvetica"), "initial font is Helvetica");
+
+    // Apply Times to the selection
+    font_node.click();
+    h.run_steps(2);
+    h.get_by_label("Times").click();
+    h.run_steps(4);
+
+    // Font combo box for the whole block is now Mixed because Heading is Helvetica and Paragraph is Times
+    let font_node = h.get_by_role_and_label(Role::ComboBox, "Font");
+    assert_eq!(font_node.value().as_deref(), Some("Mixed"), "whole block has mixed fonts");
+
+    // Apply Times to the whole block
+    font_node.click();
+    h.run_steps(2);
+    h.get_by_label("Times").click();
+    h.run_steps(4);
+
+    // Now all text is Times, so font combo box updates to Times
+    let font_node = h.get_by_role_and_label(Role::ComboBox, "Font");
+    assert_eq!(font_node.value().as_deref(), Some("Times"), "font combo box updates to Times");
+}
+
 /// The paragraph opened for typing, as a person opens it: a click on its text.
 fn open_paragraph(h: &mut Harness<'static, PdfCraftApp>) {
     let r = h.state().views[0].page_screen_rect(0).expect("on screen");
@@ -7520,6 +9204,101 @@ fn a_paragraph_selected_by_its_frame_deletes_with_one_key() {
     }
 }
 
+fn two_image_fixture() -> Vec<u8> {
+    let content = "q 20 0 0 20 100 100 cm /Im0 Do Q q 20 0 0 20 20 20 cm /Im0 Do Q";
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 300] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >>".into(),
+        format!("<< /Length {} >>\nstream\n{content}\nendstream", content.len()),
+        "<< /Type /XObject /Subtype /Image /Width 2 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8 /Length 4 >>\nstream\n\0\0\0\0\nendstream"
+            .into(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+#[test]
+fn duplicate_xobject_at_different_rects_arrange_and_delete_keeps_other_instance_through_menu() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1400.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("dup.pdf", None, two_image_fixture()).expect("opens fixture");
+        app
+    });
+    h.run_steps(4);
+    let id = h.state().views[0].id;
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.run_steps(2);
+
+    let xf = h.state().views[0].page_xform(0).expect("page 0 xform");
+    let imgs = h.state().session.get(id).unwrap().page_images(0);
+    // B is at index 0 [100, 100, 120, 120], in the back
+    let b0 = pdfcraft_ui_egui::canvas::image_screen_rect(&imgs[0], &xf, &h.state().session.get(id).unwrap().info, 0);
+    let p_b = b0.center();
+
+    // 1. Select B (image 0)
+    h.hover_at(p_b);
+    h.run_steps(1);
+    h.drag_at(p_b);
+    h.run_steps(1);
+    h.drop_at(p_b);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].image_selection.as_ref().map(|s| s.index), Some(0), "image 0 (B) selected");
+
+    // 2. Right-click B (image 0) to open context menu
+    h.hover_at(p_b);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p_b, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: p_b, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // 3. Open "Arrange image" submenu and click "Bring to front"
+    h.get_by_label("Arrange image").click();
+    h.run_steps(2);
+    h.get_by_label("Bring to front").click();
+    h.run_steps(3);
+
+    // 4. Selection must be preserved after arrange: B is now at index 1 (in front)
+    let sel = h.state().views[0].image_selection.as_ref().map(|s| s.index);
+    assert_eq!(sel, Some(1), "selection must track B to index 1 after arrange");
+
+    // 5. Right-click on the selected image (B at index 1) again to open context menu
+    let sel_idx = sel.unwrap();
+    let xf_again = h.state().views[0].page_xform(0).expect("page 0 xform");
+    let cur_imgs = h.state().session.get(id).unwrap().page_images(0);
+    let b_rect = pdfcraft_ui_egui::canvas::image_screen_rect(&cur_imgs[sel_idx], &xf_again, &h.state().session.get(id).unwrap().info, 0);
+    let p_b2 = b_rect.center();
+    h.hover_at(p_b2);
+    h.run_steps(1);
+    h.event(egui::Event::PointerButton { pos: p_b2, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: p_b2, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+
+    // 6. Click "Delete" in context menu
+    h.get_by_label("Delete").click();
+    h.run_steps(3);
+
+    // 7. Save, reopen and verify: A remains at [20, 20, 40, 40], B is deleted
+    let saved = h.state().session.save_bytes(id).unwrap();
+    let mut reopened = pdfcraft_engine::Session::new();
+    let rid = reopened.open("again.pdf", None, saved, None).unwrap();
+    let imgs = reopened.get(rid).unwrap().page_images(0);
+    assert_eq!(imgs.len(), 1, "exactly one image must remain after deleting B");
+    assert!((imgs[0].rect[0] - 20.0).abs() < 1e-2, "remaining image must be A at [20, 20, 40, 40], was {:?}", imgs[0].rect);
+}
+
 /// Esc in an open paragraph leaves its text and selects its box, as in Acrobat, so Esc and
 /// Delete remove it without aiming for the thin frame; the unapplied draft is discarded.
 #[test]
@@ -7554,3 +9333,316 @@ fn escape_in_an_open_paragraph_selects_its_box_for_delete() {
         assert_eq!(blocks(&h)[0].text, "Page 1");
     }
 }
+
+#[test]
+fn outward_image_grip_drags_grow_on_rotated_pages() {
+    for rotation in [0, 90, 180, 270] {
+        for image_turn in [0.0, 25.0] {
+            for grip in 0..8 {
+                let mut png = Vec::new();
+                image::RgbImage::from_pixel(100, 80, image::Rgb([100, 150, 200]))
+                    .write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png)
+                    .unwrap();
+                let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+                    let mut app = PdfCraftApp::new();
+                    app.set_option("language", "en").unwrap();
+                    app.open_bytes("grips.png", None, png.clone()).unwrap();
+                    app
+                });
+                h.run_steps(4);
+                h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+                    page: 0,
+                    index: 0,
+                    change: pdfcraft_engine::ImageEdit::Move([20.0, 20.0, 80.0, 60.0]),
+                });
+                h.state_mut().apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: rotation });
+                if image_turn != 0.0 {
+                    h.state_mut().apply_edit(pdfcraft_engine::Edit::EditPageImage {
+                        page: 0,
+                        index: 0,
+                        change: pdfcraft_engine::ImageEdit::RotateBy(image_turn),
+                    });
+                }
+                h.state_mut().views[0].fit = pdfcraft_ui_egui::canvas::Fit::Page;
+                assert!(h.state_mut().execute("edit.edit_text"));
+                h.state_mut().views[0].image_selection = Some(pdfcraft_ui_egui::ImageSelection::at(0, 0));
+                h.run_steps(3);
+                let view = &h.state().views[0];
+                let doc = h.state().session.get(view.id).unwrap();
+                let before = doc.page_images(0)[0].clone();
+                let obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(&before, &view.page_xform(0).unwrap(), &doc.info, 0);
+                let (handle, start) = obb.handles()[grip];
+                let opposite = obb.handles()[(grip + 4) % 8].0;
+                let finish = start + (start - obb.screen_center) * 0.15;
+                assert!(view.viewport_rect().contains(start) && view.viewport_rect().contains(finish), "test grips must be visible");
+                h.hover_at(start);
+                h.run_steps(1);
+                h.drag_at(start);
+                h.run_steps(1);
+                let started = h.state().views[0].image_selection.clone();
+                h.hover_at(finish);
+                h.run_steps(2);
+                let moved = h.state().views[0].image_selection.clone();
+                h.drop_at(finish);
+                h.run_steps(3);
+                let view = &h.state().views[0];
+                let doc = h.state().session.get(view.id).unwrap();
+                let images = doc.page_images(0);
+                let after = &images[0];
+                let after_obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(after, &view.page_xform(0).unwrap(), &doc.info, 0);
+                assert!(
+                    after_obb.handle_pos(opposite).distance(obb.handle_pos(opposite)) < 1.0,
+                    "fixed grip moved: rotation={rotation} image_turn={image_turn} grip={grip}"
+                );
+                assert!(
+                    after_obb.handle_pos(handle).distance(finish) < 1.0,
+                    "dragged grip missed pointer: rotation={rotation} image_turn={image_turn} grip={grip}"
+                );
+                let area = |m: [f64; 6]| (m[0] * m[3] - m[1] * m[2]).abs();
+                assert!(
+                    area(after.matrix) > area(before.matrix) * 1.05,
+                    "outward grip shrank or ignored: rotation={rotation} image_turn={image_turn} grip={grip}: {:?} => {:?}; started={started:?} moved={moved:?}",
+                    before.matrix,
+                    after.matrix
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn author_image_clip_is_not_offered_as_a_removable_editor_crop() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1100.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("author-clip.pdf", None, clipped_artwork_with_labels()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.state_mut().views[0].image_selection = Some(pdfcraft_ui_egui::ImageSelection::at(0, 0));
+    h.run_steps(3);
+    let view = &h.state().views[0];
+    let doc = h.state().session.get(view.id).unwrap();
+    let image = doc.page_images(0)[0].clone();
+    let visible = image.visible_rect.unwrap();
+    let xf = view.page_xform(0).unwrap();
+    let bounds = pdfcraft_ui_egui::canvas::image_screen_rect(&image, &xf, &doc.info, 0);
+    let p = bounds.center();
+    h.hover_at(p);
+    h.event(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Secondary, pressed: true, modifiers: Default::default() });
+    h.event(egui::Event::PointerButton { pos: p, button: egui::PointerButton::Secondary, pressed: false, modifiers: Default::default() });
+    h.run_steps(2);
+    assert!(h.query_all_by_label("Remove crop").next().is_none(), "author clips are not editor crops");
+    h.get_by_label("Crop").click();
+    h.run_steps(2);
+    assert!(h.query_all_by_label("Remove Crop").next().is_none(), "the initial author clip has no removable draft crop");
+    let mut draft = visible;
+    draft[0] += (draft[2] - draft[0]) * 0.2;
+    h.state_mut().views[0].image_selection.as_mut().unwrap().crop.as_mut().unwrap().keep = draft;
+    h.run_steps(3);
+    h.get_by_label("Remove Crop").click();
+    h.run_steps(1);
+    assert_eq!(h.state().views[0].image_selection.as_ref().unwrap().crop.as_ref().unwrap().keep, visible, "draft reset preserves the author's clip");
+    h.get_by_label("Done").click();
+    h.run_steps(2);
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().page_images(0)[0].visible_rect, Some(visible));
+}
+
+fn affine_review_image_fixture(matrix: [f64; 6], clip: Option<[f64; 4]>, rotation: i64) -> Vec<u8> {
+    use pdfcraft_cos::{Dict, Document, Object, Stream};
+    let mut doc = Document::open(std::sync::Arc::new(fixture(1))).unwrap();
+    let page = pdfcraft_model::pages(&doc).remove(0);
+    let mut image = Dict::new();
+    image.set(b"Type".to_vec(), Object::name("XObject"));
+    image.set(b"Subtype".to_vec(), Object::name("Image"));
+    image.set(b"Width".to_vec(), Object::Int(1));
+    image.set(b"Height".to_vec(), Object::Int(1));
+    image.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+    image.set(b"ColorSpace".to_vec(), Object::name("DeviceRGB"));
+    let image = doc.add(Object::Stream(Stream::flate(image, &[220, 80, 50])));
+    let mut xobjects = Dict::new();
+    xobjects.set(b"ImReview".to_vec(), Object::Ref(image));
+    let mut resources = Dict::new();
+    resources.set(b"XObject".to_vec(), Object::Dict(xobjects));
+    let mut content = String::from("q ");
+    if let Some([x0, y0, x1, y1]) = clip {
+        content.push_str(&format!("{x0} {y0} {} {} re W n ", x1 - x0, y1 - y0));
+    }
+    let [a, b, c, d, e, f] = matrix;
+    content.push_str(&format!("{a} {b} {c} {d} {e} {f} cm /ImReview Do Q"));
+    let stream = doc.add(Object::Stream(Stream::flate(Dict::new(), content.as_bytes())));
+    doc.update_dict(page.obj, |dict| {
+        dict.set(b"Contents".to_vec(), Object::Ref(stream));
+        dict.set(b"Resources".to_vec(), Object::Dict(resources));
+        dict.set(b"MediaBox".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(0), Object::Int(360), Object::Int(360)]));
+        dict.set(b"Rotate".to_vec(), Object::Int(rotation));
+    })
+    .unwrap();
+    pdfcraft_cos::write_incremental(&doc, &Default::default()).unwrap()
+}
+
+fn affine_review_harness(bytes: Vec<u8>) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 1000.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("affine-review.pdf", None, bytes.clone()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    h.state_mut().views[0].fit = pdfcraft_ui_egui::canvas::Fit::Page;
+    assert!(h.state_mut().execute("edit.edit_text"));
+    h.state_mut().views[0].image_selection = Some(pdfcraft_ui_egui::ImageSelection::at(0, 0));
+    h.run_steps(3);
+    h
+}
+
+#[test]
+fn affine_review_resize_out_and_back_preserves_saved_placement() {
+    for (matrix, clip, rotation) in [
+        ([100.0, 0.0, 0.0, 100.0, 100.0, 100.0], None, 0),
+        ([100.0, 0.0, 50.0, 100.0, 100.0, 100.0], None, 0),
+        ([86.60254, 50.0, -50.0, 86.60254, 150.0, 100.0], None, 0),
+        ([100.0, 0.0, 0.0, 100.0, 100.0, 100.0], Some([100.0, 100.0, 150.0, 200.0]), 90),
+    ] {
+        for offset in [egui::Vec2::ZERO, egui::vec2(3.0, 4.0)] {
+            let mut h = affine_review_harness(affine_review_image_fixture(matrix, clip, rotation));
+            let view = &h.state().views[0];
+            let id = view.id;
+            let doc = h.state().session.get(id).unwrap();
+            let original = doc.page_images(0)[0].matrix;
+            let before = h.state().session.save_bytes(id).unwrap();
+            let obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(&doc.page_images(0)[0], &view.page_xform(0).unwrap(), &doc.info, 0);
+            let start = obb.handle_pos(pdfcraft_ui_egui::ImageHandle::TopRight) + offset;
+            h.hover_at(start);
+            h.run_steps(1);
+            h.drag_at(start);
+            h.run_steps(1);
+            h.hover_at(start + egui::vec2(30.0, -25.0));
+            h.run_steps(2);
+            h.hover_at(start);
+            h.run_steps(2);
+            h.drop_at(start);
+            h.run_steps(3);
+            let saved = h.state().session.save_bytes(id).unwrap();
+            assert!(saved == before, "out-and-back must not create an edit: matrix={matrix:?} clip={clip:?} rotation={rotation} offset={offset:?}");
+            assert_eq!(h.state().session.get(id).unwrap().can_undo(), None);
+            let mut reopened = pdfcraft_engine::Session::new();
+            let reopened_id = reopened.open("saved.pdf", None, saved, None).unwrap();
+            assert_eq!(reopened.get(reopened_id).unwrap().page_images(0)[0].matrix, original);
+        }
+    }
+}
+
+#[test]
+fn affine_review_resize_uses_press_delta_and_affine_frame() {
+    for (matrix, clip, rotation) in [
+        ([100.0, 0.0, 0.0, 100.0, 100.0, 100.0], None, 0),
+        ([100.0, 0.0, 50.0, 100.0, 100.0, 100.0], None, 0),
+        ([86.60254, 50.0, -50.0, 86.60254, 150.0, 100.0], None, 0),
+        ([100.0, 0.0, 0.0, 100.0, 100.0, 100.0], Some([100.0, 100.0, 150.0, 200.0]), 90),
+    ] {
+        let mut placements = Vec::new();
+        for offset in [egui::Vec2::ZERO, egui::vec2(3.0, 4.0)] {
+            let mut h = affine_review_harness(affine_review_image_fixture(matrix, clip, rotation));
+            let view = &h.state().views[0];
+            let id = view.id;
+            let doc = h.state().session.get(id).unwrap();
+            let xf = view.page_xform(0).unwrap();
+            let obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(&doc.page_images(0)[0], &xf, &doc.info, 0);
+            let grip = obb.handle_pos(pdfcraft_ui_egui::ImageHandle::TopRight);
+            let start = grip + offset;
+            let finish = start + (grip - obb.screen_center) * 0.2;
+            h.hover_at(start);
+            h.run_steps(1);
+            h.drag_at(start);
+            h.run_steps(1);
+            h.hover_at(finish);
+            h.run_steps(2);
+            h.drop_at(finish);
+            h.run_steps(3);
+            let saved = h.state().session.save_bytes(id).unwrap();
+            let mut reopened = pdfcraft_engine::Session::new();
+            let reopened_id = reopened.open("saved.pdf", None, saved, None).unwrap();
+            let after = reopened.get(reopened_id).unwrap().page_images(0)[0].clone();
+            let after_obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(&after, &xf, &reopened.get(reopened_id).unwrap().info, 0);
+            assert!(
+                after_obb.handle_pos(pdfcraft_ui_egui::ImageHandle::BottomLeft).distance(obb.handle_pos(pdfcraft_ui_egui::ImageHandle::BottomLeft))
+                    < 0.1,
+                "opposite affine grip moved: {matrix:?} clip={clip:?} rotation={rotation}"
+            );
+            assert!(
+                after_obb.handle_pos(pdfcraft_ui_egui::ImageHandle::TopRight).distance(grip + (grip - obb.screen_center) * 0.2) < 0.2,
+                "resized affine frame missed the press-relative target: {matrix:?} clip={clip:?} rotation={rotation} offset={offset:?}"
+            );
+            placements.push(after.matrix);
+        }
+        assert!(placements[0].into_iter().zip(placements[1]).all(|(a, b)| (a - b).abs() < 1e-3), "press offset changed placement: {placements:?}");
+    }
+}
+
+#[test]
+fn affine_review_cropped_rotation_preview_matches_saved_corners() {
+    let matrix = [70.710678, 70.710678, -70.710678, 70.710678, 170.710678, 100.0];
+    for (clip, rotation) in [(None, 0), (Some([100.0, 170.0, 241.421356, 241.421356]), 0), (Some([100.0, 170.0, 241.421356, 241.421356]), 90)] {
+        let mut h = affine_review_harness(affine_review_image_fixture(matrix, clip, rotation));
+        let view = &h.state().views[0];
+        let id = view.id;
+        let doc = h.state().session.get(id).unwrap();
+        let image = doc.page_images(0)[0].clone();
+        let xf = view.page_xform(0).unwrap();
+        let obb = pdfcraft_ui_egui::canvas::ImageObb::from_image(&image, &xf, &doc.info, 0);
+        let visible = image.visible_rect.unwrap_or(image.rect);
+        let p = doc.info.pages[0].user_to_view(((visible[0] + visible[2]) * 0.5) as f32, ((visible[1] + visible[3]) * 0.5) as f32);
+        let centre = xf.norm_to_screen(p[0] / xf.pw, p[1] / xf.ph);
+        let start = obb.s_rot;
+        let v = start - centre;
+        let finish = centre + egui::vec2(-v.y, v.x);
+        h.hover_at(start);
+        h.run_steps(1);
+        h.drag_at(start);
+        h.run_steps(1);
+        h.hover_at(finish);
+        h.run_steps(2);
+        assert!(h.state().views[0].image_selection.as_ref().unwrap().turning);
+        let preview = h
+            .output()
+            .shapes
+            .iter()
+            .find_map(|shape| match &shape.shape {
+                egui::Shape::Path(path) if path.closed && path.points.len() == 4 && path.stroke.width == 1.5 => Some(path.points.clone()),
+                _ => None,
+            })
+            .expect("rotation preview outline");
+        if clip.is_some()
+            && rotation == 0
+            && let Ok(directory) = std::env::var("PDFCRAFT_AFFINE_SHOTS")
+        {
+            h.render().unwrap().save(std::path::Path::new(&directory).join("affine-rotation-preview.png")).unwrap();
+        }
+        h.drop_at(finish);
+        h.run_steps(3);
+        if clip.is_some()
+            && rotation == 0
+            && let Ok(directory) = std::env::var("PDFCRAFT_AFFINE_SHOTS")
+        {
+            h.render().unwrap().save(std::path::Path::new(&directory).join("affine-rotation-committed.png")).unwrap();
+        }
+        let saved = h.state().session.save_bytes(id).unwrap();
+        let mut reopened = pdfcraft_engine::Session::new();
+        let reopened_id = reopened.open("saved.pdf", None, saved, None).unwrap();
+        let doc = reopened.get(reopened_id).unwrap();
+        let after = doc.page_images(0)[0].clone();
+        let committed = pdfcraft_ui_egui::canvas::ImageObb::from_matrix(after.matrix, &xf, &doc.info, 0).corners();
+        let (cx, cy) = ((visible[0] + visible[2]) * 0.5, (visible[1] + visible[3]) * 0.5);
+        let expected = pdfcraft_content::Matrix(image.matrix).then(&pdfcraft_content::Matrix([0.0, -1.0, 1.0, 0.0, cx - cy, cy + cx])).0;
+        assert!(
+            after.matrix.into_iter().zip(expected).all(|(a, b)| (a - b).abs() < 1e-3),
+            "knob must commit the requested 90-degree turn around visible bounds"
+        );
+        assert!(
+            preview.iter().zip(committed).all(|(a, b)| a.distance(b) < 1.0),
+            "preview jumped after commit/save: clip={clip:?} rotation={rotation}: {preview:?} != {committed:?}"
+        );
+    }
+}
diff --git a/crates/ui-egui/tests/it/main.rs b/crates/ui-egui/tests/it/main.rs
index a5c3192358..bce7c4d069 100644
--- a/crates/ui-egui/tests/it/main.rs
+++ b/crates/ui-egui/tests/it/main.rs
@@ -57,17 +57,21 @@ mod open_action;
 mod organize_drag;
 mod pageboxes;
 mod panel_snapshots;
+mod paste_ownership;
 mod pdf_links;
 mod pickers;
+mod pinned_tools;
 mod pointer;
 mod preferences_layout;
 mod prepare;
 mod print;
 mod protect;
 mod reading_colors;
+mod recent_files;
 mod recovery;
 mod redact;
 mod reload;
+mod script_noop;
 mod side_panels;
 mod signing;
 mod stamps;
diff --git a/crates/ui-egui/tests/it/paste_ownership.rs b/crates/ui-egui/tests/it/paste_ownership.rs
new file mode 100644
index 0000000000..5dc91e051a
--- /dev/null
+++ b/crates/ui-egui/tests/it/paste_ownership.rs
@@ -0,0 +1,304 @@
+//! Context paste coordinates, insertion identity and visible image ownership.
+use egui::{Key, Modifiers, PointerButton, Pos2};
+use egui_kittest::{
+    Harness,
+    kittest::{NodeT, Queryable},
+};
+use pdfcraft_engine::{AddedContent, AddedImage, Edit};
+use pdfcraft_ui_egui::{Clip, PdfCraftApp};
+
+fn fixture(rotation: u16, cropped: bool, shared: bool) -> Vec<u8> {
+    fixture_at(rotation, cropped, shared, false)
+}
+fn fixture_at(rotation: u16, cropped: bool, shared: bool, collision: bool) -> Vec<u8> {
+    let stream = |body: &str, dict: &str| format!("<< {dict} /Length {} >>\nstream\n{body}\nendstream", body.len());
+    let (media, crop, x, y) = if cropped { ("0 0 600 800", "150 250 450 550", 170, 270) } else { ("0 0 300 300", "0 0 300 300", 20, 20) };
+    let (x, y, w, height) = if collision { (60, 80, 40, 20) } else { (x, y, 30, 30) };
+    let extra = if shared { format!(" q 30 0 0 30 {} {y} cm /RedAgain Do Q", x + 50) } else { String::new() };
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
+        format!(
+            "<< /Type /Page /Parent 2 0 R /MediaBox [{media}] /CropBox [{crop}] /Rotate {rotation} /Resources << /XObject << /Red 5 0 R /RedAgain 5 0 R >> >> /Contents 4 0 R >>"
+        ),
+        stream(&format!("q {w} 0 0 {height} {x} {y} cm /Red Do Q{extra}"), ""),
+        stream("FF0000>", "/Type /XObject /Subtype /Image /Width 1 /Height 1 /ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter /ASCIIHexDecode"),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (index, object) in objects.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", index + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        out.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    out
+}
+
+fn harness(bytes: Vec<u8>) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1000.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.system_clipboard = false;
+        app.open_bytes("ownership.pdf", None, bytes.clone()).unwrap();
+        app.clipboard_override = Some(Clip::Image { width: 40, height: 20, rgba: [0, 0, 255, 255].repeat(800) });
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+fn point(h: &Harness<'static, PdfCraftApp>, user: [f64; 2]) -> Pos2 {
+    let app = h.state();
+    let info = &app.session.get(app.views[0].id).unwrap().info.pages[0];
+    let v = info.user_to_view(user[0] as f32, user[1] as f32);
+    app.views[0].page_xform(0).unwrap().norm_to_screen(v[0] / info.width, v[1] / info.height)
+}
+
+fn right_click(h: &mut Harness<'static, PdfCraftApp>, user: [f64; 2]) {
+    let p = point(h, user);
+    h.hover_at(p);
+    h.run_steps(1);
+    for pressed in [true, false] {
+        h.event(egui::Event::PointerButton { pos: p, button: PointerButton::Secondary, pressed, modifiers: Modifiers::NONE });
+    }
+    h.run_steps(2);
+}
+
+fn reopened(app: &mut PdfCraftApp) -> PdfCraftApp {
+    let id = app.views[0].id;
+    let bytes = app.session.save_bytes(id).unwrap();
+    let mut saved = PdfCraftApp::new();
+    saved.open_bytes("saved.pdf", None, bytes.as_ref().clone()).unwrap();
+    saved
+}
+
+fn check_placement(rotation: u16, cropped: bool, view_rotation: u16, shared: bool, existing_added: bool, collision: bool) {
+    let mut h = harness(fixture_at(rotation, cropped, shared, collision));
+    if existing_added {
+        let mut png = Vec::new();
+        image::RgbImage::from_pixel(40, 40, image::Rgb([0, 0, 255])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        h.state_mut().add_image("existing.png".into(), png);
+        assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().added().len(), 1);
+        h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::Select;
+        h.state_mut().views[0].image_selection = None;
+        h.state_mut().views[0].content.selected = None;
+    }
+    h.state_mut().views[0].rotation = view_rotation;
+    h.run_steps(3);
+    let id = h.state().views[0].id;
+    let originals: Vec<_> = h.state().session.get(id).unwrap().page_images(0).iter().map(|image| image.object.unwrap()).collect();
+    let at = if cropped { [250.0, 400.0] } else { [210.0, 80.0] };
+    right_click(&mut h, at);
+    h.get_by_label_contains("Paste").click();
+    h.run_steps(3);
+    let doc = h.state().session.get(id).unwrap();
+    let inserted = doc
+        .added()
+        .iter()
+        .find_map(|item| match &item.content {
+            AddedContent::Image(image) if !originals.contains(&image.image) => Some(image.image),
+            _ => None,
+        })
+        .expect("a new image XObject was inserted");
+    assert!(!originals.contains(&inserted), "embedding must allocate a fresh image identity");
+    let selected = &doc.page_images(0)[h.state().views[0].image_selection.as_ref().unwrap().index];
+    assert_eq!(selected.object, Some(inserted), "the visible selection must name the inserted XObject");
+    let center = [(selected.rect[0] + selected.rect[2]) * 0.5, (selected.rect[1] + selected.rect[3]) * 0.5];
+    assert!((center[0] - at[0]).abs() < 0.001 && (center[1] - at[1]).abs() < 0.001, "rotation={rotation}, crop={cropped}: {center:?} vs {at:?}");
+    let saved = reopened(h.state_mut());
+    let placed = saved.session.get(saved.views[0].id).unwrap().page_images(0).into_iter().find(|image| image.object == Some(inserted)).unwrap();
+    assert!(((placed.rect[0] + placed.rect[2]) * 0.5 - at[0]).abs() < 0.001);
+    assert!(((placed.rect[1] + placed.rect[3]) * 0.5 - at[1]).abs() < 0.001);
+    h.key_press(Key::Delete);
+    h.run_steps(3);
+    let saved = reopened(h.state_mut());
+    let doc = saved.session.get(saved.views[0].id).unwrap();
+    assert_eq!(doc.added().len(), usize::from(existing_added));
+    let remaining = doc.page_images(0);
+    assert_eq!(remaining.len(), originals.len());
+    assert!(remaining.iter().any(|image| image.name == "Red"));
+    if shared {
+        assert!(remaining.iter().any(|image| image.name == "RedAgain"));
+    }
+}
+
+#[test]
+fn context_paste_ordinary_page_control() {
+    check_placement(0, false, 0, false, false, false);
+}
+#[test]
+fn context_paste_rotate90_places_and_selects_inserted_image() {
+    check_placement(90, false, 0, false, false, false);
+}
+#[test]
+fn context_paste_rotate180_places_and_selects_inserted_image() {
+    check_placement(180, false, 0, false, false, false);
+}
+#[test]
+fn context_paste_rotate270_places_and_selects_inserted_image() {
+    check_placement(270, false, 0, false, false, false);
+}
+#[test]
+fn context_paste_crop_offset_places_and_selects_inserted_image() {
+    check_placement(0, true, 0, false, false, false);
+}
+#[test]
+fn context_paste_rotated_crop_places_and_selects_inserted_image() {
+    check_placement(90, true, 0, false, false, false);
+}
+#[test]
+fn context_paste_view_rotation_control() {
+    check_placement(0, false, 90, false, false, false);
+}
+#[test]
+fn context_paste_shared_original_xobject_control() {
+    check_placement(90, false, 0, true, false, false);
+}
+
+#[test]
+fn context_paste_with_existing_added_image_control() {
+    check_placement(90, false, 0, false, true, false);
+}
+
+#[test]
+fn context_paste_identity_ignores_original_at_display_rectangle() {
+    check_placement(90, false, 0, false, false, true);
+}
+
+fn check_delete_owner(original: bool, shared_added: bool) {
+    let mut h = harness(fixture(0, false, false));
+    let id = h.state().views[0].id;
+    if shared_added {
+        let object = h.state().session.get(id).unwrap().page_images(0)[0].object.unwrap();
+        let (extension, bytes) = h.state().session.get(id).unwrap().page_image_copy_file(0, 0).unwrap();
+        assert!(h.state_mut().apply_edit(Edit::PasteContent {
+            page: 0,
+            content: AddedContent::Image(AddedImage::new([130.0, 130.0, 170.0, 170.0], object)),
+            file: Some((format!("shared.{extension}"), std::sync::Arc::new(bytes)))
+        }));
+        assert_eq!(h.state().session.get(id).unwrap().page_images(0).len(), 2);
+        assert!(h.state().session.get(id).unwrap().page_images(0).iter().all(|image| image.object == Some(object)));
+        h.state_mut().execute("edit.edit_text");
+        h.state_mut().views[0].content.selected = Some((0, 0));
+    } else {
+        let mut png = Vec::new();
+        image::RgbImage::from_pixel(40, 40, image::Rgb([0, 0, 255])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+        h.state_mut().add_image("blue.png".into(), png);
+    }
+    h.run_steps(3);
+    let p = point(&h, [150.0, 150.0]);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(2);
+    // The legacy editor can retain the added-image selection while its frame is hidden.
+    h.state_mut().views[0].content.selected = Some((0, 0));
+    let target = if original { [35.0, 35.0] } else { [150.0, 150.0] };
+    right_click(&mut h, target);
+    h.get_by_label("Copy Image").click();
+    h.run_steps(2);
+    let selection = h.state().views[0].image_selection.as_ref().unwrap();
+    let selected = &h.state().session.get(id).unwrap().page_images(0)[selection.index];
+    assert_eq!(selected.name == "Red", original, "the frame belongs to the requested occurrence");
+    h.key_press(Key::Delete);
+    h.run_steps(3);
+    let saved = reopened(h.state_mut());
+    let doc = saved.session.get(saved.views[0].id).unwrap();
+    assert_eq!(doc.page_images(0).len(), 1);
+    assert_eq!(doc.page_images(0).iter().any(|image| image.name == "Red"), !original, "Delete must remove the visibly selected occurrence");
+    assert_eq!(doc.added().len(), usize::from(original), "the other item must survive save/reopen");
+}
+
+#[test]
+fn original_image_selection_owns_delete_over_hidden_added_image() {
+    check_delete_owner(true, false);
+}
+#[test]
+fn added_image_selection_delete_control() {
+    check_delete_owner(false, false);
+}
+#[test]
+fn shared_xobject_original_occurrence_owns_delete() {
+    check_delete_owner(true, true);
+}
+
+#[test]
+fn whole_page_actions_do_not_require_a_selection() {
+    let mut h = harness(fixture(0, false, false));
+    right_click(&mut h, [210.0, 80.0]);
+    assert!(h.get_by_label_contains("Copy").accesskit_node().is_disabled());
+    assert!(!h.get_by_label("Take a snapshot").accesskit_node().is_disabled());
+    assert!(!h.get_by_label("Export this PDF").accesskit_node().is_disabled());
+}
+
+#[test]
+fn whole_page_actions_still_require_copy_permission() {
+    let mut app = PdfCraftApp::new();
+    app.open_bytes("source.pdf", None, fixture(0, false, false)).unwrap();
+    assert!(app.apply_edit(Edit::Protect(pdfcraft_engine::Protection { permissions_password: Some("owner".into()), ..Default::default() })));
+    let bytes = app.session.save_bytes(app.views[0].id).unwrap();
+    let mut h = harness(bytes.as_ref().clone());
+    right_click(&mut h, [210.0, 80.0]);
+    assert!(h.get_by_label("Take a snapshot").accesskit_node().is_disabled());
+    assert!(h.get_by_label("Export this PDF").accesskit_node().is_disabled());
+}
+
+#[test]
+fn legacy_text_delete_survives_switching_out_of_the_image_tool() {
+    let mut h = harness(fixture(0, false, false));
+    h.state_mut().execute("edit.edit_text");
+    right_click(&mut h, [35.0, 35.0]);
+    h.get_by_label("Copy Image").click();
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some());
+    assert!(h.state_mut().apply_edit(Edit::AddText {
+        page: 0,
+        text: pdfcraft_engine::AddedText { text: "note".into(), rect: [100.0, 100.0, 180.0, 130.0], ..Default::default() }
+    }));
+    assert_eq!(h.state().session.get(h.state().views[0].id).unwrap().added().len(), 1);
+    h.state_mut().views[0].content.selected = Some((0, 0));
+    h.state_mut().quick_tool = pdfcraft_ui_egui::QuickTool::Select;
+    h.key_press(Key::Delete);
+    h.run_steps(3);
+    let saved = reopened(h.state_mut());
+    let doc = saved.session.get(saved.views[0].id).unwrap();
+    assert!(doc.added().is_empty());
+    assert_eq!(doc.page_images(0).len(), 1);
+}
+
+#[test]
+fn leaving_image_controller_cannot_leave_hidden_image_owning_delete() {
+    let mut h = harness(fixture(0, false, false));
+    let mut png = Vec::new();
+    image::RgbImage::from_pixel(40, 40, image::Rgb([0, 0, 255])).write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    h.state_mut().add_image("blue.png".into(), png);
+    h.run_steps(3);
+    // Start from no selection, then let the controller select the added image itself.
+    h.state_mut().views[0].image_selection = None;
+    h.state_mut().views[0].content.selected = None;
+    let p = point(&h, [150.0, 150.0]);
+    h.hover_at(p);
+    h.run_steps(1);
+    h.drag_at(p);
+    h.run_steps(1);
+    h.drop_at(p);
+    h.run_steps(2);
+    assert!(h.state().views[0].image_selection.is_some());
+    h.key_press(Key::V);
+    h.run_steps(2);
+    assert_eq!(h.state().quick_tool, pdfcraft_ui_egui::QuickTool::Select);
+    assert!(h.state().views[0].image_selection.is_none());
+    h.key_press(Key::Delete);
+    h.run_steps(3);
+    let saved = reopened(h.state_mut());
+    let doc = saved.session.get(saved.views[0].id).unwrap();
+    assert_eq!(doc.page_images(0).len(), 2, "there is no visible image selection to delete");
+    assert_eq!(doc.added().len(), 1);
+}
diff --git a/crates/ui-egui/tests/it/pinned_tools.rs b/crates/ui-egui/tests/it/pinned_tools.rs
new file mode 100644
index 0000000000..55c84bc528
--- /dev/null
+++ b/crates/ui-egui/tests/it/pinned_tools.rs
@@ -0,0 +1,163 @@
+//! Pinned tools on Home: pin tools, unpin tools, persistence across sessions,
+//! selection modal, and the sidebar pin toggle.
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::{Dialog, LeftPanel, PdfCraftApp};
+
+fn harness(setup: impl FnOnce(&mut PdfCraftApp) + 'static) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1000.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.run_inline = true;
+        setup(&mut app);
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+#[test]
+fn state_operations_and_validation() {
+    let mut app = PdfCraftApp::new();
+    assert!(!app.is_tool_pinned("redact"));
+
+    // Pinning a valid tool
+    assert!(app.pin_tool("redact"));
+    assert!(app.is_tool_pinned("redact"));
+    assert_eq!(app.pinned_tools, vec!["redact"]);
+
+    // Pinning already pinned tool returns false (no duplicates)
+    assert!(!app.pin_tool("redact"));
+    assert_eq!(app.pinned_tools, vec!["redact"]);
+
+    // Pinning an invalid tool returns false
+    assert!(!app.pin_tool("invalid_tool_unknown_id"));
+    assert_eq!(app.pinned_tools, vec!["redact"]);
+
+    // Pinning a second valid tool
+    assert!(app.pin_tool("form"));
+    assert_eq!(app.pinned_tools, vec!["redact", "form"]);
+
+    // Unpinning
+    app.unpin_tool("redact");
+    assert!(!app.is_tool_pinned("redact"));
+    assert!(app.is_tool_pinned("form"));
+    assert_eq!(app.pinned_tools, vec!["form"]);
+
+    // Unpinning non-existent tool does nothing
+    app.unpin_tool("nonexistent");
+    assert_eq!(app.pinned_tools, vec!["form"]);
+
+    // Toggling
+    assert!(!app.toggle_pin_tool("form")); // unpins
+    assert!(!app.is_tool_pinned("form"));
+    assert!(app.pinned_tools.is_empty());
+
+    assert!(app.toggle_pin_tool("form")); // pins
+    assert!(app.is_tool_pinned("form"));
+    assert_eq!(app.pinned_tools, vec!["form"]);
+}
+
+#[test]
+fn persistence_round_trip_and_sanitization() {
+    let mut app = PdfCraftApp::new();
+    app.pin_tool("protect");
+    app.pin_tool("redact");
+
+    let saved = app.persist();
+    assert!(saved.contains("\"pinned_tools\""));
+
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&saved);
+    assert_eq!(restored.pinned_tools, vec!["protect", "redact"]);
+
+    // Test sanitization: unknown tools are discarded and duplicates are removed, preserving order
+    let malicious_or_corrupt = serde_json::json!({
+        "pinned_tools": ["redact", "nonexistent_junk", "redact", "edit", "another_unknown", "protect"]
+    })
+    .to_string();
+    restored.restore(&malicious_or_corrupt);
+    assert_eq!(restored.pinned_tools, vec!["redact", "edit", "protect"]);
+}
+
+#[test]
+fn home_shows_pinned_tools_section_and_placeholder() {
+    let mut h = harness(|_| {});
+    // When no tools are pinned, the placeholder message appears
+    h.get_by_label_contains("Pinned Tools");
+    h.get_by_label_contains("Pin your favorite tools here for quick access.");
+    h.get_by_label("Pin a tool…");
+
+    // Pin a tool and step forward
+    h.state_mut().pin_tool("redact");
+    h.run_steps(3);
+
+    // Placeholder is gone and Redact card is shown
+    assert!(h.query_by_label_contains("Pin your favorite tools here for quick access.").is_none());
+    assert!(h.query_all_by_label("Redact a PDF").count() >= 1);
+
+    // Unpin tool and verify placeholder returns
+    h.state_mut().unpin_tool("redact");
+    h.run_steps(3);
+    h.get_by_label_contains("Pin your favorite tools here for quick access.");
+}
+
+#[test]
+fn clicking_pinned_tool_card_selects_it() {
+    let mut h = harness(|app| {
+        app.pin_tool("redact");
+    });
+    h.run_steps(2);
+
+    // The Redact card is rendered and can be clicked to select the tool
+    let nodes: Vec<_> = h.query_all_by_label("Redact a PDF").collect();
+    assert!(!nodes.is_empty());
+    // Click the card
+    nodes.last().unwrap().click();
+    h.run_steps(3);
+
+    // Redact tool panel is now active
+    assert_eq!(h.state().left, LeftPanel::Tool("redact"));
+}
+
+#[test]
+fn pin_tool_dialog_workflow() {
+    let mut h = harness(|app| {
+        app.dialog = Some(Dialog::PinTool);
+    });
+    h.run_steps(3);
+
+    // Modal is open
+    h.get_by_label_contains("Pin tools to Home");
+    h.get_by_label("Done");
+
+    // Pin a tool from inside the dialog
+    assert!(!h.state().is_tool_pinned("scan"));
+    h.state_mut().toggle_pin_tool("scan");
+    assert!(h.state().is_tool_pinned("scan"));
+    h.run_steps(2);
+
+    // Close dialog with "Done"
+    h.get_by_label("Done").click();
+    h.run_steps(2);
+    assert!(h.state().dialog.is_none());
+}
+
+#[test]
+fn sidebar_pin_toggle_unpins_and_pins() {
+    let mut h = harness(|app| {
+        app.pin_tool("redact");
+    });
+    h.run_steps(2);
+    assert!(h.state().is_tool_pinned("redact"));
+
+    // Since redact is pinned, the pin toggle is rendered in the sidebar with "Unpin from Home"
+    let unpin_btn = h.get_by_label("Unpin from Home");
+    unpin_btn.click();
+    h.run_steps(3);
+
+    assert!(!h.state().is_tool_pinned("redact"));
+    // Left panel did not navigate away (still AllTools)
+    assert_eq!(h.state().left, LeftPanel::AllTools);
+}
diff --git a/crates/ui-egui/tests/it/recent_files.rs b/crates/ui-egui/tests/it/recent_files.rs
new file mode 100644
index 0000000000..b4eccfb10e
--- /dev/null
+++ b/crates/ui-egui/tests/it/recent_files.rs
@@ -0,0 +1,257 @@
+//! Preferences ▸ Recent files to keep (#5572): how many files the recent list holds, from none
+//! up to 50, on every path that adds to it, shows it or saves it.
+
+use egui::Key;
+use egui::accesskit::Role;
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::{Dialog, PdfCraftApp, RECENT_FILES_DEFAULT, RecentFile};
+
+use crate::support;
+
+const PDF: &[u8] = include_bytes!("../data/form.pdf");
+
+fn recent_file(name: &str) -> RecentFile {
+    RecentFile { name: name.into(), path: format!("/nowhere/{name}"), pages: 1, size: 0 }
+}
+
+fn names(app: &PdfCraftApp) -> Vec<&str> {
+    app.recent.iter().map(|r| r.name.as_str()).collect()
+}
+
+fn app_with(files: &[&str]) -> PdfCraftApp {
+    let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
+    app.recent.extend(files.iter().map(|n| recent_file(n)));
+    app
+}
+
+/// Tall enough that the whole of Home is on screen without scrolling.
+fn harness(limit: usize, files: &[&str]) -> Harness<'static, PdfCraftApp> {
+    let files: Vec<String> = files.iter().map(ToString::to_string).collect();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1600.0)).build_eframe(move |_cc| {
+        let mut app = app_with(&files.iter().map(String::as_str).collect::<Vec<_>>());
+        app.recent_limit = limit;
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+/// Open a document with a file behind it, as a file on disk is recorded.
+fn open(app: &mut PdfCraftApp, name: &str) {
+    app.open_bytes(name, Some(format!("/nowhere/{name}")), PDF.to_vec()).unwrap();
+}
+
+/// Typed the way a person does: click the field, type, Enter.
+fn type_limit(h: &mut Harness<'static, PdfCraftApp>, value: &str) {
+    h.get_by_role_and_label(Role::SpinButton, "Recent files to keep").click();
+    h.run_steps(2);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, Key::A);
+    h.run_steps(1);
+    h.event(egui::Event::Text(value.into()));
+    h.run_steps(1);
+    h.key_press(Key::Enter);
+    h.run_steps(3);
+}
+
+#[test]
+fn the_list_keeps_twelve_files_until_preferences_says_otherwise() {
+    let mut app = app_with(&[]);
+    assert_eq!(app.recent_limit, 12);
+    for n in 0..=RECENT_FILES_DEFAULT {
+        open(&mut app, &format!("{n}.pdf"));
+    }
+    assert_eq!(app.recent.len(), 12);
+    assert_eq!(app.recent[0].name, "12.pdf", "newest first");
+    assert_eq!(app.recent[11].name, "1.pdf", "the oldest of the thirteen went");
+}
+
+#[test]
+fn opening_a_file_keeps_the_newest_up_to_the_limit() {
+    let mut app = app_with(&[]);
+    app.recent_limit = 2;
+    for name in ["first.pdf", "second.pdf", "third.pdf"] {
+        open(&mut app, name);
+    }
+    assert_eq!(names(&app), ["third.pdf", "second.pdf"]);
+    open(&mut app, "second.pdf");
+    assert_eq!(names(&app), ["second.pdf", "third.pdf"], "a file opened again moves up and loses nothing");
+}
+
+#[test]
+fn at_zero_opening_a_file_records_nothing() {
+    let mut app = app_with(&[]);
+    app.recent_limit = 0;
+    open(&mut app, "first.pdf");
+    assert!(app.recent.is_empty());
+    let saved: serde_json::Value = serde_json::from_str(&app.persist()).unwrap();
+    assert_eq!(saved["recent"], serde_json::json!([]), "and the saved list is empty");
+}
+
+#[test]
+fn at_zero_home_has_no_recent_section() {
+    let h = harness(0, &[]);
+    assert!(h.query_by_label("Recent").is_none(), "no heading");
+    assert!(h.query_by_label_contains("Files you open in PdfCraft appear here").is_none(), "and no promise of a list");
+    h.get_by_label_contains("PdfCraft works offline");
+}
+
+#[test]
+fn above_zero_an_empty_list_still_says_what_it_is_for() {
+    let h = harness(1, &[]);
+    h.get_by_label("Recent");
+    h.get_by_label_contains("Files you open in PdfCraft appear here");
+}
+
+#[test]
+fn at_zero_the_menu_and_the_palette_have_nothing_to_open() {
+    let mut h = harness(0, &[]);
+    support::open_menu(&mut h, "File");
+    assert!(h.query_by(|n| n.label().as_deref() == Some("Open Recent") && n.is_disabled()).is_some(), "Open Recent is disabled");
+    assert!(h.state_mut().execute("file.open_recent"));
+    assert!(h.state().toast.as_ref().is_some_and(|(m, _)| m.contains("No recent files")));
+    assert!(h.state().views.is_empty(), "and nothing opened");
+}
+
+#[test]
+fn the_longest_list_scrolls_in_the_smallest_window_down_to_clear() {
+    let files: Vec<String> = (0..50).map(|n| format!("{n}.pdf")).collect();
+    let mut h = Harness::builder().with_size(egui::vec2(1000.0, 520.0)).build_eframe({
+        let files = files.clone();
+        move |_cc| {
+            let mut app = app_with(&files.iter().map(String::as_str).collect::<Vec<_>>());
+            app.recent_limit = 50;
+            app.open_bytes("doc.pdf", None, PDF.to_vec()).unwrap();
+            app
+        }
+    });
+    h.run_steps(4);
+    support::open_menu(&mut h, "File");
+    support::menu_row(&h, "Open Recent").hover();
+    h.run_steps(3);
+    let foot = |h: &Harness<'static, PdfCraftApp>| support::menu_row(h, "Clear Recent Files").rect().max.y;
+    assert!(foot(&h) > 520.0, "fifty rows run past the smallest window");
+    support::menu_row(&h, "1.pdf").hover();
+    h.run_steps(2);
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: egui::vec2(0.0, -5000.0),
+        phase: egui::TouchPhase::Move,
+        modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
+    });
+    h.run_steps(8);
+    assert!(foot(&h) <= 520.0, "the wheel brings the foot of the menu into view");
+    support::menu_row(&h, "Clear Recent Files").click();
+    h.run_steps(3);
+    assert!(h.state().recent.is_empty());
+}
+
+#[test]
+fn preferences_cuts_the_list_when_it_closes_and_not_before() {
+    let mut h = harness(12, &["first.pdf", "second.pdf", "third.pdf"]);
+    h.state_mut().dialog = Some(Dialog::Preferences);
+    h.run_steps(4);
+    type_limit(&mut h, "0");
+    assert_eq!(h.state().recent_limit, 0);
+    assert_eq!(h.state().recent.len(), 3, "0 on the way to another number forgets nothing");
+    assert!(h.query_by_label("first.pdf").is_none(), "though Home already leaves them out");
+    type_limit(&mut h, "2");
+    assert_eq!(h.state().recent.len(), 3);
+    h.get_by_label("OK").click();
+    h.run_steps(4);
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(names(h.state()), ["first.pdf", "second.pdf"], "the newest two stay");
+}
+
+#[test]
+fn escape_closes_preferences_with_the_same_result_as_ok() {
+    let mut h = harness(12, &["first.pdf", "second.pdf"]);
+    h.state_mut().dialog = Some(Dialog::Preferences);
+    h.run_steps(4);
+    type_limit(&mut h, "1");
+    h.key_press(Key::Escape);
+    h.run_steps(4);
+    assert_eq!(h.state().dialog, None);
+    assert_eq!(names(h.state()), ["first.pdf"]);
+}
+
+#[test]
+fn the_field_does_not_go_past_fifty() {
+    let mut h = harness(12, &[]);
+    h.state_mut().dialog = Some(Dialog::Preferences);
+    h.run_steps(4);
+    type_limit(&mut h, "999");
+    assert_eq!(h.state().recent_limit, 50);
+}
+
+#[test]
+fn settings_saved_while_preferences_is_open_already_leave_the_rest_out() {
+    let mut app = app_with(&["first.pdf", "second.pdf"]);
+    app.recent_limit = 1;
+    let saved = app.persist();
+    assert!(saved.contains("first.pdf"));
+    assert!(!saved.contains("second.pdf"));
+}
+
+#[test]
+fn the_limit_is_saved_and_restored_and_cuts_a_longer_list() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-recent-limit-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let paths: Vec<String> = ["a.pdf", "b.pdf", "c.pdf"]
+        .iter()
+        .map(|n| {
+            let path = dir.join(n);
+            std::fs::write(&path, PDF).unwrap();
+            path.to_string_lossy().into_owned()
+        })
+        .collect();
+    let entries: Vec<RecentFile> = paths.iter().map(|p| RecentFile { name: "x.pdf".into(), path: p.clone(), pages: 1, size: 0 }).collect();
+    let json = serde_json::json!({ "recent": entries, "recent_limit": 2 }).to_string();
+    let mut restored = PdfCraftApp::new();
+    restored.restore(&json);
+    assert_eq!(restored.recent_limit, 2);
+    let kept: Vec<&str> = restored.recent.iter().map(|r| r.path.as_str()).collect();
+    assert_eq!(kept, [paths[0].as_str(), paths[1].as_str()]);
+    let mut again = PdfCraftApp::new();
+    again.restore(&restored.persist());
+    assert_eq!(again.recent_limit, 2);
+    assert_eq!(again.recent.len(), 2);
+    std::fs::remove_dir_all(&dir).unwrap();
+}
+
+#[test]
+fn a_settings_file_can_not_ask_for_a_limit_that_is_not_one() {
+    for (saved, want) in [
+        ("{}", 12),
+        ("{\"recent_limit\": null}", 12),
+        ("{\"recent_limit\": \"3\"}", 12),
+        ("{\"recent_limit\": -1}", 12),
+        ("{\"recent_limit\": 2.5}", 12),
+        ("{\"recent_limit\": 0}", 0),
+        ("{\"recent_limit\": 50}", 50),
+        ("{\"recent_limit\": 51}", 50),
+        ("{\"recent_limit\": 18446744073709551615}", 50),
+    ] {
+        let mut app = PdfCraftApp::new();
+        app.restore(saved);
+        assert_eq!(app.recent_limit, want, "{saved}");
+    }
+}
+
+#[test]
+fn the_control_channel_sets_the_limit_and_refuses_what_it_can_not_be() {
+    let mut app = app_with(&["first.pdf", "second.pdf"]);
+    for bad in ["51", "-1", "x", "", "1.5"] {
+        let error = app.set_option("recent-files", bad).unwrap_err();
+        assert!(error.contains("between 0 and 50"), "{bad}: {error}");
+    }
+    assert_eq!((app.recent_limit, app.recent.len()), (12, 2), "a refused value changes nothing");
+    app.set_option("recent-files", "50").unwrap();
+    assert_eq!((app.recent_limit, app.recent.len()), (50, 2));
+    app.set_option("recent-files", "1").unwrap();
+    assert_eq!(names(&app), ["first.pdf"], "cut at once, with no dialog to wait for");
+    app.set_option("recent-files", "0").unwrap();
+    assert!(app.recent.is_empty());
+}
diff --git a/crates/ui-egui/tests/it/script_noop.rs b/crates/ui-egui/tests/it/script_noop.rs
new file mode 100644
index 0000000000..ba113e2a4c
--- /dev/null
+++ b/crates/ui-egui/tests/it/script_noop.rs
@@ -0,0 +1,80 @@
+//! A script button with no convertible characters must not rewrite hidden source text.
+use egui_kittest::{Harness, kittest::Queryable};
+use pdfcraft_render::{PageRenderer, RenderRequest};
+use pdfcraft_ui_egui::PdfCraftApp;
+use std::sync::Arc;
+
+fn hidden_text() -> Vec<u8> {
+    let body = "BT /F1 24 Tf 3 Tr 40 150 Td (QQQ) Tj ET";
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R >>".to_owned(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_owned(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Resources << /Font << /F1 4 0 R >> >> /Contents 5 0 R >>".to_owned(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_owned(),
+        format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()),
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(b"xref\n0 6\n0000000000 65535 f \n");
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n").as_bytes());
+    bytes
+}
+
+fn pixels(bytes: Arc<Vec<u8>>) -> Vec<u8> {
+    let mut renderer = PageRenderer::new(bytes, Default::default());
+    let rendered = renderer.render(RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    assert!(rendered.error.is_none(), "{:?}", rendered.error);
+    rendered.rgba.to_vec()
+}
+
+#[test]
+fn unsupported_script_buttons_leave_hidden_text_bytes_history_and_saved_pixels_unchanged() {
+    for button in ["Superscript", "Subscript"] {
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("hidden.pdf", None, hidden_text()).unwrap();
+            app
+        });
+        h.run_steps(4);
+        assert!(h.state_mut().execute("edit.edit_text"));
+        h.run_steps(3);
+        let id = h.state().views[0].id;
+        let block = h.state().session.get(id).unwrap().text_blocks(0).remove(0);
+        assert_eq!(block.text, "QQQ");
+        let page = h.state().views[0].page_screen_rect(0).unwrap();
+        let x = (block.rect[0] + block.rect[2]) as f32 / 2.0;
+        let y = (block.rect[1] + block.rect[3]) as f32 / 2.0;
+        let at = egui::pos2(page.left() + x / 300.0 * page.width(), page.top() + (300.0 - y) / 300.0 * page.height());
+        h.hover_at(at);
+        h.run_steps(1);
+        h.drag_at(at);
+        h.run_steps(1);
+        h.drop_at(at);
+        h.run_steps(3);
+        let editor = h.state_mut().views[0].line_editor.as_mut().expect("hidden text editor opens");
+        editor.selection = Some(1..2);
+        editor.focus = true;
+        h.run_steps(1);
+        let before = h.state().session.get(id).unwrap().bytes.clone();
+        assert!(h.state().session.get(id).unwrap().can_undo().is_none());
+        h.get_by_label(button).click();
+        h.run_steps(4);
+        let saved = h.state_mut().session.save_bytes(id).unwrap();
+        assert_eq!(pixels(saved.clone()), pixels(before.clone()), "{button} must preserve hidden text after saving");
+        let doc = h.state().session.get(id).unwrap();
+        assert_eq!(doc.bytes.as_ref(), before.as_ref(), "no conversion must leave source bytes untouched");
+        assert!(doc.can_undo().is_none(), "no conversion must not create an edit");
+        let mut reopened = PdfCraftApp::new();
+        reopened.open_bytes("reopened.pdf", None, saved.as_ref().clone()).unwrap();
+        assert_eq!(reopened.session.get(reopened.views[0].id).unwrap().text_blocks(0)[0].text, "QQQ");
+    }
+}
diff --git a/crates/ui-egui/tests/page_shadows.rs b/crates/ui-egui/tests/page_shadows.rs
new file mode 100644
index 0000000000..a83fa6ce05
--- /dev/null
+++ b/crates/ui-egui/tests/page_shadows.rs
@@ -0,0 +1,353 @@
+//! Decorative page shadows are app preferences, never PDF edits.
+
+use egui_kittest::{Harness, kittest::Queryable};
+use pdfcraft_ui_egui::PdfCraftApp;
+
+#[test]
+fn viewer_shadows_follow_the_preference_without_moving_pages() {
+    for theme in ["light", "dark"] {
+        for layout in ["single", "two-page", "continuous", "two-up"] {
+            let mut h = harness(theme);
+            h.state_mut().set_option("layout", layout).unwrap();
+            h.run_steps(3);
+            let rectangles = h.state().views[0].visible_page_rects().to_vec();
+            let original = shadows(&h, false);
+            assert!(!original.is_empty(), "{theme} {layout}");
+            h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+            h.run_steps(2);
+            assert!(shadows(&h, false).is_empty(), "{theme} {layout}");
+            assert_eq!(h.state().views[0].visible_page_rects(), rectangles);
+            h.state_mut().set_option("zoom", "125").unwrap();
+            h.state_mut().set_option("page", "2").unwrap();
+            h.run_steps(3);
+            assert!(shadows(&h, false).is_empty());
+            h.state_mut().set_option("show_page_edge_shadows", "true").unwrap();
+            h.run_steps(2);
+            assert!(!shadows(&h, false).is_empty());
+        }
+    }
+}
+
+#[test]
+fn viewport_fades_follow_the_preference_and_keep_other_scroll_areas_styled() {
+    for theme in ["light", "dark"] {
+        for organize in [false, true] {
+            let mut h = harness(theme);
+            if organize {
+                h.state_mut().set_option("organize", "on").unwrap();
+                // Make the three-page grid overflow vertically.
+                h.state_mut().set_option("grid-zoom", "300").unwrap();
+            }
+            h.run_steps(4);
+            let original_style = h.ctx.global_style().spacing.scroll.fade;
+            assert!(original_style.strength > 0.0);
+            assert!(!viewport_fades(&h).is_empty(), "bottom fade at start: {theme}, organize={organize}");
+            scroll_down(&mut h, 100.0);
+            let original = viewport_fades(&h);
+            let viewport = h.state().views[0].viewport_rect();
+            assert!(original.iter().any(|r| (r.top() - viewport.top()).abs() < 2.0), "top fade: {original:?}");
+            assert!(original.iter().any(|r| (r.bottom() - viewport.bottom()).abs() < 2.0), "bottom fade: {original:?}");
+            let pages = h.state().views[0].visible_page_rects().to_vec();
+            h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+            h.run_steps(2);
+            assert!(viewport_fades(&h).is_empty(), "viewport fades remain: {theme}, organize={organize}");
+            assert_eq!(h.state().views[0].visible_page_rects(), pages);
+            assert_eq!(h.ctx.global_style().spacing.scroll.fade, original_style);
+            h.state_mut().set_option("show_page_edge_shadows", "true").unwrap();
+            h.run_steps(2);
+            assert_eq!(viewport_fades(&h), original);
+            scroll_down(&mut h, 100_000.0);
+            let at_end = viewport_fades(&h);
+            assert!(at_end.iter().any(|r| (r.top() - viewport.top()).abs() < 2.0));
+            assert!(!at_end.iter().any(|r| (r.bottom() - viewport.bottom()).abs() < 2.0), "no bottom fade at the end");
+        }
+    }
+}
+
+#[test]
+fn horizontal_viewport_fades_also_follow_the_preference() {
+    let mut h = harness("dark");
+    h.state_mut().set_option("zoom", "400").unwrap();
+    h.run_steps(4);
+    let viewport = h.state().views[0].viewport_rect();
+    let horizontal: Vec<_> = viewport_fades(&h).into_iter().filter(|r| r.width() <= 21.0).collect();
+    assert!(horizontal.iter().any(|r| (r.left() - viewport.left()).abs() < 2.0), "left fade: {horizontal:?}");
+    assert!(horizontal.iter().any(|r| (r.right() - viewport.right()).abs() < 2.0), "right fade: {horizontal:?}");
+    let pages = h.state().views[0].visible_page_rects().to_vec();
+    h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+    h.run_steps(2);
+    assert!(viewport_fades(&h).is_empty());
+    assert_eq!(h.state().views[0].visible_page_rects(), pages);
+}
+
+fn scroll_down(h: &mut Harness<'static, PdfCraftApp>, points: f32) {
+    h.hover_at(h.state().views[0].viewport_rect().center());
+    h.run_steps(1);
+    h.event(egui::Event::MouseWheel {
+        unit: egui::MouseWheelUnit::Point,
+        delta: egui::vec2(0.0, -points),
+        phase: egui::TouchPhase::Move,
+        modifiers: egui::Modifiers::NONE,
+        source: egui::MouseWheelSource::Unknown,
+    });
+    h.run_steps(12);
+}
+
+/// Inspect the actual egui painter output: untextured four-vertex gradients
+/// with a transparent edge, spanning one dimension of the document viewport.
+fn viewport_fades(h: &Harness<'static, PdfCraftApp>) -> Vec<egui::Rect> {
+    let viewport = h.state().views[0].viewport_rect();
+    h.output()
+        .shapes
+        .iter()
+        .filter_map(|s| {
+            let egui::Shape::Mesh(mesh) = &s.shape else { return None };
+            if mesh.texture_id != egui::TextureId::default() || mesh.vertices.len() != 4 || mesh.indices.len() != 6 {
+                return None;
+            }
+            let rect = mesh.calc_bounds();
+            let transparent = mesh.vertices.iter().filter(|v| v.color == egui::Color32::TRANSPARENT).count();
+            (transparent == 2
+                && (((rect.width() - viewport.width()).abs() < 2.0 && rect.height() <= 21.0)
+                    || ((rect.height() - viewport.height()).abs() < 2.0 && rect.width() <= 21.0))
+                && rect.intersects(viewport))
+            .then_some(rect)
+        })
+        .collect()
+}
+
+#[test]
+fn organize_shadows_follow_the_preference() {
+    for theme in ["light", "dark"] {
+        let mut h = harness(theme);
+        h.state_mut().set_option("organize", "on").unwrap();
+        h.run_steps(3);
+        let original = shadows(&h, true);
+        assert_eq!(original.len(), 3);
+        h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+        h.run_steps(2);
+        assert!(shadows(&h, true).is_empty());
+        h.state_mut().set_option("show_page_edge_shadows", "true").unwrap();
+        h.run_steps(2);
+        assert_eq!(shadows(&h, true), original);
+    }
+}
+
+#[test]
+fn checkbox_and_multiple_documents_do_not_edit_pdf_state() {
+    let mut h = harness("light");
+    h.state_mut().open_bytes("second.pdf", None, pdf()).unwrap();
+    let ids: Vec<_> = h.state().views.iter().map(|v| v.id).collect();
+    h.state_mut().session.apply(ids[0], pdfcraft_engine::Edit::SetInfo { key: "Title".into(), value: "Keep existing edits".into() }).unwrap();
+    assert!(h.state().session.get(ids[0]).unwrap().dirty);
+    assert!(h.state().session.get(ids[0]).unwrap().can_undo().is_some());
+    let saved: Vec<_> = ids.iter().map(|id| h.state_mut().session.save_bytes(*id).unwrap()).collect();
+    let before: Vec<_> = h
+        .state()
+        .views
+        .iter()
+        .map(|v| {
+            let d = h.state().session.get(v.id).unwrap();
+            (
+                d.bytes.clone(),
+                d.dirty,
+                d.can_undo().map(str::to_owned),
+                d.can_redo().map(str::to_owned),
+                d.info.pages.iter().map(|p| (p.width, p.height, p.rotation)).collect::<Vec<_>>(),
+            )
+        })
+        .collect();
+    h.state_mut().set_option("dialog", "preferences").unwrap();
+    h.run_steps(3);
+    let checkbox = h.get_by_label("Show Page Edge Shadows");
+    checkbox.click();
+    h.run_steps(2);
+    assert_eq!(serde_json::from_str::<serde_json::Value>(&h.state().persist()).unwrap()["show_page_edge_shadows"], false);
+    h.get_by_label("Show Page Edge Shadows").focus();
+    h.key_press(egui::Key::Space);
+    h.run_steps(2);
+    assert_eq!(serde_json::from_str::<serde_json::Value>(&h.state().persist()).unwrap()["show_page_edge_shadows"], true);
+    let dialog_shadow = h.ctx.global_style().visuals.window_shadow;
+    assert_ne!(dialog_shadow, egui::Shadow::NONE);
+    h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+    h.run_steps(2);
+    assert_eq!(h.ctx.global_style().visuals.window_shadow, dialog_shadow);
+    h.state_mut().set_option("dialog", "none").unwrap();
+    for tab in [0, 1] {
+        h.state_mut().active = Some(tab);
+        h.run_steps(2);
+        assert!(shadows(&h, false).is_empty());
+        let d = h.state().session.get(h.state().views[tab].id).unwrap();
+        assert_eq!(
+            (&d.bytes, d.dirty, d.can_undo(), d.can_redo()),
+            (&before[tab].0, before[tab].1, before[tab].2.as_deref(), before[tab].3.as_deref())
+        );
+        assert_eq!(d.info.pages.iter().map(|p| (p.width, p.height, p.rotation)).collect::<Vec<_>>(), before[tab].4);
+    }
+    for (id, bytes) in ids.iter().zip(&saved) {
+        assert_eq!(h.state_mut().session.save_bytes(*id).unwrap(), *bytes);
+    }
+    h.state_mut().open_bytes("new.pdf", None, pdf()).unwrap();
+    h.run_steps(2);
+    assert!(shadows(&h, false).is_empty());
+}
+
+#[test]
+fn rendered_page_content_is_identical_with_and_without_decoration() {
+    let mut h = harness("dark");
+    h.state_mut().set_option("panel", "pages").unwrap();
+    h.state_mut().set_option("zoom", "175").unwrap();
+    h.run_steps(3);
+    scroll_down(&mut h, 20.0);
+    for _ in 0..400 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(!h.state().render_pending(), "the actual PDF raster must be ready");
+    let rect = h.state().views[0].page_screen_rect(0).unwrap();
+    let fades = viewport_fades(&h);
+    assert_eq!(fades.iter().filter(|r| r.height() <= 21.0).count(), 2, "the screenshot comparison must contain both vertical fades");
+    let enabled = h.render().unwrap();
+    h.state_mut().set_option("show_page_edge_shadows", "false").unwrap();
+    h.run_steps(2);
+    let disabled = h.render().unwrap();
+    assert_eq!(h.state().views[0].page_screen_rect(0), Some(rect));
+    let viewport = h.state().views[0].viewport_rect();
+    assert!(viewport_fades(&h).is_empty());
+    // Only the painter's actual decorative fade strips may change over the page.
+    // All remaining artwork, annotation and form pixels must be identical.
+    for (_, page) in h.state().views[0].visible_page_rects() {
+        let visible = page.intersect(viewport).shrink(2.0);
+        if !visible.is_positive() {
+            continue;
+        }
+        for y in visible.top().ceil() as u32..visible.bottom().floor() as u32 {
+            for x in visible.left().ceil() as u32..visible.right().floor() as u32 {
+                if !fades.iter().any(|fade| fade.expand(1.0).contains(egui::pos2(x as f32, y as f32))) {
+                    assert_eq!(enabled.get_pixel(x, y), disabled.get_pixel(x, y), "page content at {x},{y}");
+                }
+            }
+        }
+    }
+    // The top overlaps the first page's blue artwork; the bottom overlaps the
+    // blank second page. Sample clear of the unchanged scrollbar at the edge.
+    let x = rect.intersect(viewport).center().x as u32;
+    for (y, expected) in [(viewport.top() + 8.0, [204, 230, 255, 255]), (viewport.bottom() - 10.0, [255, 255, 255, 255])] {
+        assert_eq!(disabled.get_pixel(x, y as u32).0, expected, "unobscured PDF at y={y}");
+        assert_ne!(enabled.get_pixel(x, y as u32).0, expected, "fade overlays the PDF at y={y}");
+    }
+    // The Pages sidebar, including its thumbnails and selection borders, is unaffected.
+    for y in 0..enabled.height() {
+        for x in (0..viewport.left().floor() as u32).chain(viewport.right().ceil() as u32..enabled.width()) {
+            assert_eq!(enabled.get_pixel(x, y), disabled.get_pixel(x, y), "sidebar at {x},{y}");
+        }
+    }
+    assert_ne!(enabled.as_raw(), disabled.as_raw(), "the decoration really changes the image");
+    if let Ok(directory) = std::env::var("PDFCRAFT_SHADOW_SCREENSHOTS") {
+        enabled.save(format!("{directory}/page-shadows-enabled.png")).unwrap();
+        disabled.save(format!("{directory}/page-shadows-disabled.png")).unwrap();
+    }
+}
+
+fn harness(theme: &str) -> Harness<'static, PdfCraftApp> {
+    let theme = theme.to_string();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_| {
+        let mut app = PdfCraftApp::new();
+        // Save comparisons must not depend on crossing a /ModDate second boundary.
+        app.session = app.session.with_clock(|| 1_700_000_000);
+        app.set_option("language", "en").unwrap();
+        app.set_option("theme", &theme).unwrap();
+        app.open_bytes("pages.pdf", None, pdf()).unwrap();
+        app.set_option("zoom", "100").unwrap();
+        app
+    });
+    h.run_steps(3);
+    h
+}
+
+fn shadows(h: &Harness<'static, PdfCraftApp>, grid: bool) -> Vec<egui::Rect> {
+    let color = pdfcraft_ui_egui::theme::Tokens::for_kind(h.state().theme).page_shadow;
+    fn collect(shape: &egui::Shape, color: egui::Color32, grid: bool, out: &mut Vec<egui::Rect>) {
+        match shape {
+            egui::Shape::Vec(shapes) => {
+                for s in shapes {
+                    collect(s, color, grid, out);
+                }
+            }
+            egui::Shape::Rect(r)
+                if r.fill == color
+                    && r.rect.width() > 20.0
+                    && r.rect.height() > 20.0
+                    && if grid {
+                        r.blur_width == 0.0 && r.corner_radius == egui::CornerRadius::same(1)
+                    } else {
+                        r.blur_width == 14.0 && r.corner_radius == egui::CornerRadius::ZERO
+                    } =>
+            {
+                out.push(r.rect)
+            }
+            _ => {}
+        }
+    }
+    let mut out = Vec::new();
+    for s in &h.output().shapes {
+        collect(&s.shape, color, grid, &mut out);
+    }
+    out
+}
+
+/// Synthetic pages include colored artwork, an annotation and a form field.
+fn pdf() -> Vec<u8> {
+    let objects = [
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [7 0 R] >> >>".to_string(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R 5 0 R] /Count 3 /MediaBox [0 0 300 400] >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R /Contents 8 0 R /Annots [6 0 R 7 0 R] >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R >>".to_string(),
+        "<< /Type /Page /Parent 2 0 R >>".to_string(),
+        "<< /Type /Annot /Subtype /Text /Rect [20 20 40 40] /Contents (Note) >>".to_string(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (field) /V (value) /Rect [50 50 100 70] /P 3 0 R >>".to_string(),
+        {
+            let body = "0.8 0.9 1 rg 0 0 300 400 re f 0.3 g 10 10 280 8 re f";
+            format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len())
+        },
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{object}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    bytes
+}
+
+#[test]
+fn page_shadow_preference_round_trips_and_ignores_invalid_settings() {
+    let mut app = PdfCraftApp::new();
+    let enabled = |app: &PdfCraftApp| serde_json::from_str::<serde_json::Value>(&app.persist()).unwrap()["show_page_edge_shadows"].clone();
+    assert_eq!(enabled(&app), true);
+    app.restore("{}");
+    assert_eq!(enabled(&app), true);
+    for value in [false, true] {
+        app.set_option("show_page_edge_shadows", if value { "true" } else { "false" }).unwrap();
+        let mut restored = PdfCraftApp::new();
+        restored.restore(&app.persist());
+        assert_eq!(enabled(&restored), value);
+    }
+    for invalid in ["null", "0", "\"false\"", "[]", "{}"] {
+        app.restore(&format!("{{\"show_page_edge_shadows\":{invalid}}}"));
+        assert_eq!(enabled(&app), true);
+    }
+    app.restore("not json");
+    assert_eq!(enabled(&app), true);
+    assert!(app.set_option("show_page_edge_shadows", "maybe").is_err());
+    assert_eq!(enabled(&app), true);
+}
diff --git a/crates/xfa/README.md b/crates/xfa/README.md
index 2d08a74bb2..2ae840a8f0 100644
--- a/crates/xfa/README.md
+++ b/crates/xfa/README.md
@@ -32,7 +32,10 @@ that warning and keeps the existing layout and accepted widget values.
   page masters chosen by occurrence; a table's header row repeats after a break; presence
   `hidden` takes no space, `invisible` takes space; repeating subforms get their initial
   instances, in flowed content and in a top-to-bottom container inside positioned content (a
-  table in an area) alike; fields that compute the page number or count on layout show the numbers.
+  table in an area) alike; fields that compute the page number or count on layout show the numbers;
+  a draw placed by position turns about its anchor (`rotate`: degrees counter-clockwise, a multiple
+  of 90), as one item a page break doesn't cut, and its container grows to the box it stands in. A
+  field, a subform or a draw in a flow doesn't turn.
 - **PDF** (`pdf::write_form`): pages with content streams in the standard 14 fonts (Arial and
   friends → Helvetica, Courier New → Courier, serif faces → Times; nothing is embedded), JPEG
   XObjects, and widgets: text (multi-line, max length, alignment), date (Acrobat's `AFDate`
diff --git a/crates/xfa/src/layout.rs b/crates/xfa/src/layout.rs
index 73c6bde90f..eab26c6dd4 100644
--- a/crates/xfa/src/layout.rs
+++ b/crates/xfa/src/layout.rs
@@ -32,7 +32,7 @@ use common::collect_values;
 pub(crate) use common::date_pattern;
 pub use common::formatted_value;
 pub(crate) use items::UNDERLINE_DROP;
-pub use items::{Action, BorderShape, Form, Item, Page, Rounded, Widget, WidgetBorder, WidgetKind};
+pub use items::{Action, BorderShape, Form, Item, Page, Rounded, Turned, Widget, WidgetBorder, WidgetKind};
 
 /// Most pages a form may lay out to.
 pub const MAX_PAGES: usize = 500;
@@ -212,17 +212,22 @@ pub fn layout(tpl: &Template, data: Option<&DataNode>) -> Result<Form, XfaError>
     let total = l.pages.len();
     let count = total.to_string();
     for p in &mut l.pages {
-        for it in &mut p.items {
-            if let Item::Text(s) = it
-                && s.text.contains(PAGE_COUNT_MARK)
-            {
-                s.text = s.text.replace(PAGE_COUNT_MARK, &count);
-            }
-        }
+        fill_page_count(&mut p.items, &count);
     }
     Ok(Form { pages: l.pages, fields: l.fields, warnings: l.warnings })
 }
 
+/// Puts the page count, known once every page is, where `items` left room for it.
+fn fill_page_count(items: &mut [Item], count: &str) {
+    for it in items {
+        match it {
+            Item::Text(s) if s.text.contains(PAGE_COUNT_MARK) => s.text = s.text.replace(PAGE_COUNT_MARK, count),
+            Item::Turned(t) => fill_page_count(&mut t.items, count),
+            _ => {}
+        }
+    }
+}
+
 // Bytes of embedded field values copied out on this thread, for tests that bound layout work.
 #[cfg(test)]
 thread_local! {
diff --git a/crates/xfa/src/layout/common.rs b/crates/xfa/src/layout/common.rs
index 625f305a6b..54259ede47 100644
--- a/crates/xfa/src/layout/common.rs
+++ b/crates/xfa/src/layout/common.rs
@@ -51,6 +51,7 @@ pub(super) fn solid_extent(item: &Item) -> Option<(f64, f64)> {
         Item::Text(s) => Some((s.baseline - s.face.size * 0.8, s.baseline + s.face.size * 0.2)),
         Item::Image { rect, .. } => Some((rect.y, rect.bottom())),
         Item::Widget(w) => Some((w.rect.y, w.rect.bottom())),
+        Item::Turned(t) => Some(t.extent),
         Item::Fill { .. } | Item::Line { .. } | Item::Rounded(_) => None,
     }
 }
@@ -130,6 +131,11 @@ pub(super) fn moved(mut item: Item, dx: f64, dy: f64) -> Item {
             w.rect.x += dx;
             w.rect.y += dy;
         }
+        Item::Turned(t) => {
+            t.about = (t.about.0 + dx, t.about.1 + dy);
+            t.extent = (t.extent.0 + dy, t.extent.1 + dy);
+            t.items = std::mem::take(&mut t.items).into_iter().map(|i| moved(i, dx, dy)).collect();
+        }
     }
     item
 }
diff --git a/crates/xfa/src/layout/draw.rs b/crates/xfa/src/layout/draw.rs
index f6520c1628..02659c812e 100644
--- a/crates/xfa/src/layout/draw.rs
+++ b/crates/xfa/src/layout/draw.rs
@@ -1,5 +1,5 @@
 use super::common::clean_name;
-use super::items::{Item, Rounded};
+use super::items::{Item, Rounded, Turned};
 use super::{
     Arc, Border, Ctx, Draw, ExclGroup, Face, Font, Layout, Layouter, MAX_DEPTH, MAX_IMAGE_BYTES, Node, Para, Presence, Rect, SomIndices, Stroke,
     Subform, Value, XfaError, data_path, text,
@@ -35,7 +35,27 @@ impl Layouter<'_> {
         }
         let (w, h) = self.size_of(k, (inner.w - c.x.unwrap_or(0.0)).max(1.0), ctx, depth + 1);
         let (x, y) = c.top_left(w, h);
-        self.draw_node(k, Rect::new(inner.x + x, inner.y + y, w, h), ctx, depth + 1, sib)
+        let rect = Rect::new(inner.x + x, inner.y + y, w, h);
+        let start = self.item_count();
+        self.draw_node(k, rect, ctx, depth + 1, sib)?;
+        if c.rotate != 0 && matches!(k, Node::Draw(_)) {
+            let stands = k.standing_box(w, h);
+            let extent = (inner.y + stands.y, inner.y + stands.bottom());
+            self.turn(start, (inner.x + c.x.unwrap_or(0.0), inner.y + c.y.unwrap_or(0.0)), c.rotate, extent);
+        }
+        Ok(())
+    }
+
+    /// Turn the items the last page got since `start`, a draw, about `about`.
+    fn turn(&mut self, start: usize, about: (f64, f64), quarters: u8, extent: (f64, f64)) {
+        let Some(page) = self.pages.last_mut().filter(|p| start < p.items.len()) else { return };
+        let items = page.items.split_off(start);
+        page.items.push(Item::Turned(Box::new(Turned { about, quarters, extent, items })));
+        // One item now, kept whole by what it is: the record of its items, the last one kept,
+        // would fall on the next.
+        if self.leaves.last().is_some_and(|leaf| leaf.0 == start) {
+            self.leaves.pop();
+        }
     }
 
     pub(super) fn draw_node(&mut self, node: &Node, rect: Rect, ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
diff --git a/crates/xfa/src/layout/items.rs b/crates/xfa/src/layout/items.rs
index 8a68388684..be9499cb84 100644
--- a/crates/xfa/src/layout/items.rs
+++ b/crates/xfa/src/layout/items.rs
@@ -27,6 +27,22 @@ pub enum Item {
         content_type: String,
     },
     Widget(Box<Widget>),
+    /// A draw turned about its anchor.
+    Turned(Box<Turned>),
+}
+
+/// A draw turned about its anchor ([`Item::Turned`]). It stays one item, so a page break doesn't
+/// cut it, and what it holds is written unturned under one matrix.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Turned {
+    /// The point it turns about.
+    pub about: (f64, f64),
+    /// Quarter turns counter-clockwise, 1 to 3.
+    pub quarters: u8,
+    /// Top and bottom of its box once turned.
+    pub extent: (f64, f64),
+    /// The draw as it stands before turning.
+    pub items: Vec<Item>,
 }
 
 /// A box with rounded corners ([`Item::Rounded`]).
diff --git a/crates/xfa/src/layout/measure.rs b/crates/xfa/src/layout/measure.rs
index 2fffb3dfa0..32250ab02f 100644
--- a/crates/xfa/src/layout/measure.rs
+++ b/crates/xfa/src/layout/measure.rs
@@ -141,7 +141,7 @@ impl Layouter<'_> {
             Layout::Positioned => visible
                 .map(|k| {
                     let (w, h) = self.size_of(k, avail_w, ctx, depth + 1);
-                    k.common().top_left(w, h).0 + w
+                    k.standing_box(w, h).right()
                 })
                 .fold(0.0, f64::max)
                 .min(avail_w),
@@ -297,7 +297,7 @@ impl Layouter<'_> {
             .map(|k| {
                 let c = k.common();
                 let (w, h) = self.size_of(k, (inner_w - c.x.unwrap_or(0.0)).max(1.0), ctx, depth + 1);
-                c.top_left(w, h).1 + h
+                k.standing_box(w, h).bottom()
             })
             .fold(0.0, f64::max)
     }
diff --git a/crates/xfa/src/model.rs b/crates/xfa/src/model.rs
index 0fac8db18e..23b685102c 100644
--- a/crates/xfa/src/model.rs
+++ b/crates/xfa/src/model.rs
@@ -334,6 +334,9 @@ pub struct Common {
     pub x: Option<f64>,
     pub y: Option<f64>,
     pub anchor: Anchor,
+    /// Quarter turns counter-clockwise about the anchor (`rotate`), 0 to 3. Only a draw placed by
+    /// position is turned.
+    pub rotate: u8,
     pub w: Option<f64>,
     pub h: Option<f64>,
     pub min_w: Option<f64>,
@@ -366,6 +369,26 @@ impl Common {
 }
 
 impl Node {
+    /// The box a positioned object of `w` by `h` stands in, in its parent: from `x`, `y` and the
+    /// anchor, and for a draw, the only object that turns, turned about the anchor.
+    pub fn standing_box(&self, w: f64, h: f64) -> Rect {
+        let c = self.common();
+        let (x, y) = c.top_left(w, h);
+        let upright = Rect::new(x, y, w, h);
+        if !matches!(self, Node::Draw(_)) {
+            return upright;
+        }
+        let (ax, ay) = (c.x.unwrap_or(0.0), c.y.unwrap_or(0.0));
+        let (left, top, right, bottom) = (x - ax, y - ay, x + w - ax, y + h - ay);
+        // Counter-clockwise on a page whose y grows down, from the anchor.
+        match c.rotate {
+            1 => Rect::new(ax + top, ay - right, h, w),
+            2 => Rect::new(ax - right, ay - bottom, w, h),
+            3 => Rect::new(ax - bottom, ay + left, h, w),
+            _ => upright,
+        }
+    }
+
     pub fn common(&self) -> &Common {
         match self {
             Node::Subform(s) => &s.common,
diff --git a/crates/xfa/src/parse.rs b/crates/xfa/src/parse.rs
index fc114aebac..9ca6a7f3cd 100644
--- a/crates/xfa/src/parse.rs
+++ b/crates/xfa/src/parse.rs
@@ -198,6 +198,16 @@ fn parse_para(n: Option<XmlNode>) -> ParaSpec {
     }
 }
 
+/// `rotate` as quarter turns (XFA 3.3: degrees counter-clockwise, a multiple of 90, `deg` optional):
+/// anything else leaves the object as it stands.
+fn quarter_turns(rotate: Option<&str>) -> u8 {
+    let degrees = rotate.map(str::trim).map(|v| v.strip_suffix("deg").unwrap_or(v).trim_end());
+    let turns = degrees.and_then(|v| v.parse::<f64>().ok()).map(|v| v.rem_euclid(360.0) / 90.0);
+    // Whole, which NaN and infinities aren't, and in range, so the cast is exact; a tiny negative
+    // angle rounds to a full turn.
+    turns.filter(|t| t.fract() == 0.0).map_or(0, |t| t as u8 % 4)
+}
+
 fn parse_common(n: XmlNode) -> Common {
     Common {
         name: n.attribute("name").map(str::to_string).filter(|s| !s.is_empty()),
@@ -205,6 +215,7 @@ fn parse_common(n: XmlNode) -> Common {
         x: attr_measure(n, "x"),
         y: attr_measure(n, "y"),
         anchor: Anchor::parse(n.attribute("anchorType")),
+        rotate: quarter_turns(n.attribute("rotate")),
         w: attr_measure(n, "w"),
         h: attr_measure(n, "h"),
         min_w: attr_measure(n, "minW"),
diff --git a/crates/xfa/src/pdf.rs b/crates/xfa/src/pdf.rs
index 0c21507abf..8e9b30c00d 100644
--- a/crates/xfa/src/pdf.rs
+++ b/crates/xfa/src/pdf.rs
@@ -8,7 +8,7 @@ use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
 use pdfcraft_fonts::{literal, win_ansi};
 
 use crate::XfaError;
-use crate::layout::{Action, BorderShape, Form, Item, Page, Rounded, Widget, WidgetKind};
+use crate::layout::{Action, BorderShape, Form, Item, Page, Rounded, Turned, Widget, WidgetKind};
 use crate::model::Rect;
 use crate::text::{Face, Family, Span};
 
@@ -567,12 +567,30 @@ impl Emitter<'_> {
         let h = page.height;
         // The link the text before ended in, which a next piece of it on the line widens.
         let mut last_link: Option<LinkPiece> = None;
-        for (i, item) in page.items.iter().enumerate() {
+        let steps = steps(&page.items);
+        let mut turn = None;
+        for (i, step) in steps.iter().enumerate() {
+            let item = match step {
+                Step::Item(item) => *item,
+                Step::Turn(t) => {
+                    let matrix = turn_matrix(t, h);
+                    turn = Some(matrix);
+                    last_link = None;
+                    content.extend(format!("q {} cm\n", matrix.map(n).join(" ")).bytes());
+                    continue;
+                }
+                Step::EndTurn => {
+                    turn = None;
+                    last_link = None;
+                    content.extend_from_slice(b"Q\n");
+                    continue;
+                }
+            };
             // A link's pieces join only across text and the underline drawn just before it: a fill,
             // picture, field or any other line (a rule) between them ends the link there.
             let keeps_link = match item {
                 Item::Text(_) => true,
-                Item::Line { from, to, .. } => matches!(page.items.get(i + 1), Some(Item::Text(s))
+                Item::Line { from, to, .. } => matches!(steps.get(i + 1), Some(Step::Item(Item::Text(s)))
                     if (from.1 - to.1).abs() < 0.01
                         && (from.0 - s.x).abs() < 0.01
                         && (from.1 - (s.baseline + s.face.size * crate::layout::UNDERLINE_DROP)).abs() < 0.01),
@@ -627,7 +645,7 @@ impl Emitter<'_> {
                     );
                     content.extend(literal(&win_ansi(&s.text)));
                     content.extend_from_slice(format!(" Tj{close}\n").as_bytes());
-                    if let Some(r) = self.text_link(s, h, page_ref, &mut last_link)? {
+                    if let Some(r) = self.text_link(s, h, page_ref, &mut last_link, turn)? {
                         annots.push(Object::Ref(r));
                     }
                 }
@@ -637,6 +655,8 @@ impl Emitter<'_> {
                     xobjects.set(name.clone().into_bytes(), Object::Ref(r));
                     content.extend(format!("q {} 0 0 {} {} {} cm /{name} Do Q\n", n(rect.w), n(rect.h), n(rect.x), n(h - rect.bottom())).bytes());
                 }
+                // Opened out by `steps`.
+                Item::Turned(_) => {}
                 Item::Widget(w) => {
                     if let Some(r) = self.widget(w, page, page_ref)? {
                         annots.push(Object::Ref(r));
@@ -675,12 +695,25 @@ impl Emitter<'_> {
     /// A span that goes on the link `last` ended in, on the same line, widens that annotation
     /// instead (a link whose text changes style partway is one link). An address PdfCraft
     /// wouldn't open from a document leaves the text as plain text, with one warning for the form.
-    fn text_link(&mut self, s: &Span, page_height: f64, page_ref: ObjRef, last: &mut Option<LinkPiece>) -> Result<Option<ObjRef>, XfaError> {
+    fn text_link(
+        &mut self,
+        s: &Span,
+        page_height: f64,
+        page_ref: ObjRef,
+        last: &mut Option<LinkPiece>,
+        turn: Option<[f64; 6]>,
+    ) -> Result<Option<ObjRef>, XfaError> {
         let piece = self.link_piece(s, page_height);
-        let Some((target, rect)) = piece else {
+        let Some((target, mut rect)) = piece else {
             *last = None;
             return Ok(None);
         };
+        // Turned text is drawn by a matrix, and clicked where that puts it. Its pieces don't join:
+        // that goes by the line they stand on before turning.
+        if let Some(m) = turn {
+            rect = turned_rect(rect, m);
+            *last = None;
+        }
         if let Some(prev) = last.as_mut()
             && prev.uri == target
             && (prev.baseline - s.baseline).abs() < 0.01
@@ -765,6 +798,45 @@ fn write_button_action(action: Option<&Action>, d: &mut Dict) {
     }
 }
 
+/// What a page's content is written from: its items, with a turned draw opened out.
+enum Step<'a> {
+    Item(&'a Item),
+    Turn(&'a Turned),
+    EndTurn,
+}
+
+fn steps(items: &[Item]) -> Vec<Step<'_>> {
+    let mut out = Vec::with_capacity(items.len());
+    for item in items {
+        if let Item::Turned(t) = item {
+            out.push(Step::Turn(t));
+            out.extend(t.items.iter().map(Step::Item));
+            out.push(Step::EndTurn);
+        } else {
+            out.push(Step::Item(item));
+        }
+    }
+    out
+}
+
+/// The matrix that turns `t` about its point, on a page `page_height` tall.
+fn turn_matrix(t: &Turned, page_height: f64) -> [f64; 6] {
+    let (cos, sin) = match t.quarters {
+        1 => (0.0, 1.0),
+        2 => (-1.0, 0.0),
+        _ => (0.0, -1.0),
+    };
+    let (x, y) = (t.about.0, page_height - t.about.1);
+    [cos, sin, -sin, cos, x - cos * x + sin * y, y - sin * x - cos * y]
+}
+
+/// Rectangle `r`, `[left, bottom, right, top]`, under quarter-turn matrix `m`.
+fn turned_rect(r: [f64; 4], m: [f64; 6]) -> [f64; 4] {
+    let at = |x: f64, y: f64| (m[0] * x + m[2] * y + m[4], m[1] * x + m[3] * y + m[5]);
+    let (a, b) = (at(r[0], r[1]), at(r[2], r[3]));
+    [a.0.min(b.0), a.1.min(b.1), a.0.max(b.0), a.1.max(b.1)]
+}
+
 /// The link annotation a page's text last ended in: the next piece of the same link on the same
 /// line widens it.
 struct LinkPiece {
diff --git a/crates/xfa/src/tests.rs b/crates/xfa/src/tests.rs
index e424be5441..6d93e1bc99 100644
--- a/crates/xfa/src/tests.rs
+++ b/crates/xfa/src/tests.rs
@@ -4145,3 +4145,389 @@ fn clear_password_values_clears_static_xfa_password_fields() {
     let packets = read_packets(&doc).unwrap().unwrap();
     assert!(!packets.xdp.contains("hunter2"), "{}", packets.xdp);
 }
+
+/// A form with `draws` in a subform placed by position, on a letter page whose content area is a
+/// quarter inch in, with `master` on the page itself.
+fn form_of_draws(master: &str, draws: &str) -> String {
+    format!(
+        r#"<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/"><template xmlns="http://www.xfa.org/schema/xfa-template/3.3/"><subform name="form" layout="tb"><pageSet><pageArea name="p">{master}<contentArea x="0.25in" y="0.25in" w="8in" h="10.5in"/><medium stock="letter" short="8.5in" long="11in"/></pageArea></pageSet><subform name="s" w="8in" h="2.5in">{draws}</subform></subform></template></xdp:xdp>"#
+    )
+}
+
+/// A line from the top-left to the bottom-right of a box 0.7in × 0.4in, as #5561's form draws.
+fn line_draw(x: &str, y: &str, rotate: &str) -> String {
+    format!(r#"<draw x="{x}" y="{y}" w="0.7in" h="0.4in" {rotate}><value><line><edge thickness="2.5pt"/></line></value></draw>"#)
+}
+
+/// `xdp` laid out into its document, and that document's first page.
+fn written(xdp: &str) -> (Document, Dict) {
+    let mut doc = Document::open(Arc::new(shell(xdp))).unwrap();
+    render_into(&mut doc).unwrap();
+    let root = doc.get(doc.root().unwrap());
+    let pages = doc.get(root.as_dict().unwrap().reference(b"Pages").unwrap());
+    let kids = pages.as_dict().unwrap().get(b"Kids").map(|k| doc.resolve(k)).unwrap();
+    let page = doc.get(kids.as_array().unwrap()[0].as_ref().unwrap());
+    let page = page.as_dict().unwrap().clone();
+    (doc, page)
+}
+
+fn page_content(doc: &Document, page: &Dict) -> String {
+    let contents = doc.get(page.reference(b"Contents").unwrap());
+    let Object::Stream(s) = &*contents else { panic!("not a stream") };
+    String::from_utf8_lossy(&s.decoded().unwrap()).into_owned()
+}
+
+/// The ends of each line `content` strokes, on the page: through the matrices around it.
+fn stroked_lines(content: &str) -> Vec<[(f64, f64); 2]> {
+    let (mut stack, mut matrix) = (Vec::new(), [1.0, 0.0, 0.0, 1.0, 0.0, 0.0]);
+    let (mut numbers, mut from, mut lines): (Vec<f64>, _, _) = (Vec::new(), (0.0, 0.0), Vec::new());
+    for token in content.split_whitespace() {
+        let at = |m: [f64; 6], x: f64, y: f64| (m[0] * x + m[2] * y + m[4], m[1] * x + m[3] * y + m[5]);
+        let last = |numbers: &[f64]| (numbers[numbers.len() - 2], numbers[numbers.len() - 1]);
+        match token {
+            "q" => stack.push(matrix),
+            "Q" => matrix = stack.pop().unwrap(),
+            "cm" => {
+                let n: [f64; 6] = numbers[numbers.len() - 6..].try_into().unwrap();
+                let m = matrix;
+                matrix = [
+                    n[0] * m[0] + n[1] * m[2],
+                    n[0] * m[1] + n[1] * m[3],
+                    n[2] * m[0] + n[3] * m[2],
+                    n[2] * m[1] + n[3] * m[3],
+                    n[4] * m[0] + n[5] * m[2] + m[4],
+                    n[4] * m[1] + n[5] * m[3] + m[5],
+                ];
+            }
+            "m" => {
+                let (x, y) = last(&numbers);
+                from = at(matrix, x, y);
+            }
+            "l" => {
+                let (x, y) = last(&numbers);
+                lines.push([from, at(matrix, x, y)]);
+            }
+            _ => {}
+        }
+        match token.parse() {
+            Ok(v) => numbers.push(v),
+            Err(_) => numbers.clear(),
+        }
+    }
+    lines
+}
+
+fn turned(page: &Page) -> Vec<&crate::layout::Turned> {
+    page.items.iter().filter_map(|i| if let Item::Turned(t) = i { Some(t.as_ref()) } else { None }).collect()
+}
+
+/// A draw turns counter-clockwise about its anchor. The figures are where Acrobat put these lines
+/// on the page it flattened for #5561's form: from the anchor by (+50.4, -28.8) unturned, and by
+/// (+28.8, +50.4), (-50.4, +28.8) and (-28.8, -50.4) at 90, 180 and 270 degrees.
+#[test]
+fn a_draw_turns_counter_clockwise_about_its_anchor() {
+    let draws = [
+        line_draw("1in", "0.95in", ""),
+        line_draw("3in", "0.95in", r#"rotate="90""#),
+        line_draw("5in", "0.95in", r#"rotate="180""#),
+        line_draw("7in", "0.95in", r#"rotate="270""#),
+    ]
+    .concat();
+    let (doc, page) = written(&form_of_draws("", &draws));
+    let lines = stroked_lines(&page_content(&doc, &page));
+    assert_eq!(lines.len(), 4, "{lines:?}");
+    let top = 792.0 - 18.0 - 0.95 * 72.0;
+    let acrobat = [((90.0, top), (50.4, -28.8)), ((234.0, top), (28.8, 50.4)), ((378.0, top), (-50.4, 28.8)), ((522.0, top), (-28.8, -50.4))];
+    for ([from, to], (anchor, by)) in lines.iter().zip(acrobat) {
+        assert!((from.0 - anchor.0).abs() < 0.01 && (from.1 - anchor.1).abs() < 0.01, "{from:?} for {anchor:?}");
+        let moved = (to.0 - from.0, to.1 - from.1);
+        assert!((moved.0 - by.0).abs() < 0.01 && (moved.1 - by.1).abs() < 0.01, "{moved:?} for {by:?}");
+    }
+}
+
+/// The anchor is the point it turns about, whichever corner that is: a box anchored at its bottom
+/// right stands up and to the left of it, not where a top-left anchor would turn it.
+#[test]
+fn a_draw_turns_about_the_anchor_it_names() {
+    let draw = r#"<draw x="3in" y="1in" w="0.7in" h="0.4in" anchorType="bottomRight" rotate="90"><value><line><edge thickness="1pt"/></line></value></draw>"#;
+    let (doc, page) = written(&form_of_draws("", draw));
+    let lines = stroked_lines(&page_content(&doc, &page));
+    let anchor = (18.0 + 216.0, 792.0 - 18.0 - 72.0);
+    // Its bottom right is 0.7in right and 0.4in down of its top left, here turned to 0.7in up and
+    // 0.4in right: so the top left is that far back from the anchor, and the line ends on it.
+    let [from, to] = lines[0];
+    assert!((to.0 - anchor.0).abs() < 0.01 && (to.1 - anchor.1).abs() < 0.01, "{to:?} for {anchor:?}");
+    assert!((from.0 - (anchor.0 - 28.8)).abs() < 0.01 && (from.1 - (anchor.1 - 50.4)).abs() < 0.01, "{from:?}");
+}
+
+/// Each of the nine anchors stays where it is, and the box goes round it at each turn. What is
+/// asked for comes from the box's corners here, not from layout: from the anchor, y up, the line
+/// runs from the top left to the bottom right, and a quarter turn takes (x, y) to (-y, x).
+#[test]
+fn a_draw_turns_about_each_of_the_nine_anchors() {
+    let (w, h) = (50.4, 28.8);
+    let anchor = (18.0 + 216.0, 792.0 - 18.0 - 72.0);
+    for (name, down) in [("top", 0.0), ("middle", 0.5), ("bottom", 1.0)] {
+        for (side, across) in [("Left", 0.0), ("Center", 0.5), ("Right", 1.0)] {
+            for quarters in 0..4 {
+                let rotate = quarters * 90;
+                let draw = format!(
+                    r#"<draw x="3in" y="1in" w="0.7in" h="0.4in" anchorType="{name}{side}" rotate="{rotate}"><value><line><edge thickness="1pt"/></line></value></draw>"#
+                );
+                let (doc, page) = written(&form_of_draws("", &draw));
+                let lines = stroked_lines(&page_content(&doc, &page));
+                assert_eq!(lines.len(), 1, "{name}{side} at {rotate}: {lines:?}");
+                let (left, top) = (-across * w, down * h);
+                for (got, corner) in lines[0].iter().zip([(left, top), (left + w, top - h)]) {
+                    let turned = (0..quarters).fold(corner, |(x, y), _| (-y, x));
+                    let want = (anchor.0 + turned.0, anchor.1 + turned.1);
+                    assert!((got.0 - want.0).abs() < 0.01 && (got.1 - want.1).abs() < 0.01, "{name}{side} at {rotate}: {got:?} for {want:?}");
+                }
+            }
+        }
+    }
+}
+
+/// A draw that stands past the edge of the page once turned stays where it turned to: nothing moves
+/// it back or cuts it, as for an upright one. From the page's top left corner of the content area
+/// it goes off to the left and above the page, and from its right side, off to the right.
+#[test]
+fn a_turned_draw_stands_past_the_edge_of_the_page() {
+    for (x, rotate, anchor, by) in [("0in", "180", 18.0, (-50.4, 28.8)), ("8in", "90", 594.0, (28.8, 50.4))] {
+        let draw = line_draw(x, "0in", &format!(r#"rotate="{rotate}""#));
+        let (doc, page) = written(&form_of_draws("", &draw));
+        let content = page_content(&doc, &page);
+        assert!(!content.split_whitespace().any(|t| t == "W" || t == "W*"), "{rotate}: nothing clips it: {content}");
+        let lines = stroked_lines(&content);
+        assert_eq!(lines.len(), 1, "{rotate}: {lines:?}");
+        let [from, to] = lines[0];
+        assert!((from.0 - anchor).abs() < 0.01 && (from.1 - 774.0).abs() < 0.01, "{rotate}: {from:?}");
+        assert!((to.0 - (anchor + by.0)).abs() < 0.01 && (to.1 - (774.0 + by.1)).abs() < 0.01, "{rotate}: {to:?}");
+        assert!(to.0 < 0.0 || to.0 > 612.0, "{rotate}: it does stand past the edge, at {to:?}");
+    }
+}
+
+/// Everything a draw shows turns with it, under one matrix: its text, its picture and its border,
+/// rounded or not, each written as if it stood upright.
+#[test]
+fn text_pictures_and_borders_turn_with_their_draw() {
+    let picture = format!(
+        r#"<draw x="1in" y="1in" w="1in" h="1in" rotate="90"><value><image contentType="image/png">{}</image></value></draw>"#,
+        base64::Engine::encode(&base64::engine::general_purpose::STANDARD, tiny_png())
+    );
+    for (draw, shows) in [
+        (r#"<draw x="1in" y="1in" w="2in" h="0.5in" rotate="90"><value><text>upright</text></value></draw>"#.to_string(), "(upright) Tj"),
+        (picture, " Do "),
+        (r#"<draw x="1in" y="1in" w="2in" h="0.5in" rotate="90"><value><rectangle><edge thickness="1pt"/></rectangle></value></draw>"#.to_string(), " l S"),
+        (
+            r#"<draw x="1in" y="1in" w="2in" h="0.5in" rotate="90"><value><rectangle><edge thickness="1pt"/><corner radius="5pt"/></rectangle></value></draw>"#.to_string(),
+            " c",
+        ),
+        (r#"<draw x="1in" y="1in" w="2in" h="0.5in" rotate="90"><border><fill><color value="255,0,0"/></fill></border><value><text>x</text></value></draw>"#.to_string(), " re f"),
+    ] {
+        let (doc, page) = written(&form_of_draws("", &draw));
+        let content = page_content(&doc, &page);
+        let open = content.find("0 1 -1 0 ").unwrap_or_else(|| panic!("no matrix for {draw}: {content}"));
+        let close = open + content[open..].find("\nQ\n").unwrap_or_else(|| panic!("no end for {draw}: {content}"));
+        assert!(content[open..close].contains(shows), "{shows} outside the matrix: {content}");
+    }
+}
+
+/// `rotate` as a multiple of 90 degrees, with a unit or not, past a full turn or below none;
+/// anything else leaves the draw as it stands.
+#[test]
+fn rotate_reads_as_quarter_turns() {
+    let quarters = |rotate: &str| {
+        let form = layout_xml(&form_of_draws("", &line_draw("1in", "1in", &format!(r#"rotate="{rotate}""#)))).unwrap();
+        turned(&form.pages[0]).first().map_or(0, |t| t.quarters)
+    };
+    for (rotate, want) in [("90", 1), ("180", 2), ("270", 3), ("0", 0), ("360", 0), ("450", 1), ("-90", 3), ("90deg", 1), (" 90 ", 1), ("90.0", 1)] {
+        assert_eq!(quarters(rotate), want, "{rotate}");
+    }
+    for rotate in ["45", "89.5", "135", "225", "abc", "", "deg", "NaN", "inf", "-inf"] {
+        assert_eq!(quarters(rotate), 0, "{rotate}");
+    }
+    // Far past what a turn can be told apart at, or just under none: in range whatever it reads as.
+    for rotate in ["1e300", "-1e-300"] {
+        assert!(quarters(rotate) < 4, "{rotate}");
+    }
+}
+
+/// A turned draw is one item: a page break moves it whole, what it holds moving with the point it
+/// turns about, and doesn't cut it, and the draws around it stay where they belong.
+#[test]
+fn a_page_break_moves_a_turned_draw_whole() {
+    let draws = format!(
+        r#"<draw x="6in" y="10.4in" w="1in" h="0.5in"><border><edge thickness="1pt"/></border><value><text>across</text></value></draw><draw x="1in" y="1in" w="2in" h="0.5in"><value><text>first</text></value></draw>{}{}<draw x="1in" y="13in" w="2in" h="0.5in"><value><text>last</text></value></draw>"#,
+        [
+            line_draw("3in", "12in", r#"rotate="90""#),
+            r#"<draw x="5in" y="12in" w="2in" h="0.5in" rotate="90"><border><edge thickness="1pt"/></border><value><text>sideways</text></value></draw>"#.to_string(),
+        ]
+        .concat(),
+        (2..8).map(|y| line_draw("1in", &format!("{y}in"), "")).collect::<String>()
+    );
+    let xdp = form_of_draws("", &draws).replace(r#"h="2.5in""#, r#"h="14in""#);
+    let form = layout_xml(&xdp).unwrap();
+    assert!(form.pages.len() >= 2, "{}", form.pages.len());
+    assert_eq!(texts(&form.pages[0]), ["first"]);
+    // Written after the turned draws, these lines still belong at the top of the block: what the
+    // break knew of the draw's many items mustn't carry over to those that now stand in their places.
+    let lines = form.pages[0].items.iter().filter(|i| matches!(i, Item::Line { .. })).count();
+    assert_eq!(lines, 6, "{:?}", form.pages[0].items);
+    assert_eq!(turned(&form.pages[0]).len(), 0);
+    let moved = turned(&form.pages[1]);
+    assert_eq!(moved.len(), 2, "{:?}", form.pages[1].items);
+    let Item::Line { from, .. } = &moved[0].items[0] else { panic!("not a line") };
+    assert_eq!(*from, moved[0].about, "the line moved with the point it turns about");
+    // Turned 90 degrees, a box 0.7in wide stands 0.7in up from its anchor, on a second page.
+    assert!(moved[0].about.1 < 792.0, "{:?}", moved[0].about);
+    assert!((moved[0].extent.1 - moved[0].about.1).abs() < 0.01, "{:?}", moved[0]);
+    assert!((moved[0].about.1 - moved[0].extent.0 - 50.4).abs() < 0.01, "{:?}", moved[0]);
+    let moved_text = texts(&form.pages[1]);
+    assert!(moved_text.contains(&"last".to_string()) && moved_text.contains(&"across".to_string()), "{moved_text:?}");
+}
+
+/// What a page break goes by is the box as it stands once turned, whichever way, about whichever
+/// corner: from a top-left anchor, it stands up, up or down of it; from a bottom-right one, the
+/// box starts behind the anchor and the same turns take it the other way.
+#[test]
+fn a_turned_draw_knows_where_it_stands() {
+    let box_at = |anchor: &str, rotate: u32| {
+        let draw = format!(
+            r#"<draw x="3in" y="1in" w="0.7in" h="0.4in" {anchor} rotate="{rotate}"><value><line><edge thickness="1pt"/></line></value></draw>"#
+        );
+        let form = layout_xml(&form_of_draws("", &draw)).unwrap();
+        let held = turned(&form.pages[0]);
+        let t = held.first().expect("turned");
+        (t.extent.0 - t.about.1, t.extent.1 - t.about.1)
+    };
+    let close = |got: (f64, f64), want: (f64, f64)| (got.0 - want.0).abs() < 0.01 && (got.1 - want.1).abs() < 0.01;
+    for (rotate, want) in [(90, (-50.4, 0.0)), (180, (-28.8, 0.0)), (270, (0.0, 50.4))] {
+        assert!(close(box_at("", rotate), want), "{rotate}: {:?}", box_at("", rotate));
+    }
+    for (rotate, want) in [(90, (0.0, 50.4)), (180, (0.0, 28.8)), (270, (-50.4, 0.0))] {
+        let got = box_at(r#"anchorType="bottomRight""#, rotate);
+        assert!(close(got, want), "{rotate}: {got:?}");
+    }
+}
+
+/// The page count is filled in inside a turned draw too, as it comes last, when every page is known.
+#[test]
+fn the_page_count_reaches_a_turned_draw() {
+    let master = r##"<draw x="7in" y="10in" w="1in" h="0.2in" rotate="90"><value><exData contentType="text/html"><body xmlns="http://www.w3.org/1999/xhtml"><p>of <span xfa:embed="#pageCount" xmlns:xfa="http://www.xfa.org/schema/xfa-data/1.0/"/></p></body></exData></value></draw><field name="pageCount" id="pageCount" presence="hidden" w="1in" h="0.2in"><ui><textEdit/></ui><event activity="ready" ref="$layout"><script contentType="application/x-javascript">this.rawValue = xfa.layout.pageCount();</script></event></field>"##;
+    let form = layout_xml(&form_of_draws(master, &line_draw("1in", "1in", ""))).unwrap();
+    let held = turned(&form.pages[0]);
+    assert_eq!(held.len(), 1, "{:?}", form.pages[0].items);
+    let text: Vec<&str> = held[0].items.iter().filter_map(|i| if let Item::Text(s) = i { Some(s.text.as_str()) } else { None }).collect();
+    assert_eq!(text.concat().trim(), "of 1", "{text:?}");
+}
+
+/// A link in turned text is clicked where the text is drawn, whichever way it turned: the box it
+/// has unturned, turned about the draw's anchor.
+#[test]
+fn a_link_turns_with_its_text() {
+    let rect_at = |rotate: &str| {
+        let draw = format!(
+            r#"<draw x="1in" y="3in" w="2in" h="0.5in" {rotate}><value><exData contentType="text/html"><body xmlns="http://www.w3.org/1999/xhtml"><p><a href="https://example.com/a">a link in turned text</a></p></body></exData></value></draw>"#
+        );
+        let (doc, page) = written(&form_of_draws("", &draw));
+        let annots = page.get(b"Annots").map(|a| doc.resolve(a)).expect("the link");
+        let annot = doc.get(annots.as_array().unwrap()[0].as_ref().unwrap());
+        let rect: Vec<f64> = annot.as_dict().unwrap().get(b"Rect").unwrap().as_array().unwrap().iter().map(|v| v.as_f64().unwrap()).collect();
+        rect
+    };
+    let upright = rect_at("");
+    let (ax, ay) = (18.0 + 72.0, 792.0 - 18.0 - 216.0);
+    let (left, bottom, right, top) = (upright[0] - ax, upright[1] - ay, upright[2] - ax, upright[3] - ay);
+    assert!(left >= -0.01 && top <= 0.01 && right - left > 3.0 * (top - bottom), "it stands right and down of its anchor: {upright:?}");
+    for (rotate, want) in [
+        ("90", [ax - top, ay + left, ax - bottom, ay + right]),
+        ("180", [ax - right, ay - top, ax - left, ay - bottom]),
+        ("270", [ax + bottom, ay - right, ax + top, ay - left]),
+    ] {
+        let got = rect_at(&format!(r#"rotate="{rotate}""#));
+        assert!(got.iter().zip(want).all(|(g, w)| (g - w).abs() < 0.01), "{rotate}: {got:?} for {want:?}");
+    }
+}
+
+/// Only a draw placed by position turns: a field, and a draw in a flow, stand as they did.
+#[test]
+fn only_positioned_draws_turn() {
+    let field = r#"<field name="f" x="1in" y="1in" w="2in" h="0.5in" rotate="90"><ui><textEdit/></ui></field>"#;
+    let form = layout_xml(&form_of_draws("", field)).unwrap();
+    assert!(turned(&form.pages[0]).is_empty());
+    assert_eq!(widgets(&form.pages[0]).len(), 1);
+    let flowed = form_of_draws("", &line_draw("1in", "1in", r#"rotate="90""#))
+        .replace(r#"<subform name="s" w="8in" h="2.5in">"#, r#"<subform name="s" w="8in" layout="tb">"#);
+    let form = layout_xml(&flowed).unwrap();
+    assert!(turned(&form.pages[0]).is_empty(), "{:?}", form.pages[0].items);
+    assert!(form.pages[0].items.iter().any(|i| matches!(i, Item::Line { .. })), "it is still drawn");
+    // A draw that shows nothing has nothing to turn.
+    let form = layout_xml(&form_of_draws("", &line_draw("1in", "1in", r#"rotate="90" presence="invisible""#))).unwrap();
+    assert!(form.pages[0].items.is_empty(), "{:?}", form.pages[0].items);
+}
+
+/// A block carried over to a content area further across takes a turned draw with it, point and
+/// items both.
+#[test]
+fn a_turned_draw_moves_across_with_its_content_area() {
+    let xdp = form_of_draws("", &line_draw("1in", "6in", r#"rotate="90""#))
+        .replace(
+            r#"<contentArea x="0.25in" y="0.25in" w="8in" h="10.5in"/>"#,
+            r#"<contentArea x="0.25in" y="0.25in" w="3in" h="5in"/><contentArea x="4in" y="0.25in" w="3in" h="5in"/>"#,
+        )
+        .replace(r#"h="2.5in""#, r#"h="7in""#);
+    let form = layout_xml(&xdp).unwrap();
+    let moved = form.pages.iter().flat_map(turned).next().expect("turned");
+    let Item::Line { from, .. } = &moved.items[0] else { panic!("not a line") };
+    assert_eq!(*from, moved.about);
+    assert!((moved.about.0 - (4.0 + 1.0) * 72.0).abs() < 0.01, "{:?}", moved.about);
+}
+
+/// A positioned subform with no height grows to hold what it holds as it stands, so what comes next
+/// neither runs through a turned draw nor leaves the room its upright box would have had.
+#[test]
+fn a_container_grows_to_a_turned_draw_as_it_stands() {
+    let next = r#"</subform><subform name="next" w="8in" h="1in"><draw x="0in" y="0in" w="2in" h="0.5in"><value><text>next</text></value></draw></subform></subform></template>"#;
+    let baseline = |rotate: &str| {
+        let xdp = form_of_draws("", &line_draw("1in", "1in", rotate)).replace(r#" h="2.5in""#, "").replace("</subform></subform></template>", next);
+        let form = layout_xml(&xdp).unwrap();
+        assert_eq!(form.pages.len(), 1);
+        form.pages[0].items.iter().find_map(|i| if let Item::Text(s) = i { Some(s.baseline) } else { None }).expect("the next block")
+    };
+    // Upright the box ends 0.4in below the anchor, and the next block starts there.
+    let upright = baseline("");
+    for (rotate, bottom) in [("90", 0.0), ("180", 0.0), ("270", 50.4)] {
+        let got = baseline(&format!(r#"rotate="{rotate}""#)) - (upright - 28.8);
+        assert!((got - bottom).abs() < 0.01, "{rotate}: the next block starts {got} below the anchor, not {bottom}");
+    }
+}
+
+/// A subform with no width is as wide as what it holds as it stands, whichever way that turned,
+/// so a neighbour in a row doesn't stand off from it or over it.
+#[test]
+fn a_container_is_as_wide_as_a_turned_draw_stands() {
+    let row = |rotate: &str| {
+        let xdp = form_of_draws(
+            "",
+            &format!(
+                r#"<subform name="turned">{}</subform><subform name="beside" w="1in" h="1in"><draw x="0in" y="0in" w="1in" h="0.5in"><value><text>beside</text></value></draw></subform>"#,
+                line_draw("1in", "1in", rotate)
+            ),
+        )
+        .replace(r#"<subform name="s" w="8in" h="2.5in">"#, r#"<subform name="s" w="8in" h="2.5in" layout="lr-tb">"#);
+        let form = layout_xml(&xdp).unwrap();
+        form.pages[0].items.iter().find_map(|i| if let Item::Text(s) = i { Some(s.x) } else { None }).expect("the neighbour")
+    };
+    let upright = row("");
+    // Upright it ends 0.7in right of the anchor; turned, 0.4in right, at the anchor, and at it again.
+    for (rotate, right) in [("90", 28.8), ("180", 0.0), ("270", 0.0)] {
+        let got = row(&format!(r#"rotate="{rotate}""#)) - (upright - 50.4);
+        assert!((got - right).abs() < 0.01, "{rotate}: the neighbour stands {got} right of the anchor, not {right}");
+    }
+    // From a bottom-right anchor the box starts behind it, and the same turns take it the other way.
+    for (rotate, right) in [("90", 0.0), ("180", 50.4), ("270", 28.8)] {
+        let got = row(&format!(r#"anchorType="bottomRight" rotate="{rotate}""#)) - (upright - 50.4);
+        assert!((got - right).abs() < 0.01, "{rotate}: the neighbour stands {got} right of the anchor, not {right}");
+    }
+}
diff --git a/docs/licensing-self-check.md b/docs/licensing-self-check.md
new file mode 100644
index 0000000000..305d756ff7
--- /dev/null
+++ b/docs/licensing-self-check.md
@@ -0,0 +1,33 @@
+# Source licensing self-check
+
+Run `cargo xtask license-check` to validate the checked-out source, offline. The command
+does not download assets, fetch models, inspect installers, or generate dependency notices.
+It reuses `cargo xtask assets` for attribution, asset policy and locked dependency versions,
+then checks the documents recorded in `LICENSES.toml`.
+
+Each document has a repository-relative source, a unique portable logical destination and
+the SHA-256 of its audited text. Destinations are validation metadata, not instructions to
+copy files into packages. Required project documents and every asset's `licence_file` must
+be mapped. Every dependency-bundled asset must have a document mapping matching its existing
+`ATTRIBUTION.toml` licence expression. Foxit has an explicit required document. Licence
+texts for egui's default fonts and CMaps are retained in `licenses/`, with their pinned
+upstream origins recorded in the manifest. Existing font and asset texts stay in place.
+
+Missing files, empty or invalid text, changed hashes, duplicate mappings, case-insensitive
+destination collisions, parent-file conflicts and unsafe paths fail the check. Source
+symlinks must resolve inside the checkout. OCR models need complete attribution and valid
+hashes and destination names; the model binaries and downloaded licence texts need not be
+present. The optional craft-fonts checkout remains governed by its own attribution and
+the existing asset validator; this command does not audit that external checkout.
+
+When changing attribution, edit `ATTRIBUTION.toml`, run `cargo xtask assets --write`. Generated attribution consistency remains checked only
+by the existing asset validator. When changing licence or notice text, re-audit
+its provenance before updating the corresponding hash. Do not replace a licence with
+guessed terms or update a hash merely to silence a failure. `LICENSES.toml` is validated
+with unknown fields rejected.
+
+The existing Linux source-validation step in `.github/workflows/ci.yml` and `cargo xtask ci`
+run `license-check` in place of `assets`; the asset validator runs once within that command.
+This Stage 1 check establishes source-document consistency, not completed-package
+compliance or legal sufficiency. Installer inspection, dependency-notice generation and
+font-delivery packaging changes remain separate work.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 0f1fb6f4d5..c5bc1ab7d0 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,5 +1,11 @@
 # PdfCraft roadmap: milestones and what's next
 
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 further review: inherited drawing/text state, affine image gestures, paste/selection ownership, no-op scripts and menu permissions; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 latest comments: explicit image-paste events, mixed-size field refresh, and documented mixed-script normalization with Undo; estimates unchanged)
+
+> **Last reviewed:** 2026-11-01 | **Last updated:** 2026-11-01 | **Change:** patch (M7, PR #2155 review follow-up: preserve image crop/tag/stream ownership, resize in page orientation, harden clipboard and text formatting, and reload installed fonts; estimates unchanged)
+
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: GBK rasters compared with explicit Unicode and independently selected installed faces; wrong-glyph and wrong-family negative controls fail; estimates unchanged)
 > **Last reviewed:** 2026-10-31 | **Last updated:** 2026-10-31 | **Change:** patch (M2, PR #4172: integrate main fa5f9f8c; retain CJK viewer and upstream raster regressions, restore explicit display_config imports; estimates unchanged)
 > **Last reviewed:** 2026-10-28 · **Last updated:** 2026-10-28 · **Change:** patch (M2, PR #4172: integrate main 5af10276; retain both roadmap histories and viewer-only CJK font policy; estimates unchanged)
@@ -194,7 +200,7 @@ total matches the parity estimate.
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. Page marks, added content and print output retain small page-unit transform coefficients when serialized. Forms without Resources use page Properties for ActualText and layer visibility; own dictionaries stop fallback. Oversized missing inline-image samples, including header and terminator overhead, no longer pin the content window (#3107 / PR #3438); normal large streamed images retain deterministic sample boundaries. Radial luminosity fades have synthetic coverage for the existing #2132 mask guard, including per-pixel references, antialiased clips, previews, scales and tiles; no additional production fix was needed. Dotted TOC leaders no longer inflate letter tracking or hide word spaces (#3086); phrase search and selection are covered. Short tracked ellipses retain their gap samples and remain searchable. Missing spacing glyphs in non-embedded Japanese CID substitutes render blank without changing PDF advances or Unicode (#3601). The desktop viewer can use installed CJK fonts, including Windows GBK Song/Hei/Kai/FangSong and subset-prefixed Founder names; Combine thumbnails and accessibility figure previews use the same display-only fallback, without changing export or print font policy (#234, continuation of #1567, review #4172). Print previews exclude installed faces and isolate their font cache; GBK regressions cover view/print switching for inline and pooled whole-page/tile rendering. Installed-font helpers and their regression contracts have function documentation. GBK regression rasters match explicit-Unicode references with independently selected installed faces; wrong-glyph and wrong-family negative controls fail. Integration with main fa5f9f8c retains viewer fallback across the split engine session modules, renderer tests and Combine thumbnail workers. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings. Packed TIFF-predictor RGB rows retain later rows in decoding and rendering. The renderer keeps its one-point crop-size floor in physical points after UserUnit scaling, with regression coverage for crop origins, rotations and f32 reciprocal rounding. Existing unit policy and nearly-zero fallback are retained. |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Short same-line redraws split before placement rather than interleaving. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
-| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). #3808: the Pages inspector offers a 50–150% thumbnail slider and buttons, also available through `ui.set`. Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. #3149: page-list changes discard render demand based on old geometry; actual raster dimensions are checked against the GPU limit before upload. Synthetic crash and continued-rendering regressions cover the replacement path. Save-prompt shortcuts yield to dialogs above them; stacked link-consent UI regression covers Escape and Return. Comment hover follows individual marked lines and original annotation paint order (#3541/#3620), independently of spatial inspection sorting; synthetic rotation, differing-upper-edge overlap and unchanged-document regressions. Optional page gaps join page edges without cropping PDF margins; current-document toggle, persisted default and UI control options are covered by viewer tests. Gap changes in Organize Pages preserve document scroll position, and both comparison panes follow menu and control choices. Repeated window resizes by an edge and moves by the tab strip on GNOME/Wayland work without a click in between. |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). #3808: the Pages inspector offers a 50–150% thumbnail slider and buttons, also available through `ui.set`. Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. #3149: page-list changes discard render demand based on old geometry; actual raster dimensions are checked against the GPU limit before upload. Synthetic crash and continued-rendering regressions cover the replacement path. Save-prompt shortcuts yield to dialogs above them; stacked link-consent UI regression covers Escape and Return. Comment hover follows individual marked lines and original annotation paint order (#3541/#3620), independently of spatial inspection sorting; synthetic rotation, differing-upper-edge overlap and unchanged-document regressions. Optional page gaps join page edges without cropping PDF margins; current-document toggle, persisted default and UI control options are covered by viewer tests. Gap changes in Organize Pages preserve document scroll position, and both comparison panes follow menu and control choices. Repeated window resizes by an edge and moves by the tab strip on GNOME/Wayland work without a click in between. Optional --two-paged applies noncontinuous two-page layout to explicitly opened CLI files without changing defaults; explicit --layout wins. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Selected-text Copy in Edit and the canvas context menu is covered by focused regressions and native clipboard checks (#1225); document copy restrictions apply to the floating action too. #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Page-label navigation displays logical labels, retains the current page on unchanged submission and refreshes focused same-document replacements; clean file-watcher reload preserves the chosen scrolling mode, preventing a Single Page reader from jumping to page 1 during replacement. Synthetic control regressions cover these behaviors. Wrapped revision buttons stay above Binding in Document Properties (#2739); a synthetic UI test checks layout and saved revision content. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. Later native-open replies stay queued while a modal or picker owns the foreground; regressions cover recipient ownership, completion/cancellation and one-shot wakes. |
 | M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). #1364 candidate: absolute local GoToR links ask before target access; headless callers explicitly opt in. Native-opening candidate: chosen tools survive preparation and password retries; startup intake waits for pending preparation. #1980: exact quit modifiers preserve Ctrl+Alt+Q email input; Ctrl+Q/Cmd+Q asks before discarding unsaved documents. |
@@ -217,7 +223,7 @@ total matches the parity estimate.
 | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions. Plain AcroForm XML imports retain all direct text around comments and processing instructions, including CDATA and character references.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Multi-select choice fields write ascending `/I` option indices while preserving `/V` selection order; synthetic forms/engine regressions cover reverse selection and save/reopen. CSV export preserves carriage returns in names and values. |
 | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions. XML/XFDF exports preserve tabs and line breaks in names and comment metadata. Refreshed against upstream `99941daa` (2026-10-15).<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Multi-select choice fields write ascending `/I` option indices while preserving `/V` selection order; synthetic forms/engine regressions cover reverse selection and save/reopen. CSV export preserves carriage returns in names and values. |
 | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions. XML/XFDF exports preserve tabs and line breaks in names and comment metadata. Plain AcroForm XML imports retain all direct text around comments and processing instructions, including CDATA and character references. CSV export and spreadsheet merging quote tabs, and import distinguishes quoted tabs from TSV delimiters without changing field identities.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Multi-select choice fields write ascending `/I` option indices while preserving `/V` selection order; synthetic forms/engine regressions cover reverse selection and save/reopen. CSV export preserves carriage returns in names and values. |
-| M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Done since: Edit text preserves Arabic/Hebrew `/ActualText` typing order, with font-independent regressions; single-glyph RTL ligature spans (including lam-alef) join their surrounding word. Done since (#1116): editable text regions grouped across compatible words and subset fonts, one rich-text editor over a background with the source text removed, embedded sfnt faces reused as editor faces, and visible (clipped) bounds for cropped-image selection and resize. Exclusive crops now resize across nested states and content streams, with shared clips fixed.<br>Done since: #594 ordinary paragraph drags preserve overlapping source text; UI/engine regressions, native save/reopen, independent-reader checks and full CI passed in the Linux test environment. #1200 candidate: local GoToR links open in desktop tabs and through root-confined automation; appearance-only edits preserve existing actions. Named destinations remain unapplied and `/NewWindow` is a tab hint. Done since: #3187: Added-image automation normalizes extreme signed rotation angles before combining them with the current orientation; integer bounds, history, pixels, save/reopen and MCP have regressions. Done since: #2592: Styled fallback fonts batch up to 240 glyphs per actual face and retain source styles. Budget refusal and distinct same-BaseFont descriptor weights have mutation-checked regressions; coverage and complex mixed runs remain limited. Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
+| M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Done since: Edit text preserves Arabic/Hebrew `/ActualText` typing order, with font-independent regressions; single-glyph RTL ligature spans (including lam-alef) join their surrounding word. Done since (#1116): editable text regions grouped across compatible words and subset fonts, one rich-text editor over a background with the source text removed, embedded sfnt faces reused as editor faces, and visible (clipped) bounds for cropped-image selection and resize. Exclusive crops now resize across nested states and content streams, with shared clips fixed.<br>Done since: #594 ordinary paragraph drags preserve overlapping source text; UI/engine regressions, native save/reopen, independent-reader checks and full CI passed in the Linux test environment. #1200 candidate: local GoToR links open in desktop tabs and through root-confined automation; appearance-only edits preserve existing actions. Named destinations remain unapplied and `/NewWindow` is a tab hint. Done since: #3187: Added-image automation normalizes extreme signed rotation angles before combining them with the current orientation; integer bounds, history, pixels, save/reopen and MCP have regressions. Done since: #2592: Styled fallback fonts batch up to 240 glyphs per actual face and retain source styles. Budget refusal and distinct same-BaseFont descriptor weights have mutation-checked regressions; coverage and complex mixed runs remain limited. Missing: editing existing text and images in place (the longest pole), image/PDF watermarks PR #2155 candidate: editor-owned crops preserve original clips through group moves; Arrange preserves added-item stream ownership and refuses unsafe scope/state/tag extraction; image handles and flips follow page orientation; general transforms and Unicode script toggles have headless tools. Clipboard, mixed-size formatting, Home pins and reloadable installed-font discovery have review regressions. Latest follow-up uses explicit image-paste events, refreshes the mixed-size display, and documents script normalization with Undo. Further review covers inherited Form text and mask chronology, scoped transform composition, affine resize/rotation pivots, paste/selection ownership, no-op scripts and page-menu permissions. |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Done since: Edit text preserves Arabic/Hebrew `/ActualText` typing order, with font-independent regressions. Done since (#1116): editable text regions grouped across compatible words and subset fonts, one rich-text editor over a background with the source text removed, embedded sfnt faces reused as editor faces, and visible (clipped) bounds for cropped-image selection and resize. Exclusive crops now resize across nested states and content streams, with shared clips fixed.<br>Done since: #594 ordinary paragraph drags preserve overlapping source text; UI/engine regressions, native save/reopen, independent-reader checks and full CI passed in the Linux test environment. #1200 candidate: local GoToR links open in desktop tabs and through root-confined automation; appearance-only edits preserve existing actions. Named destinations remain unapplied and `/NewWindow` is a tab hint. #1316: replacing a line or paragraph keeps a neighbouring line whose glyph box overlaps when the baselines differ; a second copy on the same baseline is still replaced. Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). #3212: Headers, Bates numbers, watermarks and added text stay visible after unfinished marked content, without revealing hidden content. Tracked editable text distinguishes repeated glyph spacing from word gaps, with synthetic paragraph/object regressions. Missing: editing existing text and images in place (the longest pole), watermark print/screen visibility and repeat |
 | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done; XFDF values retain text across XML comments and processing instructions.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Existing simple field-font encodings and Differences are respected when generating appearances; an unencodable value uses a separate Helvetica appearance font without changing the source font. Synthetic reopen regressions cover punctuation, subset fallback and multiline text. Exact font metrics/layout and broader Unicode fallback remain incomplete. |
@@ -290,6 +296,8 @@ Estimates unchanged.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-31 | patch | #1577: reconcile optional page shadows with current viewer/organizer and settings modules; CI validation pending. |
+| 2026-10-31 | patch | M3 #1354: reconcile the launch override with split app/file modules and the structured open result; preserve headless help/version exits. CI validation pending. |
 | 2026-10-31 | patch | M2, PR #4172: eight GBK font/alias cases compare exact pixels with independent installed-face and explicit-Unicode references; wrong-glyph and wrong-family negative controls fail. Estimates unchanged. |
 | 2026-10-31 | patch | M2, PR #4172: integrate main fa5f9f8c, preserve both raster test groups and restore explicit display_config imports; display-only CJK policy and estimates unchanged. |
 | 2026-10-28 | patch | M2, PR #4172: integrate main 5af10276 and retain both roadmap histories; viewer-only CJK and print/output font policies and estimates unchanged. |
diff --git a/licenses/CMap-LICENSE.txt b/licenses/CMap-LICENSE.txt
new file mode 100644
index 0000000000..2552cc990c
--- /dev/null
+++ b/licenses/CMap-LICENSE.txt
@@ -0,0 +1,28 @@
+Copyright 1990-2023 Adobe. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+Redistributions of source code must retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+Neither the name of Adobe nor the names of its contributors may be
+used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/licenses/egui-Hack-Regular.txt b/licenses/egui-Hack-Regular.txt
new file mode 100644
index 0000000000..b0ec74488a
--- /dev/null
+++ b/licenses/egui-Hack-Regular.txt
@@ -0,0 +1,31 @@
+The work in the Hack project is Copyright 2018 Source Foundry Authors and licensed under the MIT License
+
+The work in the DejaVu project was committed to the public domain.
+
+Bitstream Vera Sans Mono Copyright 2003 Bitstream Inc. and licensed under the Bitstream Vera License with Reserved Font Names "Bitstream" and "Vera"
+MIT License
+
+Copyright (c) 2018 Source Foundry Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+BITSTREAM VERA LICENSE
+
+Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is a trademark of Bitstream, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of the fonts accompanying this license ("Fonts") and associated documentation files (the "Font Software"), to reproduce and distribute the Font Software, including without limitation the rights to use, copy, merge, publish, distribute, and/or sell copies of the Font Software, and to permit persons to whom the Font Software is furnished to do so, subject to the following conditions:
+
+The above copyright and trademark notices and this permission notice shall be included in all copies of one or more of the Font Software typefaces.
+
+The Font Software may be modified, altered, or added to, and in particular the designs of glyphs or characters in the Fonts may be modified and additional glyphs or characters may be added to the Fonts, only if the fonts are renamed to names not containing either the words "Bitstream" or the word "Vera".
+
+This License becomes null and void to the extent applicable to Fonts or Font Software that has been modified and is distributed under the "Bitstream Vera" names.
+
+The Font Software may be sold as part of a larger software package but no copy of one or more of the Font Software typefaces may be sold by itself.
+
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL BITSTREAM OR THE GNOME FOUNDATION BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE FONT SOFTWARE.
+
+Except as contained in this notice, the names of Gnome, the Gnome Foundation, and Bitstream Inc., shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Font Software without prior written authorization from the Gnome Foundation or Bitstream Inc., respectively. For further information, contact: fonts at gnome dot org.
diff --git a/licenses/egui-OFL.txt b/licenses/egui-OFL.txt
new file mode 100644
index 0000000000..d952d62c06
--- /dev/null
+++ b/licenses/egui-OFL.txt
@@ -0,0 +1,92 @@
+This Font Software is licensed under the SIL Open Font License,
+Version 1.1.
+
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font
+creation efforts of academic and linguistic communities, and to
+provide a free and open framework in which fonts may be shared and
+improved in partnership with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply to
+any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software
+components as distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to,
+deleting, or substituting -- in part or in whole -- any of the
+components of the Original Version, by changing formats or by porting
+the Font Software to a new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed,
+modify, redistribute, and sell modified and unmodified copies of the
+Font Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components, in
+Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the
+corresponding Copyright Holder. This restriction only applies to the
+primary font name as presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created using
+the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/licenses/egui-UFL.txt b/licenses/egui-UFL.txt
new file mode 100644
index 0000000000..ae78a8f94e
--- /dev/null
+++ b/licenses/egui-UFL.txt
@@ -0,0 +1,96 @@
+-------------------------------
+UBUNTU FONT LICENCE Version 1.0
+-------------------------------
+
+PREAMBLE
+This licence allows the licensed fonts to be used, studied, modified and
+redistributed freely. The fonts, including any derivative works, can be
+bundled, embedded, and redistributed provided the terms of this licence
+are met. The fonts and derivatives, however, cannot be released under
+any other licence. The requirement for fonts to remain under this
+licence does not require any document created using the fonts or their
+derivatives to be published under this licence, as long as the primary
+purpose of the document is not to be a vehicle for the distribution of
+the fonts.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this licence and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Original Version" refers to the collection of Font Software components
+as received under this licence.
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to
+a new environment.
+
+"Copyright Holder(s)" refers to all individuals and companies who have a
+copyright ownership of the Font Software.
+
+"Substantially Changed" refers to Modified Versions which can be easily
+identified as dissimilar to the Font Software by users of the Font
+Software comparing the Original Version with the Modified Version.
+
+To "Propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification and with or without charging
+a redistribution fee), making available to the public, and in some
+countries other activities as well.
+
+PERMISSION & CONDITIONS
+This licence does not grant any rights under trademark law and all such
+rights are reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of the Font Software, to propagate the Font Software, subject to
+the below conditions:
+
+1) Each copy of the Font Software must contain the above copyright
+notice and this licence. These can be included either as stand-alone
+text files, human-readable headers or in the appropriate machine-
+readable metadata fields within text or binary files as long as those
+fields can be easily viewed by the user.
+
+2) The font name complies with the following:
+(a) The Original Version must retain its name, unmodified.
+(b) Modified Versions which are Substantially Changed must be renamed to
+avoid use of the name of the Original Version or similar names entirely.
+(c) Modified Versions which are not Substantially Changed must be
+renamed to both (i) retain the name of the Original Version and (ii) add
+additional naming elements to distinguish the Modified Version from the
+Original Version. The name of such Modified Versions must be the name of
+the Original Version, with "derivative X" where X represents the name of
+the new work, appended to that name.
+
+3) The name(s) of the Copyright Holder(s) and any contributor to the
+Font Software shall not be used to promote, endorse or advertise any
+Modified Version, except (i) as required by this licence, (ii) to
+acknowledge the contribution(s) of the Copyright Holder(s) or (iii) with
+their explicit written permission.
+
+4) The Font Software, modified or unmodified, in part or in whole, must
+be distributed entirely under this licence, and must not be distributed
+under any other licence. The requirement for fonts to remain under this
+licence does not affect any document created using the Font Software,
+except any version of the Font Software extracted from a document
+created using the Font Software may only be distributed under this
+licence.
+
+TERMINATION
+This licence becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF
+COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER
+DEALINGS IN THE FONT SOFTWARE.
diff --git a/licenses/egui-emoji-icon-font-mit-license.txt b/licenses/egui-emoji-icon-font-mit-license.txt
new file mode 100644
index 0000000000..99016e120b
--- /dev/null
+++ b/licenses/egui-emoji-icon-font-mit-license.txt
@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2014 John Slegers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/packaging/linux/flatpak-bundle.sh b/packaging/linux/flatpak-bundle.sh
index 26e09cd1c8..0534b3194e 100755
--- a/packaging/linux/flatpak-bundle.sh
+++ b/packaging/linux/flatpak-bundle.sh
@@ -20,10 +20,12 @@ APP_ID=ai.storyteller.pdfcraft
 FLATHUB=https://dl.flathub.org/repo/flathub.flatpakrepo
 
 TEST=1
+OCI=0
 TARBALL=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --no-test) TEST=0; shift ;;
+    --oci) OCI=1; shift ;;
     -h | --help) sed -n '2,14p' "$0"; exit 0 ;;
     -*) echo "unknown argument: $1" >&2; exit 2 ;;
     *) TARBALL="$1"; shift ;;
@@ -62,6 +64,13 @@ OUT="$DIST/$BASENAME.flatpak"
 flatpak build-bundle --runtime-repo="$FLATHUB" "$WORK/repo" "$OUT" "$APP_ID" stable
 echo "wrote $OUT"
 
+if [[ "$OCI" = 1 ]]; then
+  OUT_OCI="$DIST/$BASENAME-oci"
+  rm -rf "$OUT_OCI"
+  flatpak build-bundle --oci "$WORK/repo" "$OUT_OCI" "$APP_ID" stable
+  echo "wrote OCI layout to $OUT_OCI"
+fi
+
 if [[ "$TEST" = 1 ]]; then
   flatpak install --user -y --noninteractive --reinstall "$OUT"
   flatpak info --user "$APP_ID"
diff --git a/packaging/linux/flatpak-oci.sh b/packaging/linux/flatpak-oci.sh
new file mode 100755
index 0000000000..0572ef1a3a
--- /dev/null
+++ b/packaging/linux/flatpak-oci.sh
@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Build PdfCraft as an OCI container layout and push it to GitHub Container Registry (GHCR)
+# for consumption by Flatpak OCI clients (flatpak-oci-specs).
+#
+# Usage:
+#   packaging/linux/flatpak-oci.sh [--push] [TARBALL]
+#
+# Environment variables:
+#   REGISTRY       Target registry image (default: ghcr.io/storytold/pdfcraft)
+#   TAG            Target image tag (default: $VERSION-$ARCH, also tags stable and latest)
+#   GITHUB_TOKEN   Token for GHCR authentication when --push is used
+set -euo pipefail
+# shellcheck source=../env.sh
+. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
+HERE="$ROOT/packaging/linux"
+
+PUSH=0
+TARBALL=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --push) PUSH=1; shift ;;
+    -h | --help) sed -n '2,12p' "$0"; exit 0 ;;
+    -*) echo "unknown argument: $1" >&2; exit 2 ;;
+    *) TARBALL="$1"; shift ;;
+  esac
+done
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64) ;;
+  aarch64 | arm64) ARCH=aarch64 ;;
+  *) echo "unsupported architecture $ARCH" >&2; exit 2 ;;
+esac
+
+BASENAME="pdfcraft-$VERSION-linux-$ARCH"
+OUT_OCI="$DIST/$BASENAME-oci"
+
+echo "==> Building Flatpak OCI layout for $BASENAME"
+"$HERE/flatpak-bundle.sh" --oci --no-test "${TARBALL:-}"
+
+[[ -d "$OUT_OCI" ]] || { echo "error: $OUT_OCI layout not generated" >&2; exit 1; }
+
+REGISTRY="${REGISTRY:-ghcr.io/storytold/pdfcraft}"
+TAG="${TAG:-$VERSION-$ARCH}"
+
+echo "==> OCI layout ready at $OUT_OCI (Target: $REGISTRY:$TAG)"
+
+if [[ "$PUSH" = 1 ]]; then
+  command -v skopeo >/dev/null || { echo "error: skopeo is required to push OCI images (apt install skopeo)" >&2; exit 1; }
+
+  AUTH_ARGS=()
+  if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+    AUTH_ARGS=(--dest-creds "${GITHUB_ACTOR:-storytold}:$GITHUB_TOKEN")
+  fi
+
+  echo "==> Pushing to $REGISTRY:$TAG"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:$TAG"
+
+  # Also update architecture-specific stable tag
+  echo "==> Pushing to $REGISTRY:stable-$ARCH"
+  skopeo copy --format oci "${AUTH_ARGS[@]}" "oci:$OUT_OCI" "docker://$REGISTRY:stable-$ARCH"
+
+  echo "==> Push complete"
+fi
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index a8d2ce3f32..401a0152ca 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -890,8 +890,8 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.layout.two_up"]
 tools = []
-evidence = ["crates/ui-egui/tests/it/view.rs::two_up_layout_places_pages_side_by_side", "crates/ui-egui/tests/it/viewer.rs::two_page_view_steps_a_spread_at_a_time"]
-notes = "next/previous page step a spread at a time"
+evidence = ["crates/ui-egui/tests/it/view.rs::two_up_layout_places_pages_side_by_side", "crates/ui-egui/tests/it/viewer.rs::two_page_view_steps_a_spread_at_a_time", "apps/pdfcraft/src/startup.rs::startup_override_is_per_file_and_does_not_persist", "crates/ui-egui/src/platform/open_worker/tests.rs::flagged_startup_opens_wait_for_password_ownership_before_the_first_frame"]
+notes = "Next/previous page step a spread at a time. Optional desktop --two-paged launches named PDFs in noncontinuous two-page view without changing saved defaults or unrelated restored tabs. Explicit --layout wins after flagged opens settle, including password retries; repeated files reuse their tab. This is a launch override, not a declarative configuration module."
 
 [[feature]]
 id = "view.layout-two-up-scrolling"
@@ -1287,7 +1287,7 @@ status = "shipped"
 commands = []
 tools = []
 evidence = ["crates/ui-egui/tests/it/view.rs::pages_sidebar_select_all_keeps_current_page_and_keyboard_scope", "crates/ui-egui/tests/it/editing.rs::dragging_pages_panel_thumbnails_reorders_pages", "crates/ui-egui/tests/it/viewer.rs::pages_panel_thumbnails_have_a_context_menu", "crates/ui-egui/tests/it/editing.rs::split_from_pages_panel_context_menu", "crates/ui-egui/tests/it/editing.rs::deleting_pages_from_the_pages_panel_menu", "crates/ui-egui/tests/it/editing.rs::the_delete_key_deletes_pages_picked_in_the_pages_panel_but_never_every_page"]
-notes = "Ctrl/Cmd+A selects every page while the Pages sidebar owns the keyboard, without navigation; Escape clears that selection. Viewer and text-field shortcuts keep their own scope. Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Split document…, Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
+notes = "Ctrl/Cmd+A selects every page while the Pages sidebar owns the keyboard, without navigation; Escape clears that selection. Viewer and text-field shortcuts keep their own scope. Drag the selection (or the page grabbed) to reorder, with a drop bar and edge scrolling; right-click offers Split document…, Extract pages, Cut, Copy, Paste after and Delete pages (also the Delete key over the panel). Deleting pages makes the next Save a full rewrite (unsigned files), so the deleted pages leave the file; signed files stay incremental. Not yet: Rotate, Insert and Page labels in the menu, dragging pages between documents, or dropping files onto the panel."
 
 [[feature]]
 id = "view.bookmarks-panel"
@@ -1799,11 +1799,17 @@ title = "Customise the quick-action toolbar and pinned tools"
 area = "B"
 tier = "P2"
 milestone = "M14"
-status = "planned"
+status = "partial"
 commands = []
 tools = []
-evidence = []
-notes = ""
+evidence = [
+  "crates/ui-egui/tests/it/pinned_tools.rs::state_operations_and_validation",
+  "crates/ui-egui/tests/it/pinned_tools.rs::persistence_round_trip_and_sanitization",
+  "crates/ui-egui/tests/it/pinned_tools.rs::home_shows_pinned_tools_section_and_placeholder",
+  "crates/ui-egui/tests/it/pinned_tools.rs::pin_tool_dialog_workflow",
+  "crates/ui-egui/tests/it/pinned_tools.rs::sidebar_pin_toggle_unpins_and_pins",
+]
+notes = "Pin and unpin tools on the Home page via tool card hover button, All Tools row toggle, or 'Pin a tool' search dialog. Pinned tool order persists across sessions. Floating quick-action toolbar customisation remains planned."
 
 [[feature]]
 id = "view.restriction-notice"
@@ -1959,11 +1965,19 @@ title = "Superscript and subscript"
 area = "C"
 tier = "P2"
 milestone = "M7"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["edit.edit_text"]
+tools = ["text_script"]
+evidence = [
+  "crates/engine/src/text_script.rs::every_form_toggles_back_to_its_character",
+  "crates/engine/src/text_script.rs::text_with_characters_unicode_cannot_raise_toggles_back",
+  "crates/ui-egui/src/tools/edit_text_ui.rs::superscript_and_subscript_conversion",
+  "crates/ui-egui/tests/it/editing.rs::the_format_panel_toggles_superscript_and_subscript_on_selection",
+  "crates/automation/tests/it/automation.rs::superscript_and_subscript_through_tools",
+  "crates/engine/src/text_script.rs::mixed_plain_and_scripted_text_normalizes_instead_of_round_tripping",
+  "crates/automation/tests/it/automation.rs::mixed_script_tools_normalize_but_undo_restores_the_exact_mixture",
+]
+notes = "Toggled in the Format text panel for the selection, and headlessly with text_script on a paragraph or a byte range of it; each toggle of a paragraph is one undo step. Uses Unicode superscript and subscript forms (2 ↔ ²) rather than text rise (Ts) and font scaling, so the font must provide the corresponding glyphs and extracted text contains the Unicode characters. Characters Unicode has no form for (q, most capitals in subscript) stay unchanged and do not determine script state. Two toggles restore uniformly plain or uniformly scripted inputs. Mixed input normalizes (H₂2 → H₂₂ → H22), so a second toggle does not recover the original mixture; Undo restores the exact prior text. The mathematical minus sign U+2212 has its own script mapping, while ASCII hyphen-minus stays unchanged."
 
 [[feature]]
 id = "edit.paragraph-alignment"
@@ -2129,8 +2143,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.image"]
 tools = ["content_update", "image_edit"]
-evidence = ["crates/ui-egui/tests/it/editing.rs::cropping_a_picture_with_its_handles", "crates/engine/src/tests.rs::cropping_an_existing_image_clips_it_and_moves_with_it", "crates/automation/tests/it/automation.rs::editing_page_images_through_tools", "crates/engine/src/tests.rs::added_images_rotate_flip_and_crop_as_drawn", "crates/automation/tests/it/automation.rs::adding_content_through_tools"]
-notes = "Existing page images: right-click ▸ Crop Image puts the picture in crop mode: its eight handles trim (the inside pans), the part that will go is dimmed, Enter or Done applies, Esc or Cancel leaves it; Remove Crop shows the whole picture again. The pixels stay where they are (a clipping path inside the picture's own scope, so a later move or resize carries it along; cropping again replaces the earlier crop, so it can grow back); image_edit crop. Added images: trim each side by percent in Edit image, clipped. Not yet: cropping grouped Form artwork by handles is allowed the same way (it is a clip), but a shared clip of the original file is not changed."
+evidence = ["crates/edit/src/tests.rs::removing_a_crop_preserves_author_clips_and_works_under_outer_clip", "crates/ui-egui/tests/it/editing.rs::cropping_a_picture_with_its_handles", "crates/engine/src/tests.rs::cropping_an_existing_image_clips_it_and_moves_with_it", "crates/automation/tests/it/automation.rs::editing_page_images_through_tools", "crates/engine/src/tests.rs::added_images_rotate_flip_and_crop_as_drawn", "crates/automation/tests/it/automation.rs::adding_content_through_tools"]
+notes = "Existing page images: right-click ▸ Crop Image puts the picture in crop mode: its eight handles trim (the inside pans), the part that will go is dimmed, Enter or Done applies, Esc or Cancel leaves it; Remove Crop removes only a crop created by PdfCraft, preserving original document clips. The pixels stay where they are (a clipping path inside the picture's own scope, so a later move or resize carries it along; cropping again replaces the earlier crop, so it can grow back); image_edit crop. Added images: trim each side by percent in Edit image, clipped. Grouped Form artwork cannot be cropped. Shared clips and other clipping paths from the original file remain unchanged."
 
 [[feature]]
 id = "edit.image-rotate-flip"
@@ -2153,8 +2167,8 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.edit_text"]
 tools = ["image_edit", "image_hit"]
-evidence = ["crates/edit/src/tests.rs::private_image_crop_with_intervening_state_resizes_across_streams", "crates/automation/tests/it/automation.rs::private_crops_with_nested_state_resize_save_reopen_through_tools", "crates/edit/src/tests.rs::form_artwork_edits_only_the_selected_placement", "crates/ui-egui/tests/it/editing.rs::editing_existing_form_artwork_on_the_page", "crates/automation/tests/it/automation.rs::editing_form_artwork_through_tools", "crates/edit/src/tests.rs::page_images_move_turn_replace_and_delete", "crates/ui-egui/tests/it/editing.rs::editing_existing_images_on_the_page", "crates/automation/tests/it/automation.rs::editing_page_images_through_tools", "crates/edit/src/tests.rs::curved_image_clips_have_analytic_bounds_and_holes_do_not_capture_points", "crates/edit/src/tests.rs::cropped_image_resizing_moves_private_clips_and_keeps_shared_ones", "crates/ui-egui/tests/it/editing.rs::cropped_image_corner_resize_keeps_opposite_corner_and_scales_crop", "crates/edit/src/tests.rs::image_selection_bounds_respect_clips_and_restore_graphics_state", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::resizing_an_image_under_a_shared_clip_moves_its_own_clip"]
-notes = "existing raster images and grouped Form artwork: select, drag to move, drag a corner to resize keeping proportions; Delete removes one placement. Forms include their nested content as a group; individual internal elements and inline images are not supported. See docs/editing-images.md; added images too Since #1116: raster images and grouped Forms move/resize/turn as placements; selected grips own the gesture and opposite anchor, with no PDF writes during movement. Curved path frames use analytic Bezier extrema and hit testing evaluates actual nonzero/even-odd fill rules, excluding holes; intersections can retain a loose frame. Selection and resize use the visible (clipped) frame; exclusive image clips move with their pixels across nested states, intervening operators and content streams, also inside a clip the picture shares with other content (its own clip scales, the shared one stays); shared clips stay fixed. Inline images and Form internals remain unsupported; see docs/editing-images.md"
+evidence = ["crates/edit/src/tests.rs::private_image_crop_with_intervening_state_resizes_across_streams", "crates/automation/tests/it/automation.rs::private_crops_with_nested_state_resize_save_reopen_through_tools", "crates/edit/src/tests.rs::form_artwork_edits_only_the_selected_placement", "crates/ui-egui/tests/it/editing.rs::editing_existing_form_artwork_on_the_page", "crates/automation/tests/it/automation.rs::editing_form_artwork_through_tools", "crates/edit/src/tests.rs::page_images_move_turn_replace_and_delete", "crates/ui-egui/tests/it/editing.rs::editing_existing_images_on_the_page", "crates/automation/tests/it/automation.rs::editing_page_images_through_tools", "crates/edit/src/tests.rs::curved_image_clips_have_analytic_bounds_and_holes_do_not_capture_points", "crates/edit/src/tests.rs::cropped_image_resizing_moves_private_clips_and_keeps_shared_ones", "crates/ui-egui/tests/it/editing.rs::cropped_image_corner_resize_keeps_opposite_corner_and_scales_crop", "crates/edit/src/tests.rs::image_selection_bounds_respect_clips_and_restore_graphics_state", "crates/ui-egui/tests/it/editing.rs::cropped_images_do_not_intercept_text_and_stay_inside_each_page", "crates/automation/tests/it/automation.rs::clipped_image_bounds_and_text_edit_save_reopen_through_tools", "crates/edit/src/tests.rs::resizing_an_image_under_a_shared_clip_moves_its_own_clip", "crates/automation/tests/it/automation.rs::transforming_page_images_through_tools"]
+notes = "existing raster images and grouped Form artwork: select, drag to move, 8-point handles to resize (corners keep proportions, edges scale along axis, Shift inverts aspect lock); Delete removes one placement. Headless: image_edit action move (a new box) or transform (any finite, non-flat 6-number matrix in top-left-origin points, applied after the placement: the edit a resize of a turned image makes). Forms include their nested content as a group; individual internal elements and inline images are not supported. See docs/editing-images.md; added images too Since #1116: raster images and grouped Forms move/resize/turn as placements; selected grips own the gesture and opposite anchor, with no PDF writes during movement. Curved path frames use analytic Bezier extrema and hit testing evaluates actual nonzero/even-odd fill rules, excluding holes; intersections can retain a loose frame. Selection and resize use the visible (clipped) frame; exclusive image clips move with their pixels across nested states, intervening operators and content streams, also inside a clip the picture shares with other content (its own clip scales, the shared one stays); shared clips stay fixed. Inline images and Form internals remain unsupported; see docs/editing-images.md"
 
 [[feature]]
 id = "edit.image-extract"
@@ -2186,11 +2200,17 @@ title = "Arrange objects (bring forward, send backward)"
 area = "C"
 tier = "P1"
 milestone = "M7"
-status = "planned"
+status = "partial"
 commands = []
-tools = []
-evidence = []
-notes = ""
+tools = ["image_edit"]
+evidence = [
+  "crates/edit/src/tests.rs::image_arrange_stacking_order_and_remove_crop",
+  "crates/edit/src/tests.rs::image_arrange_refuses_crossed_scope_boundaries_without_changes",
+  "crates/edit/src/tests.rs::arrange_refuses_unrestorable_extended_print_state",
+  "crates/automation/tests/it/automation.rs::arranging_page_images_through_tools",
+  "crates/ui-egui/tests/it/editing.rs::duplicate_xobject_at_different_rects_arrange_and_delete_keeps_other_instance_through_menu",
+]
+notes = "Image stacking order in content streams: Bring to Front, Send to Back, Bring Forward, Send Backward with undo/redo and persistence. Refuses arranging across shared marked content, unbalanced graphics/marked-content boundaries, or when clipping path transforms cannot be cleanly preserved. Stacking for arbitrary vector paths and inline images remains planned."
 
 [[feature]]
 id = "edit.align-distribute-objects"
@@ -5320,8 +5340,8 @@ milestone = "M12"
 status = "partial"
 commands = ["file.open"]
 tools = ["doc_open", "doc_info", "form_fields", "form_fill", "js_run"]
-evidence = ["crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/it/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/it/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/engine/src/tests.rs::xfa_date_arithmetic_reads_the_date_as_its_display_picture_shows_it", "crates/automation/tests/it/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/it/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/ui-egui/tests/it/xfa.rs::a_form_whose_scripts_were_turned_off_at_open_says_so", "crates/ui-egui/tests/it/xfa.rs::scripts_turned_off_by_a_click_bring_a_closed_notice_bar_back", "crates/automation/tests/it/automation.rs::doc_info_says_when_a_runaway_script_turned_the_forms_scripts_off", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save", "crates/xfa/src/tests.rs::repeating_subforms_inside_positioned_content_get_their_instances", "crates/engine/src/tests.rs::xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them", "crates/xfa/src/tests.rs::page_area_without_occur_serves_every_body_page", "apps/pdfcraft-cli/tests/it/xfa.rs::info_reports_the_laid_out_pages_and_fields", "apps/pdfcraft-cli/tests/it/xfa.rs::text_reads_the_layout_including_a_page_absent_from_the_placeholder", "apps/pdfcraft-cli/tests/it/xfa.rs::render_matches_the_engine_layout_on_the_second_page", "apps/pdfcraft-cli/tests/it/xfa.rs::a_laid_out_form_keeps_the_original_copy_permissions", "crates/engine/src/tests.rs::filling_growable_xfa_text_reflows_and_undo_restores_the_layout", "crates/engine/src/tests.rs::xfa_text_growth_refreshes_widget_geometry_but_fixed_height_fields_keep_their_widgets", "crates/automation/tests/it/automation.rs::growable_xfa_text_paginates_after_fill_save_and_print", "crates/engine/src/tests.rs::an_xfa_script_that_fails_partway_keeps_what_it_changed_before_the_error", "crates/engine/src/tests.rs::repeated_xfa_print_buttons_run_their_click_script", "crates/automation/tests/it/automation.rs::repeated_xfa_print_buttons_work_through_tools_and_after_reopen", "crates/xfa/src/tests.rs::rich_text_max_length_reaches_the_field_and_layout", "crates/automation/tests/it/automation.rs::xfa_rich_text_max_length_is_reported_and_enforced_through_tools", "crates/xfa/src/tests.rs::bmp_and_tiff_pictures_are_decoded_and_drawn", "crates/engine/src/tests.rs::active_xfa_does_not_run_pdf_container_scripts_but_keeps_requested_alerts", "crates/engine/src/tests.rs::active_xfa_without_template_scripts_does_not_initialize_pdf_fallback_scripts", "crates/engine/src/tests.rs::inactive_xfa_and_ordinary_pdfs_keep_document_helpers_and_alerts", "crates/automation/tests/it/automation.rs::active_xfa_skips_container_fallback_scripts_after_save_and_reopen", "crates/xfa/src/tests.rs::laying_a_form_out_takes_off_the_usage_rights_it_voids", "crates/engine/src/tests.rs::a_dynamic_xfa_form_is_saved_without_the_usage_rights_its_layout_voided", "crates/xfa/src/tests.rs::faces_measure_text_at_their_standard_14_widths", "crates/xfa/src/tests.rs::rich_text_links_keep_their_address", "crates/xfa/src/tests.rs::links_in_rich_text_become_link_annotations_one_per_line", "crates/xfa/src/tests.rs::a_links_pieces_share_one_address", "crates/xfa/src/tests.rs::a_rule_between_two_pieces_of_a_link_keeps_them_apart", "crates/xfa/src/tests.rs::links_to_anything_but_web_and_email_addresses_stay_plain_text", "crates/automation/tests/it/automation.rs::links_in_xfa_rich_text_are_listed_through_tools", "crates/xfa/src/tests.rs::rounded_corners_make_a_border_one_rounded_shape", "crates/xfa/src/tests.rs::a_rounded_box_cut_by_a_page_break_keeps_its_corners_on_each_page", "crates/xfa/src/tests.rs::rounded_boxes_are_written_as_curved_paths", "crates/xfa/src/tests.rs::a_flowed_subform_is_drawn_with_its_border_under_its_content", "crates/xfa/src/tests.rs::a_check_box_sits_where_its_margins_caption_and_alignment_put_it", "crates/xfa/src/tests.rs::a_check_box_caption_without_a_reserve_takes_the_rest_of_the_field", "crates/xfa/src/tests.rs::a_radio_button_sits_where_a_check_box_would", "crates/xfa/src/tests.rs::a_check_box_caption_without_a_reserve_is_measured_as_it_is_drawn", "crates/js/src/tests.rs::message_box_keeps_its_title_icon_and_buttons", "crates/js/src/tests.rs::app_alert_in_an_xfa_script_reads_app_alerts_arguments", "crates/engine/src/tests.rs::xfa_message_boxes_keep_their_title_icon_and_buttons", "crates/xfa/src/tests.rs::signature_fields_are_named_by_their_som_path", "crates/xfa/src/tests.rs::a_signature_on_a_laid_out_box_survives_a_new_layout"]
-notes = "Active XFA layout skips PDF-container document-script initialization for the Acrobat console/field context, so fallback-viewer scripts do not run there. Scripts remain in the file/listing; explicit console/field and XFA alerts still run. Ordinary PDF, static XFA and unlaid-out shells keep document scripts; static-conversion undo restores the XFA policy. Changed growable multiline text (no fixed h) reflows from final datasets after edits, with or without scripts; pages/widgets refresh and undo/redo, save/reopen and print retain all text. Oversized text still uses the existing read-only page-text fallback with a warning; fixed-height fields do not reflow. Repeated page-master buttons resolve their own PDF field to the shared XFA click script; the numPages-based print script requests printing from every copy, including after save/reopen (#2572). Rich-text exData/maxLength is carried into AcroForm MaxLen, reported by form_fields and enforced by form_fill (Unicode characters); limits and accepted values survive save/reopen (#2570). laid out from the template on open by the xfa crate (positioned, tb, lr-tb, table/row, page masters (a page area with no occur repeats without limit, one with occur max=1 is used once, one with occur min=1 the body never reached gets a page after the body, as Acrobat Pro does on a synthetic form), breaks, repeated header rows, borders and fills of flowed subforms (a page break between their children gives each page's part a closed border, the margins repeated at the cut, as measured on a synthetic form in another viewer, and a child's own page break breaks them the same way; one holding an item that doesn't fit on its page, cut across pages or placed past the content area's bottom, is drawn without its border, with a layout warning), captions, rounded and inverted border corners, rich text (its http, https and mailto links clickable), JPEG/PNG/GIF/BMP/TIFF images) into real pages and AcroForm fields (text, password, date with AFDate formats, check boxes and radio groups (each box placed by its field's margins, caption and paragraph alignment as measured on two synthetic forms in another viewer: with no caption at the right of the content area, beside a reserved caption where the alignment puts it, and a caption without a reserve taking the rest of the field; a check box's own margin larger than the box draws a bigger box there, which isn't copied), drop-downs and list boxes with shown/saved item pairs and multi-select, signature fields (each named by its SOM path, under a generated field for each step above it, so that another viewer, which lays the form out again, finds a signature made here, as seen on a synthetic form, and a box signed here keeps its signature, and that name, when a script lays the form out again; a box whose path, or a part of it, the file already gives another field keeps its own name, and its signature isn't found there yet), image fields showing their picture (pictures decoded once per document, at most 20 million pixels, and reused across re-layouts), buttons with reset/print/save/URL), filled from the datasets packet (including rows another viewer added), saved as an incremental revision with the values merged into the datasets so Adobe's viewers show them; usage rights the form carried (/Perms /UR3) are taken off with a note, as the layout voids them and a form with void usage rights opens with every field locked; doc_info reports xfa_layout. CLI info reports the laid-out page/field counts and dimensions while retaining the input file size and raw counts as pdf_pages/acroform_fields; text and render use those pages too, preserving copy permissions and leaving the source file unchanged (#1645). XFA JavaScript and FormCalc (form.xfa-formcalc) run in the js crate's XFA object model (xfa.form, SOM resolution, rawValue, formattedValue in a date display picture's pattern (number and text display pictures still give the raw value), presence, access, instance managers, xfa.host, xfa.layout, xfa.event): initialize and calculate on open, exit, validate and calculate after a field changes, click for buttons (through js_run and the app), with rows added and removed, subforms shown and hidden, and the form laid out again, all as one undo step and kept in the file. All the scripts of one event run on one thread, each in a fresh context on the form as the engine holds it then (nothing shared between scripts; the live form kept up to date in place for values, rebuilt only when the structure changed), so hundreds of calculations run within the open budget. Hostile scripts are bounded per event (merged and capped effects, messages and console lines, lower loop limits and a time budget on open and calculate, one datasets rewrite per event, print/save/links/focus from clicks only, a runaway script abandoned and the form's scripts turned off, which the app says in a toast and on the notice bar, with a button to the JavaScript console, and doc_info reports as xfa_scripts_off) and what open-time scripts changed is noted. A script that fails partway keeps what it changed before the error, as JavaScript does (forms often trip over an object an earlier version had after their first lines did the work). Missing: a page area's relevant=\"-print\" (on a synthetic form Acrobat still prints the page but leaves it blank; PdfCraft prints its content, #2574); a page break before the first section (Acrobat opens an empty body page first when the first section has breakBefore targetType=pageArea, with or without startNew, as seen on synthetic forms; PdfCraft skips a break on an empty page and lays out one page fewer, #2574); loops inside nested calls are only stopped by abandoning their thread, and script memory is not capped; the change event per keystroke; xfa.template, connections and data descriptions; a hidden instance of a repeating subform hides them all; barcodes are drawn as their text, not bars; keep rules; text is measured at the exact standard-14 widths of the face it is drawn in (bold, italic and Times included), not in the template's own typefaces, and Acrobat fidelity is eyeballed on real forms, not measured (#60). xfa.host.messageBox keeps its title, icon and buttons, and app.alert in an XFA script reads its own argument order; every message box still answers OK (1) (#4291)."
+evidence = ["crates/xfa/src/tests.rs::a_draw_turns_counter_clockwise_about_its_anchor", "crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/it/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/it/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/engine/src/tests.rs::xfa_date_arithmetic_reads_the_date_as_its_display_picture_shows_it", "crates/automation/tests/it/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/it/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/ui-egui/tests/it/xfa.rs::a_form_whose_scripts_were_turned_off_at_open_says_so", "crates/ui-egui/tests/it/xfa.rs::scripts_turned_off_by_a_click_bring_a_closed_notice_bar_back", "crates/automation/tests/it/automation.rs::doc_info_says_when_a_runaway_script_turned_the_forms_scripts_off", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save", "crates/xfa/src/tests.rs::repeating_subforms_inside_positioned_content_get_their_instances", "crates/engine/src/tests.rs::xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them", "crates/xfa/src/tests.rs::page_area_without_occur_serves_every_body_page", "apps/pdfcraft-cli/tests/it/xfa.rs::info_reports_the_laid_out_pages_and_fields", "apps/pdfcraft-cli/tests/it/xfa.rs::text_reads_the_layout_including_a_page_absent_from_the_placeholder", "apps/pdfcraft-cli/tests/it/xfa.rs::render_matches_the_engine_layout_on_the_second_page", "apps/pdfcraft-cli/tests/it/xfa.rs::a_laid_out_form_keeps_the_original_copy_permissions", "crates/engine/src/tests.rs::filling_growable_xfa_text_reflows_and_undo_restores_the_layout", "crates/engine/src/tests.rs::xfa_text_growth_refreshes_widget_geometry_but_fixed_height_fields_keep_their_widgets", "crates/automation/tests/it/automation.rs::growable_xfa_text_paginates_after_fill_save_and_print", "crates/engine/src/tests.rs::an_xfa_script_that_fails_partway_keeps_what_it_changed_before_the_error", "crates/engine/src/tests.rs::repeated_xfa_print_buttons_run_their_click_script", "crates/automation/tests/it/automation.rs::repeated_xfa_print_buttons_work_through_tools_and_after_reopen", "crates/xfa/src/tests.rs::rich_text_max_length_reaches_the_field_and_layout", "crates/automation/tests/it/automation.rs::xfa_rich_text_max_length_is_reported_and_enforced_through_tools", "crates/xfa/src/tests.rs::bmp_and_tiff_pictures_are_decoded_and_drawn", "crates/engine/src/tests.rs::active_xfa_does_not_run_pdf_container_scripts_but_keeps_requested_alerts", "crates/engine/src/tests.rs::active_xfa_without_template_scripts_does_not_initialize_pdf_fallback_scripts", "crates/engine/src/tests.rs::inactive_xfa_and_ordinary_pdfs_keep_document_helpers_and_alerts", "crates/automation/tests/it/automation.rs::active_xfa_skips_container_fallback_scripts_after_save_and_reopen", "crates/xfa/src/tests.rs::laying_a_form_out_takes_off_the_usage_rights_it_voids", "crates/engine/src/tests.rs::a_dynamic_xfa_form_is_saved_without_the_usage_rights_its_layout_voided", "crates/xfa/src/tests.rs::faces_measure_text_at_their_standard_14_widths", "crates/xfa/src/tests.rs::rich_text_links_keep_their_address", "crates/xfa/src/tests.rs::links_in_rich_text_become_link_annotations_one_per_line", "crates/xfa/src/tests.rs::a_links_pieces_share_one_address", "crates/xfa/src/tests.rs::a_rule_between_two_pieces_of_a_link_keeps_them_apart", "crates/xfa/src/tests.rs::links_to_anything_but_web_and_email_addresses_stay_plain_text", "crates/automation/tests/it/automation.rs::links_in_xfa_rich_text_are_listed_through_tools", "crates/xfa/src/tests.rs::rounded_corners_make_a_border_one_rounded_shape", "crates/xfa/src/tests.rs::a_rounded_box_cut_by_a_page_break_keeps_its_corners_on_each_page", "crates/xfa/src/tests.rs::rounded_boxes_are_written_as_curved_paths", "crates/xfa/src/tests.rs::a_flowed_subform_is_drawn_with_its_border_under_its_content", "crates/xfa/src/tests.rs::a_check_box_sits_where_its_margins_caption_and_alignment_put_it", "crates/xfa/src/tests.rs::a_check_box_caption_without_a_reserve_takes_the_rest_of_the_field", "crates/xfa/src/tests.rs::a_radio_button_sits_where_a_check_box_would", "crates/xfa/src/tests.rs::a_check_box_caption_without_a_reserve_is_measured_as_it_is_drawn", "crates/js/src/tests.rs::message_box_keeps_its_title_icon_and_buttons", "crates/js/src/tests.rs::app_alert_in_an_xfa_script_reads_app_alerts_arguments", "crates/engine/src/tests.rs::xfa_message_boxes_keep_their_title_icon_and_buttons", "crates/xfa/src/tests.rs::signature_fields_are_named_by_their_som_path", "crates/xfa/src/tests.rs::a_signature_on_a_laid_out_box_survives_a_new_layout"]
+notes = "A draw placed by position turns about its anchor (rotate); fields, subforms and draws in a flow don't. Active XFA layout skips PDF-container document-script initialization for the Acrobat console/field context, so fallback-viewer scripts do not run there. Scripts remain in the file/listing; explicit console/field and XFA alerts still run. Ordinary PDF, static XFA and unlaid-out shells keep document scripts; static-conversion undo restores the XFA policy. Changed growable multiline text (no fixed h) reflows from final datasets after edits, with or without scripts; pages/widgets refresh and undo/redo, save/reopen and print retain all text. Oversized text still uses the existing read-only page-text fallback with a warning; fixed-height fields do not reflow. Repeated page-master buttons resolve their own PDF field to the shared XFA click script; the numPages-based print script requests printing from every copy, including after save/reopen (#2572). Rich-text exData/maxLength is carried into AcroForm MaxLen, reported by form_fields and enforced by form_fill (Unicode characters); limits and accepted values survive save/reopen (#2570). laid out from the template on open by the xfa crate (positioned, tb, lr-tb, table/row, page masters (a page area with no occur repeats without limit, one with occur max=1 is used once, one with occur min=1 the body never reached gets a page after the body, as Acrobat Pro does on a synthetic form), breaks, repeated header rows, borders and fills of flowed subforms (a page break between their children gives each page's part a closed border, the margins repeated at the cut, as measured on a synthetic form in another viewer, and a child's own page break breaks them the same way; one holding an item that doesn't fit on its page, cut across pages or placed past the content area's bottom, is drawn without its border, with a layout warning), captions, rounded and inverted border corners, rich text (its http, https and mailto links clickable), JPEG/PNG/GIF/BMP/TIFF images) into real pages and AcroForm fields (text, password, date with AFDate formats, check boxes and radio groups (each box placed by its field's margins, caption and paragraph alignment as measured on two synthetic forms in another viewer: with no caption at the right of the content area, beside a reserved caption where the alignment puts it, and a caption without a reserve taking the rest of the field; a check box's own margin larger than the box draws a bigger box there, which isn't copied), drop-downs and list boxes with shown/saved item pairs and multi-select, signature fields (each named by its SOM path, under a generated field for each step above it, so that another viewer, which lays the form out again, finds a signature made here, as seen on a synthetic form, and a box signed here keeps its signature, and that name, when a script lays the form out again; a box whose path, or a part of it, the file already gives another field keeps its own name, and its signature isn't found there yet), image fields showing their picture (pictures decoded once per document, at most 20 million pixels, and reused across re-layouts), buttons with reset/print/save/URL), filled from the datasets packet (including rows another viewer added), saved as an incremental revision with the values merged into the datasets so Adobe's viewers show them; usage rights the form carried (/Perms /UR3) are taken off with a note, as the layout voids them and a form with void usage rights opens with every field locked; doc_info reports xfa_layout. CLI info reports the laid-out page/field counts and dimensions while retaining the input file size and raw counts as pdf_pages/acroform_fields; text and render use those pages too, preserving copy permissions and leaving the source file unchanged (#1645). XFA JavaScript and FormCalc (form.xfa-formcalc) run in the js crate's XFA object model (xfa.form, SOM resolution, rawValue, formattedValue in a date display picture's pattern (number and text display pictures still give the raw value), presence, access, instance managers, xfa.host, xfa.layout, xfa.event): initialize and calculate on open, exit, validate and calculate after a field changes, click for buttons (through js_run and the app), with rows added and removed, subforms shown and hidden, and the form laid out again, all as one undo step and kept in the file. All the scripts of one event run on one thread, each in a fresh context on the form as the engine holds it then (nothing shared between scripts; the live form kept up to date in place for values, rebuilt only when the structure changed), so hundreds of calculations run within the open budget. Hostile scripts are bounded per event (merged and capped effects, messages and console lines, lower loop limits and a time budget on open and calculate, one datasets rewrite per event, print/save/links/focus from clicks only, a runaway script abandoned and the form's scripts turned off, which the app says in a toast and on the notice bar, with a button to the JavaScript console, and doc_info reports as xfa_scripts_off) and what open-time scripts changed is noted. A script that fails partway keeps what it changed before the error, as JavaScript does (forms often trip over an object an earlier version had after their first lines did the work). Missing: a page area's relevant=\"-print\" (on a synthetic form Acrobat still prints the page but leaves it blank; PdfCraft prints its content, #2574); a page break before the first section (Acrobat opens an empty body page first when the first section has breakBefore targetType=pageArea, with or without startNew, as seen on synthetic forms; PdfCraft skips a break on an empty page and lays out one page fewer, #2574); loops inside nested calls are only stopped by abandoning their thread, and script memory is not capped; the change event per keystroke; xfa.template, connections and data descriptions; a hidden instance of a repeating subform hides them all; barcodes are drawn as their text, not bars; keep rules; text is measured at the exact standard-14 widths of the face it is drawn in (bold, italic and Times included), not in the template's own typefaces, and Acrobat fidelity is eyeballed on real forms, not measured (#60). xfa.host.messageBox keeps its title, icon and buttons, and app.alert in an XFA script reads its own argument order; every message box still answers OK (1) (#4291)."
 
 [[feature]]
 id = "form.xfa-formcalc"
@@ -6968,8 +6988,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["create.blank"]
 tools = ["doc_create"]
-evidence = ["crates/ui-egui/tests/it/create.rs::opening_images_and_text_converts_them_to_new_pdfs", "crates/create/src/tests.rs::blank_documents", "crates/automation/tests/it/automation.rs::creating_and_reducing_through_tools"]
-notes = ""
+evidence = ["crates/ui-egui/tests/it/create.rs::opening_images_and_text_converts_them_to_new_pdfs", "crates/ui-egui/tests/it/create.rs::a_blank_page_is_on_the_system_regions_paper", "crates/ui-egui/src/persist/paper.rs::region_decides_the_paper", "crates/create/src/tests.rs::blank_documents", "crates/automation/tests/it/automation.rs::creating_and_reducing_through_tools"]
+notes = "The page is the system region's paper (#5644): US Letter in the US, Canada, Mexico, the Philippines and the other CLDR Letter regions, A4 elsewhere; Windows' own Region paper size (iPaperSize) first, then the system locale (macOS) or LC_ALL/LC_PAPER/LANG; Letter when the region is unknown (web). The doc_create tool keeps Letter unless given width and height. Missing: a page size or count chooser like Acrobat's New Document dialog."
 
 [[feature]]
 id = "create.from-html"
@@ -9928,8 +9948,8 @@ milestone = "M14"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/it/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::default_zoom_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::preferences_set_the_default_zoom", "crates/ui-egui/tests/it/view.rs::always_use_my_default_zoom_and_page_layout_ignores_what_the_pdf_asks_for"]
-notes = "Preferences ▸ Documents and view: Default page display and Default zoom (Fit to width, Zoom to page level or a percentage) for every new tab; a PDF that asks for a layout or zoom gets it, unless Always use my default zoom and page layout is on. Missing: Acrobat's resolution, rendering and page-content options"
+evidence = ["crates/ui-egui/tests/page_shadows.rs::viewport_fades_follow_the_preference_and_keep_other_scroll_areas_styled", "crates/ui-egui/tests/page_shadows.rs::rendered_page_content_is_identical_with_and_without_decoration", "crates/ui-egui/tests/page_shadows.rs::page_shadow_preference_round_trips_and_ignores_invalid_settings", "crates/ui-egui/tests/page_shadows.rs::viewer_shadows_follow_the_preference_without_moving_pages", "crates/ui-egui/tests/page_shadows.rs::organize_shadows_follow_the_preference", "crates/ui-egui/tests/it/control.rs::page_shadows_are_an_observable_app_wide_preference", "crates/ui-egui/tests/it/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::default_zoom_is_used_for_new_documents", "crates/ui-egui/tests/it/view.rs::preferences_set_the_default_zoom", "crates/ui-egui/tests/it/view.rs::always_use_my_default_zoom_and_page_layout_ignores_what_the_pdf_asks_for"]
+notes = "Preferences ▸ Documents and view: Default page display and Default zoom (Fit to width, Zoom to page level or a percentage) for every new tab; a PDF that asks for a layout or zoom gets it, unless Always use my default zoom and page layout is on. Preferences ▸ Appearance also has an app-wide, persistent Show Page Edge Shadows checkbox (on by default), exposed through ui.set and ui.state; it affects viewer and Organize decorations, including the viewport-edge gradients painted over pages, only. Missing: Acrobat's resolution, rendering and page-content options"
 
 [[feature]]
 id = "misc.prefs-documents"
@@ -9937,11 +9957,11 @@ title = "Preferences: documents (autosave interval, recent count)"
 area = "N"
 tier = "P1"
 milestone = "M14"
-status = "planned"
+status = "partial"
 commands = []
 tools = []
-evidence = []
-notes = ""
+evidence = ["crates/ui-egui/tests/it/recent_files.rs::preferences_cuts_the_list_when_it_closes_and_not_before", "crates/ui-egui/tests/it/recent_files.rs::at_zero_home_has_no_recent_section", "crates/ui-egui/tests/it/recent_files.rs::a_settings_file_can_not_ask_for_a_limit_that_is_not_one"]
+notes = "Preferences ▸ Documents and view: Recent files to keep, from 0 to 50 with 12 by default (#5572). At 0 Home has no Recent section and File ▸ Open Recent is disabled; Restore the last view keeps its own record of paths under its own switch. Still missing: the autosave interval (recovery snapshots run every AUTOSAVE_SECS, 60 s) and the rest of Acrobat's Documents page."
 
 [[feature]]
 id = "misc.prefs-commenting"
diff --git a/vendor/README.md b/vendor/README.md
index 8b906996a2..812958b996 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -39,11 +39,11 @@ Other resource categories retain their existing parent-chain lookup.
 
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; the comma-below letters (`/scommaaccent`, `/Tcommaaccent`, `/kcommaaccent`…, found by character, so `/uni0136` and the glyph list's `/Kcedilla` too) are the letter and the font's comma, smaller and under the baseline, since the stand-ins have no `commaaccent` (Romanian ș drew nothing and ț a cedilla in forms laid out from XFA; ģ, whose comma is turned and above, is not built); (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) an image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN image, a 1-, 2- or 4-bit gray or indexed one) is converted once per possible pixel value through a lookup table instead of once per pixel (`rgb_via_lookup`): a spot-colour tint transform is often a PostScript calculator program, run for every pixel, so a fillable character sheet's 3304 × 4105 DeviceN background took four seconds and 430 MB to draw a page; each entry is converted on its own (`convert_each`), so a tint transform giving the wrong number of components for a value the image never uses cannot shift the colours of the values it does; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548); (30) the Annex D.2 alias codes read as the ink they draw: WinAnsiEncoding 0xA0 and 0xAD, and MacRomanEncoding 0xCA, carry the glyph names `space` and `hyphen` -- the names those tables also give 0x20 and 0x2D -- not `nbspace` and `sfthyphen`, whose glyph list values U+00A0 and U+00AD are invisible formatting characters. Extraction hid drawn ink behind them, so search and redaction matched neither (`XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 soft hyphens; across the 989 files the soft hyphens we extract fall from 117 to 13 and the non-breaking spaces from 30 to 26, what remains coming from `/ToUnicode` maps, which say so explicitly). The base table only, in the text direction only: a `/Differences` name keeps its glyph list value and glyph lookup is untouched, both as pdftotext does; (31) a Type 0 sampled function keeps its samples in one flat array indexed by strides (`Type0::entry`) instead of a hash map keyed by each grid point: the map was built again, one hashed insert per sample, every time a shading using the function was painted (a 2,097,152-sample ramp painted 30 times took 38 s; `bug1721218` in the pdf.js corpus spent most of a 1.5 s page on it); the interpolation is unchanged, so results are bit for bit the same, a sample missing from a short stream still gives no value, and the maximum sample value is computed without overflowing at 32 bits per sample; (32) the decoded-image cache (24) keys a decode by the size the image is drawn at only when a JPX stream decodes it or its soft mask or mask (`decode_reads_target`): JPX is the only filter that decodes a reduced resolution for a size, so a JPEG or Flate scan was decoded again at every zoom step and kept once per zoom level; one decode now serves every size; `InterpreterCache::decoded_image_decodes` counts the cache's decodes; (33) Coons and tensor-product patches copy their vertices' colours less: each point of a patch's 20 × 20 triangle grid is interpolated once (`generate_patch_triangles`; each cell interpolated its four corners itself, 1,444 interpolations a patch for 400 points), a cell's second triangle takes the vertices its first copied, and the mesh sampler moves a patch's triangles into device space instead of copying each vertex (`TriangleSampler::sample_owned`); the same values, 10–16% faster on mesh-gradient pages; (34) `color::tint_transform_runs`: how many colours the calling thread has run through a Separation or DeviceN tint transform (counted once per batch in `convert_f32`), so a test counts patch (28)'s once-per-sample-value runs instead of timing them (its 10 s deadline failed on a busy FreeBSD VM in CI); (35) `EncodedShadingPattern::extent`: where a mesh shading (types 4–7) can paint at all, the pixels its triangles touched when it was encoded (`None` for the types that paint everywhere, and when the shading has a `/Background`), so the renderer samples a texture there alone and skips a mesh with nothing on the canvas; (36) a mesh shading's pixel whose corner no triangle holds strictly (on an edge two triangles share, or on the mesh's side) takes the triangle that covers its centre, edges included (`Triangle::covers`): testing only the corner left a white seam along every shared edge, and the colour is still taken at the corner; (38) the `/DefaultGray`, `/DefaultRGB` and `/DefaultCMYK` colour spaces of a resource dictionary (ISO 32000-2 §8.6.5.6) replace the device space content selects: with `g`/`G`, `rg`/`RG`, `k`/`K` and `cs`/`CS` (by name, or through a `/ColorSpace` resource that is a device space), and as the `/ColorSpace` of an image XObject, an inline image or a shading painted by `sh` or as a shading pattern (`DefaultColorSpaces`, looked up once per content window in the resources and those they inherit, so a form XObject without a default of its own draws in its page's, as Poppler and MuPDF draw it); a default that is a Lab, Indexed, Pattern or device space, has another number of components or is no colour space is ignored and device colour is drawn as before; device spaces inside other spaces (an Indexed base, a Separation or DeviceN alternate, a Pattern's underlying space), shading dictionaries, masks and transparency group spaces are unchanged, and the decoded-image cache (24) keys a decode by the default it was drawn in. hayro drew device colour as it was, so pages that calibrate it this way (common in PDF/A) came out in the wrong colours; (39) knockout groups (#2971): `Device::set_knockout` right after a `/K true` group is pushed; `Device::knockout_image` for an unmasked image before its group is pushed, when `Device::in_knockout_group`: the device clears its placement rectangle only if it will draw the image (on the canvas, not a preview's tiny image, and it decodes), decoded at its draw size so the draw reuses that decode; and, when `Device::knockout_erase_wanted`, a nested group's content drawn once between `begin_knockout_erase` and `end_knockout_erase` before the group itself, which then always gets a layer of its own; (40) an optional content membership dictionary's visibility expression (`/VE`: `/And`, `/Or`, `/Not`, nested up to 32 deep) decides its visibility ahead of `/OCGs` and `/P` (ISO 32000-2 §8.11.2.2); it was ignored, so content under it stayed visible with its layers hidden; a malformed expression, including one naming an object the document doesn't list in `/OCProperties /OCGs`, falls back to `/OCGs` and `/P` (#2986); (41) a transparency group that is neither isolated nor knockout, entered at full opacity with no soft mask and Normal blending, is drawn straight onto the page instead of into a layer of its own (§11.4.7: its elements composite with the backdrop; the layer made a `/BM /Multiply` highlight appearance an opaque block, #1968); (42) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it (`7 Tr` since follows 64); (43) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range`; (44) a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (not a CMap stream; WSCAD writes it) reads each code as its Unicode value, as Acrobat shows it (`Type0Font::identity_to_unicode`); the identity CMap the name resolved to maps codes to CIDs only, so such pages had no text to select or find; (46) an image XObject's group applies the fill opacity, so the fill alpha is reset to 1 before a stencil mask takes the fill colour as its paint, and a pattern paint drops the opacity it captured at `scn` (`Pattern::without_opacity`) (it was applied twice: a mask at `ca 0.5` was drawn at a quarter, #2975); (47) `path_as_rect`: a five-element path is a rectangle only when its four points are distinct, each step from one to the next runs along a single axis, and the last returns to the first. The length test admits one MoveTo and four LineTo as well as one MoveTo, three LineTo and a ClosePath, and asking only that every corner of the bounding box was visited says nothing about the order or the steps between, so a five-point polyline whose ends reached the corners was painted as that box -- a fourth side the path does not have -- and a clip of that shape was discarded; the coordinates are compared exactly, since the matrix is applied after this check and a `cm` of 10,000 turns `is_nearly_equal`'s 256th of a unit into tens of device units (#3327); (48) an `/ICCBased` colour space is cached by what its profile is read from (`IccProfileKey`): the stream object it names, looked up without reading the stream, and then the stream's dictionary and its own bytes (decrypted, not decoded), so a byte-for-byte copy of a profile in another object is read once, and a profile stream written directly in its array, which reports the object holding the array as every other stream written there does, is told apart by its bytes. hayro keyed it by the stream dictionary's bytes alone, so two different profiles with the same `/N` and `/Length` shared whichever was read first, and colours in the second were drawn through the first. `InterpreterCache::icc_profile_reads` counts the profiles read; (49) `OpenTypeFontBlob::new` also accepts a `post` table version 1.0, 2.0 or 3.0 written with its 16-bit halves swapped (`00 00 00 03`), as ScanSoft PDF Create! embeds every font; such fonts were refused and their text drawn with a substitute (Hebrew came out garbled or missing, #2946); `glyph_names` reads such a table from a copy with the version written correctly, so a 2.0 table's names serve `/Differences`. Any other unknown version is still refused (pdf.js 9462); (50) `CffFontBlob::glyph_index_by_name` looks a glyph name up in a name to glyph map built on first use (shared between clones) instead of searching the whole charset, with a string lookup per glyph, for every character code of a font; the first glyph with a name still wins; (51) at most 4096 graphics states saved at once, holding at most 64 MiB together (each `q` copies the whole state, dash array and clip list included, so short operators multiplied one large state); a `q` past either limit is counted but not copied, and its `Q` still removes the clips added since (from storytold/craft-libs#239); (52) a `/W2` run whose first CID is past `MAX_CID` stops there, as in `/W` (7), checked before the run's metrics are read: a first CID of 4294967295 inserted one entry and then overflowed, discarding the whole `/W2` table (from storytold/craft-libs#254); (55) a Separation or DeviceN tint transform that cannot be read keeps its colour space, and one that cannot be read or evaluated paints the alternate space's initial colour, as evaluation failures already did; that fallback, and a `cs`/`CS` colour space that cannot be read (drawn in DeviceGray as before), are now reported once per content stream as `InterpreterWarning::ColorFallback` (`RenderWarning::ColourFallback` in `pdfcraft-render`) instead of silently (#4260); (56) an annotation whose Invisible flag (bit 1) is set and whose `/Subtype` is none of the standard types of ISO 32000-2 Table 171 (`is_standard_annotation_type`; no `/Subtype` counts as unknown) is not drawn (Table 167), and a `/Popup` annotation's appearance is never painted on the page (§12.5.6.14: a popup has no appearance stream of its own; the viewer shows it as a window for its parent annotation). Both were drawn from their `/AP`; (57) a simple font drawn with a standard-font stand-in because the document names a font it doesn't embed (`StandardKind` with `fallback`) narrows a glyph to a narrower `/Widths` advance but no longer widens it to a wider one: the advance already places the next glyph (ISO 32000-2 §9.2.4; /Widths in Table 109), and widening drew a non-embedded `Arial,Bold` with 600-unit widths as a heavy fixed-pitch face whose `i` and `l` were solid blocks twice their width; an exact standard-14 font still matches its standard metrics both ways; (58) the fallback request for a Type 0 font that is not embedded (`FallbackFontQuery::with_descriptor`) takes its serif, italic and small-cap flags, `/FontWeight`, `/FontFamily` and `/FontStretch` from the descendant CIDFont's font descriptor (ISO 32000-2 §9.7.4.1, §9.7.6.1; §9.8): it read them from the Type 0 dictionary, which has none, so every such request asked for a regular sans-serif face and no resolver could tell a Song or Mincho font from a Hei or Gothic one, or see `/FontWeight 700`; (59) the NoRotate flag (`/F` bit 5) is honoured: the appearance, fitted to `/Rect`, is turned against the page's `/Rotate` about the rectangle's upper-left corner, which stays where it is, so it reads upright as the page is displayed (ISO 32000-2 §12.5.3). Sticky notes, which are saved NoRotate, were drawn turned with the page (#2583). Form fields and links stay in `/Rect`, where PdfCraft takes their click targets from it; (64) text in a Type 3 font follows ISO 32000-2 §9.3.6 in the clipping modes: under `7 Tr` it is not rendered (reported to the device as clipping text, `GlyphDrawMode::Clip`, so extraction keeps it), and in modes 4 to 7 a Type 3 glyph adds nothing to the clipping path (`clip_glyph`), so text shown only in a Type 3 font leaves no clip at `ET`. Since (42) `7 Tr` painted the glyphs in the fill colour (black by default), so a fill meant to follow showed them wherever it didn't cover them; 4 to 6 still render filled; (66) a Separation colour space whose colourant is the special name `All` paints every colourant at once (ISO 32000-2 §8.6.6.4): on screen and in an RGB print raster its tint t is the gray 1 − t, complemented because the device is additive, whatever its alternate space and tint transform say (hayro drew it through the tint transform, so a `/DeviceCMYK` transform giving cyan drew registration marks light cyan); `/None` still paints nothing, any other name still goes through its alternate, and a DeviceN space naming `All` keeps its alternate, since the clause gives the name that meaning in a Separation space; (63) a luminosity soft mask whose group colour space is `/DeviceCMYK` (by name, not an ICC-based or calibrated space) reads a `/DeviceCMYK` fill or stroke colour drawn in it, and its `/BC`, as their gray `1 - min(1, 0.3 c + 0.59 m + 0.11 y + k)` (ISO 32000-2 §10.4.2.3, §11.5.3: device colour converts to gray with no colour calibration; `Context::luminosity_in_device_cmyk`, `color::device_cmyk_to_gray`): it went through the CMYK display profile, where 100% K is a dark grey, so a 100% K mask let about an eighth of the masked paint through. CMYK images, shadings and tiling patterns inside such a mask, and CMYK on the page, still use the profile; (73) `InterpreterSettings::jbig2_work`, set for each page in `interpret_page` and ended with it, and a JBIG2 image or an image with a JBIG2 mask past it left out with `ContentTruncated` | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts`, `raster::tests::comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`, `raster::tests::images_converted_through_a_table_keep_every_samples_colour`, `raster::tests::a_malformed_tint_for_an_unused_sample_keeps_the_used_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (30) `text::tests::the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space`; (31) `raster::tests::shadings_with_large_sampled_functions_paint_quickly`, `raster::tests::sampled_functions_interpolate_their_grid_as_before`; (32) `raster::tests::decoded_images_serve_every_size_they_are_drawn_at`; (33) `raster::tests::patch_meshes_keep_their_corner_colours`; (34) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`; (35) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (36) `raster::tests::mesh_triangles_sharing_an_edge_leave_no_seam`; (38) `raster::tests::default_colour_spaces::device_rgb_operators_draw_in_default_rgb`, `raster::tests::default_colour_spaces::device_cmyk_operators_draw_in_default_cmyk`, `raster::tests::default_colour_spaces::device_gray_operators_draw_in_default_gray`, `raster::tests::default_colour_spaces::device_images_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::device_shadings_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::an_image_drawn_with_and_without_a_default_keeps_both_colours`, `raster::tests::default_colour_spaces::forms_inherit_the_default_colour_spaces_they_do_not_override`, `raster::tests::default_colour_spaces::unusable_defaults_leave_device_colour_alone`; (39) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (40) `raster::tests::visibility_expressions_decide_what_a_membership_dictionary_shows`; (41) `raster::tests::a_multiply_highlight_inside_a_transparency_group_keeps_the_text`; (42) `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`; (43) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours`; (44) `text::tests::identity_to_unicode_names_give_text`; (46) `raster::tests::stencil_masks_are_drawn_at_the_fill_opacity_once`; (47) `raster::tests::a_five_point_polyline_is_not_painted_as_its_bounding_box`, `raster::tests::a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle`, `raster::tests::a_rectangle_is_still_painted_as_a_rectangle`; (48) `raster::tests::icc_profile_cache::icc_profiles_with_identical_dictionaries_draw_their_own_colours`, `raster::tests::icc_profile_cache::icc_profiles_used_again_are_read_once`; (49) `raster::tests::a_font_whose_post_version_has_swapped_halves_is_still_used`; (50) `font::blob::tests::glyph_names_resolve_to_the_first_glyph_with_that_name`; (51) `context::saved_state_tests::repeated_saves_stay_bounded_and_balanced`; (52) `font::cid::tests::w2_run_past_the_largest_cid_keeps_the_rest_of_the_table` (hayro-interpret); (55) `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_evaluated_draws_the_rest_of_the_page_and_warns`, `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_read_falls_back_and_warns`; (56) `raster::tests::invisible_unknown_annotations_and_popups_paint_nothing`; (57) `substitute_widths::a_substitute_keeps_its_glyph_shapes_at_wider_advances`, `substitute_widths::a_substitute_still_narrows_glyphs_to_narrower_advances` (pdfcraft-render `tests/it`); (58) `cid_fallback_query::a_cid_font_fallback_request_carries_its_descendants_style`, `cid_fallback_query::a_cid_font_without_a_descriptor_asks_for_the_default_style` (pdfcraft-render integration tests); (59) `raster::tests::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages` (hayro-interpret); (64) `type3_text_clip::{clip_only_type3_text_is_not_rendered_and_leaves_no_clip, invisible_type3_text_is_not_rendered, other_modes_render_type3_glyphs_filled_and_never_clip, only_outline_glyphs_shape_a_clip_shared_with_type3_text, self_nesting_type3_text_in_a_clip_mode_stays_bounded}` (`cargo test -p pdfcraft-render --test it`), `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`, `text::tests::clipping_mode_type3_text_is_kept_by_the_ocr_filter`; (66) `separation_all::{separation_all_fills_paint_the_complemented_tint_as_gray, separation_all_strokes_paint_the_complemented_tint_as_gray, separation_all_images_paint_each_sample_as_the_complemented_gray, separation_all_shadings_paint_the_complemented_gray, separation_none_paints_nothing, a_named_separation_still_paints_through_its_alternate, a_device_n_space_naming_all_still_paints_through_its_alternate}` (`cargo test -p pdfcraft-render --test it`); (63) `color::device_cmyk_gray_tests::{each_ink_darkens_by_its_iso_weight, ink_past_full_coverage_is_black_and_bad_components_read_as_zero}` (hayro-interpret), `it::luminosity_group_space::{black_ink_in_a_device_cmyk_group_masks_fully_and_no_ink_shows_fully, each_process_ink_in_a_device_cmyk_group_masks_by_its_weight, a_device_cmyk_backdrop_colour_masks_by_its_gray, gray_and_rgb_groups_mask_as_before, device_cmyk_on_the_page_keeps_its_display_colour}` (pdfcraft-render); (73) `raster::tests::the_jbig2_images_of_a_page_share_one_allowance`, `a_picture_whose_jbig2_mask_is_past_the_pages_allowance_is_not_drawn` and `a_pages_jbig2_allowance_ends_with_the_page` (pdfcraft-render) |
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour); (24) `DecodedImageCache`: decoded image pixels shared across renders through the interpreter cache within a 64 MiB budget (an image-heavy page decoded its thousands of images again per tile and per scale), keyed by every decode input (`DecodedImageKey`: the stream's place and dictionary bytes, its object, mask/stencil/raster output, interpolation, decode target size, preview or final); images under a transfer function and inline images are not cached, an image over the budget is never kept, and a poisoned lock decodes uncached; (25) `Device::actual_text` hands the device a marked content sequence's `/ActualText` (inline or named in `/Properties`), so text extraction keeps the Thai, Indic and Arabic clusters Chrome marks this way (their shaped tone marks and vowels have no Unicode of their own); (26) non-embedded simple fonts drawn with a standard-font stand-in build the Latin Extended-A letters the stand-in lacks (`/Gbreve`, `/Idotaccent`, `/Scedilla`, `/aogonek`, `/ccaron`…) from the base letter and accent it has (`StandardKind::composite_glyph`, `ACCENTED_LETTERS`): PDFium's Foxit stand-ins hold only the Standard/WinAnsi/Mac Roman glyphs, so iText letters with Times New Roman unembedded showed blanks for Ğ, İ, Ş, ğ and ş; the comma-below letters (`/scommaaccent`, `/Tcommaaccent`, `/kcommaaccent`…, found by character, so `/uni0136` and the glyph list's `/Kcedilla` too) are the letter and the font's comma, smaller and under the baseline, since the stand-ins have no `commaaccent` (Romanian ș drew nothing and ț a cedilla in forms laid out from XFA; ģ, whose comma is turned and above, is not built); (27) an embedded TrueType font without a base encoding reads its codes as WinAnsi for text extraction (`EmbeddedKind::code_to_unicode_name`), matching pdftotext's output, instead of Standard: OCR text layers of scans write WinAnsi codes with no `/Encoding`, and Standard has no ü, ö or ß and reads é as Ø (glyph selection unchanged); (28) an image whose pixels hold at most 16 bits of samples (an 8-bit Separation or DeviceN image, a 1-, 2- or 4-bit gray or indexed one) is converted once per possible pixel value through a lookup table instead of once per pixel (`rgb_via_lookup`): a spot-colour tint transform is often a PostScript calculator program, run for every pixel, so a fillable character sheet's 3304 × 4105 DeviceN background took four seconds and 430 MB to draw a page; each entry is converted on its own (`convert_each`), so a tint transform giving the wrong number of components for a value the image never uses cannot shift the colours of the values it does; (29) `Device::begin_annotations`/`end_annotations` bracket the page's annotations, so a device can tell comment paints from document paints (reading colours recolour the document, never a comment, #1548); (30) the Annex D.2 alias codes read as the ink they draw: WinAnsiEncoding 0xA0 and 0xAD, and MacRomanEncoding 0xCA, carry the glyph names `space` and `hyphen` -- the names those tables also give 0x20 and 0x2D -- not `nbspace` and `sfthyphen`, whose glyph list values U+00A0 and U+00AD are invisible formatting characters. Extraction hid drawn ink behind them, so search and redaction matched neither (`XiaoBiaoSong.pdf` in the pdf.js corpus drew 104 soft hyphens; across the 989 files the soft hyphens we extract fall from 117 to 13 and the non-breaking spaces from 30 to 26, what remains coming from `/ToUnicode` maps, which say so explicitly). The base table only, in the text direction only: a `/Differences` name keeps its glyph list value and glyph lookup is untouched, both as pdftotext does; (31) a Type 0 sampled function keeps its samples in one flat array indexed by strides (`Type0::entry`) instead of a hash map keyed by each grid point: the map was built again, one hashed insert per sample, every time a shading using the function was painted (a 2,097,152-sample ramp painted 30 times took 38 s; `bug1721218` in the pdf.js corpus spent most of a 1.5 s page on it); the interpolation is unchanged, so results are bit for bit the same, a sample missing from a short stream still gives no value, and the maximum sample value is computed without overflowing at 32 bits per sample; (32) the decoded-image cache (24) keys a decode by the size the image is drawn at only when a JPX stream decodes it or its soft mask or mask (`decode_reads_target`): JPX is the only filter that decodes a reduced resolution for a size, so a JPEG or Flate scan was decoded again at every zoom step and kept once per zoom level; one decode now serves every size; `InterpreterCache::decoded_image_decodes` counts the cache's decodes; (33) Coons and tensor-product patches copy their vertices' colours less: each point of a patch's 20 × 20 triangle grid is interpolated once (`generate_patch_triangles`; each cell interpolated its four corners itself, 1,444 interpolations a patch for 400 points), a cell's second triangle takes the vertices its first copied, and the mesh sampler moves a patch's triangles into device space instead of copying each vertex (`TriangleSampler::sample_owned`); the same values, 10–16% faster on mesh-gradient pages; (34) `color::tint_transform_runs`: how many colours the calling thread has run through a Separation or DeviceN tint transform (counted once per batch in `convert_f32`), so a test counts patch (28)'s once-per-sample-value runs instead of timing them (its 10 s deadline failed on a busy FreeBSD VM in CI); (35) `EncodedShadingPattern::extent`: where a mesh shading (types 4–7) can paint at all, the pixels its triangles touched when it was encoded (`None` for the types that paint everywhere, and when the shading has a `/Background`), so the renderer samples a texture there alone and skips a mesh with nothing on the canvas; (36) a mesh shading's pixel whose corner no triangle holds strictly (on an edge two triangles share, or on the mesh's side) takes the triangle that covers its centre, edges included (`Triangle::covers`): testing only the corner left a white seam along every shared edge, and the colour is still taken at the corner; (38) the `/DefaultGray`, `/DefaultRGB` and `/DefaultCMYK` colour spaces of a resource dictionary (ISO 32000-2 §8.6.5.6) replace the device space content selects: with `g`/`G`, `rg`/`RG`, `k`/`K` and `cs`/`CS` (by name, or through a `/ColorSpace` resource that is a device space), and as the `/ColorSpace` of an image XObject, an inline image or a shading painted by `sh` or as a shading pattern (`DefaultColorSpaces`, looked up once per content window in the resources and those they inherit, so a form XObject without a default of its own draws in its page's, as Poppler and MuPDF draw it); a default that is a Lab, Indexed, Pattern or device space, has another number of components or is no colour space is ignored and device colour is drawn as before; device spaces inside other spaces (an Indexed base, a Separation or DeviceN alternate, a Pattern's underlying space), shading dictionaries, masks and transparency group spaces are unchanged, and the decoded-image cache (24) keys a decode by the default it was drawn in. hayro drew device colour as it was, so pages that calibrate it this way (common in PDF/A) came out in the wrong colours; (39) knockout groups (#2971): `Device::set_knockout` right after a `/K true` group is pushed; `Device::knockout_image` for an unmasked image before its group is pushed, when `Device::in_knockout_group`: the device clears its placement rectangle only if it will draw the image (on the canvas, not a preview's tiny image, and it decodes), decoded at its draw size so the draw reuses that decode; and, when `Device::knockout_erase_wanted`, a nested group's content drawn once between `begin_knockout_erase` and `end_knockout_erase` before the group itself, which then always gets a layer of its own; (40) an optional content membership dictionary's visibility expression (`/VE`: `/And`, `/Or`, `/Not`, nested up to 32 deep) decides its visibility ahead of `/OCGs` and `/P` (ISO 32000-2 §8.11.2.2); it was ignored, so content under it stayed visible with its layers hidden; a malformed expression, including one naming an object the document doesn't list in `/OCProperties /OCGs`, falls back to `/OCGs` and `/P` (#2986); (41) a transparency group that is neither isolated nor knockout, entered at full opacity with no soft mask and Normal blending, is drawn straight onto the page instead of into a layer of its own (§11.4.7: its elements composite with the backdrop; the layer made a `/BM /Multiply` highlight appearance an opaque block, #1968); (42) text in a Type 3 font is drawn filled whatever the text rendering mode, except mode 3 (invisible): only that mode has any effect on Type 3 fonts (ISO 32000-1 §9.3.6). Stroking ran the glyph procedure a second time, so `2 Tr` made bitmap fonts look bold, `1 Tr` painted an uncoloured glyph in the stroking colour, and `7 Tr` hid it (`7 Tr` since follows 64); (43) Lab colour spaces honour their own `/WhitePoint`: L\*a\*b\* goes to XYZ relative to that white, is Bradford-adapted to D65 and converted to sRGB (ISO 32000-2 §8.6.5.4) instead of through `LAB.icc` as if every white were D50 (a D65 blue came out 45 levels too red; the profile is removed); components normalised to [0, 1] (`manual_scale`, an `/Indexed` palette over Lab) map onto L\* 0..100 and the a\*/b\* `/Range`; (44) a Type 0 font whose `/ToUnicode` is the name `/Identity-H` or `/Identity-V` (not a CMap stream; WSCAD writes it) reads each code as its Unicode value, as Acrobat shows it (`Type0Font::identity_to_unicode`); the identity CMap the name resolved to maps codes to CIDs only, so such pages had no text to select or find; (46) an image XObject's group applies the fill opacity, so the fill alpha is reset to 1 before a stencil mask takes the fill colour as its paint, and a pattern paint drops the opacity it captured at `scn` (`Pattern::without_opacity`) (it was applied twice: a mask at `ca 0.5` was drawn at a quarter, #2975); (47) `path_as_rect`: a five-element path is a rectangle only when its four points are distinct, each step from one to the next runs along a single axis, and the last returns to the first. The length test admits one MoveTo and four LineTo as well as one MoveTo, three LineTo and a ClosePath, and asking only that every corner of the bounding box was visited says nothing about the order or the steps between, so a five-point polyline whose ends reached the corners was painted as that box -- a fourth side the path does not have -- and a clip of that shape was discarded; the coordinates are compared exactly, since the matrix is applied after this check and a `cm` of 10,000 turns `is_nearly_equal`'s 256th of a unit into tens of device units (#3327); (48) an `/ICCBased` colour space is cached by what its profile is read from (`IccProfileKey`): the stream object it names, looked up without reading the stream, and then the stream's dictionary and its own bytes (decrypted, not decoded), so a byte-for-byte copy of a profile in another object is read once, and a profile stream written directly in its array, which reports the object holding the array as every other stream written there does, is told apart by its bytes. hayro keyed it by the stream dictionary's bytes alone, so two different profiles with the same `/N` and `/Length` shared whichever was read first, and colours in the second were drawn through the first. `InterpreterCache::icc_profile_reads` counts the profiles read; (49) `OpenTypeFontBlob::new` also accepts a `post` table version 1.0, 2.0 or 3.0 written with its 16-bit halves swapped (`00 00 00 03`), as ScanSoft PDF Create! embeds every font; such fonts were refused and their text drawn with a substitute (Hebrew came out garbled or missing, #2946); `glyph_names` reads such a table from a copy with the version written correctly, so a 2.0 table's names serve `/Differences`. Any other unknown version is still refused (pdf.js 9462); (50) `CffFontBlob::glyph_index_by_name` looks a glyph name up in a name to glyph map built on first use (shared between clones) instead of searching the whole charset, with a string lookup per glyph, for every character code of a font; the first glyph with a name still wins; (51) at most 4096 graphics states saved at once, holding at most 64 MiB together (each `q` copies the whole state, dash array and clip list included, so short operators multiplied one large state); a `q` past either limit is counted but not copied, and its `Q` still removes the clips added since (from storytold/craft-libs#239); (52) a `/W2` run whose first CID is past `MAX_CID` stops there, as in `/W` (7), checked before the run's metrics are read: a first CID of 4294967295 inserted one entry and then overflowed, discarding the whole `/W2` table (from storytold/craft-libs#254); (55) a Separation or DeviceN tint transform that cannot be read keeps its colour space, and one that cannot be read or evaluated paints the alternate space's initial colour, as evaluation failures already did; that fallback, and a `cs`/`CS` colour space that cannot be read (drawn in DeviceGray as before), are now reported once per content stream as `InterpreterWarning::ColorFallback` (`RenderWarning::ColourFallback` in `pdfcraft-render`) instead of silently (#4260); (56) an annotation whose Invisible flag (bit 1) is set and whose `/Subtype` is none of the standard types of ISO 32000-2 Table 171 (`is_standard_annotation_type`; no `/Subtype` counts as unknown) is not drawn (Table 167), and a `/Popup` annotation's appearance is never painted on the page (§12.5.6.14: a popup has no appearance stream of its own; the viewer shows it as a window for its parent annotation). Both were drawn from their `/AP`; (57) a simple font drawn with a standard-font stand-in because the document names a font it doesn't embed (`StandardKind` with `fallback`) narrows a glyph to a narrower `/Widths` advance but no longer widens it to a wider one: the advance already places the next glyph (ISO 32000-2 §9.2.4; /Widths in Table 109), and widening drew a non-embedded `Arial,Bold` with 600-unit widths as a heavy fixed-pitch face whose `i` and `l` were solid blocks twice their width; an exact standard-14 font still matches its standard metrics both ways; (58) the fallback request for a Type 0 font that is not embedded (`FallbackFontQuery::with_descriptor`) takes its serif, italic and small-cap flags, `/FontWeight`, `/FontFamily` and `/FontStretch` from the descendant CIDFont's font descriptor (ISO 32000-2 §9.7.4.1, §9.7.6.1; §9.8): it read them from the Type 0 dictionary, which has none, so every such request asked for a regular sans-serif face and no resolver could tell a Song or Mincho font from a Hei or Gothic one, or see `/FontWeight 700`; (59) the NoRotate flag (`/F` bit 5) is honoured: the appearance, fitted to `/Rect`, is turned against the page's `/Rotate` about the rectangle's upper-left corner, which stays where it is, so it reads upright as the page is displayed (ISO 32000-2 §12.5.3). Sticky notes, which are saved NoRotate, were drawn turned with the page (#2583). Form fields and links stay in `/Rect`, where PdfCraft takes their click targets from it; (63) a luminosity soft mask whose group colour space is `/DeviceCMYK` (by name, not an ICC-based or calibrated space) reads a `/DeviceCMYK` fill or stroke colour drawn in it, and its `/BC`, as their gray `1 - min(1, 0.3 c + 0.59 m + 0.11 y + k)` (ISO 32000-2 §10.4.2.3, §11.5.3: device colour converts to gray with no colour calibration; `Context::luminosity_in_device_cmyk`, `color::device_cmyk_to_gray`): it went through the CMYK display profile, where 100% K is a dark grey, so a 100% K mask let about an eighth of the masked paint through. CMYK images, shadings and tiling patterns inside such a mask, and CMYK on the page, still use the profile; (64) text in a Type 3 font follows ISO 32000-2 §9.3.6 in the clipping modes: under `7 Tr` it is not rendered (reported to the device as clipping text, `GlyphDrawMode::Clip`, so extraction keeps it), and in modes 4 to 7 a Type 3 glyph adds nothing to the clipping path (`clip_glyph`), so text shown only in a Type 3 font leaves no clip at `ET`. Since (42) `7 Tr` painted the glyphs in the fill colour (black by default), so a fill meant to follow showed them wherever it didn't cover them; 4 to 6 still render filled; (66) a Separation colour space whose colourant is the special name `All` paints every colourant at once (ISO 32000-2 §8.6.6.4): on screen and in an RGB print raster its tint t is the gray 1 − t, complemented because the device is additive, whatever its alternate space and tint transform say (hayro drew it through the tint transform, so a `/DeviceCMYK` transform giving cyan drew registration marks light cyan); `/None` still paints nothing, any other name still goes through its alternate, and a DeviceN space naming `All` keeps its alternate, since the clause gives the name that meaning in a Separation space; (71) a lookup table in an indirect string reads: it was read as a stream first, which uses up a reference (ISO 32000-2 §8.6.6.3); (72) an uncoloured pattern's underlying space given as a name or a reference is used: it was skipped, so a CMYK cyan drew red (ISO 32000-2 §8.7.3.3); (73) `InterpreterSettings::jbig2_work`, set for each page in `interpret_page` and ended with it, and a JBIG2 image or an image with a JBIG2 mask past it left out with `ContentTruncated`; (74) colour spaces nest at most 32 levels, through every way one names another, so a chain of them ends instead of overflowing the stack; an ICC profile's `/Alternate` is read where it's met and isn't kept with the profile, or a page could build a chain past the limit on spaces already read | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs`; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (24) `raster::tests::tiles_match_full_render`, `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` (both decode through the cache), `raster::tests::decoded_images_with_identical_dictionaries_keep_their_own_pixels`, `raster::tests::decoded_images_under_a_transfer_function_are_not_shared`; (25) `text::tests::actual_text_replaces_the_glyphs_it_marks_in_every_writing_direction`, `text::tests::actual_text_follows_the_pdf_rules_for_marked_content`; (26) `raster::tests::accented_letters_the_standard_stand_ins_lack_are_built_from_their_parts`, `raster::tests::comma_below_letters_in_standard_fonts_draw_a_comma_under_the_letter`; (27) `text::tests::truetype_without_an_encoding_reads_its_codes_as_win_ansi`; (28) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`, `raster::tests::images_converted_through_a_table_keep_every_samples_colour`, `raster::tests::a_malformed_tint_for_an_unused_sample_keeps_the_used_colours`; (29) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (30) `text::tests::the_annex_d2_alias_codes_read_as_an_ordinary_hyphen_and_space`; (31) `raster::tests::shadings_with_large_sampled_functions_paint_quickly`, `raster::tests::sampled_functions_interpolate_their_grid_as_before`; (32) `raster::tests::decoded_images_serve_every_size_they_are_drawn_at`; (33) `raster::tests::patch_meshes_keep_their_corner_colours`; (34) `raster::tests::spot_colour_images_run_their_tint_transform_once_per_sample_value`; (35) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (36) `raster::tests::mesh_triangles_sharing_an_edge_leave_no_seam`; (38) `raster::tests::default_colour_spaces::device_rgb_operators_draw_in_default_rgb`, `raster::tests::default_colour_spaces::device_cmyk_operators_draw_in_default_cmyk`, `raster::tests::default_colour_spaces::device_gray_operators_draw_in_default_gray`, `raster::tests::default_colour_spaces::device_images_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::device_shadings_draw_in_the_default_colour_spaces`, `raster::tests::default_colour_spaces::an_image_drawn_with_and_without_a_default_keeps_both_colours`, `raster::tests::default_colour_spaces::forms_inherit_the_default_colour_spaces_they_do_not_override`, `raster::tests::default_colour_spaces::unusable_defaults_leave_device_colour_alone`; (39) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (40) `raster::tests::visibility_expressions_decide_what_a_membership_dictionary_shows`; (41) `raster::tests::a_multiply_highlight_inside_a_transparency_group_keeps_the_text`; (42) `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`; (43) `raster::tests::lab_honours_the_space_white_point`, `raster::tests::indexed_palettes_over_lab_keep_their_colours`; (44) `text::tests::identity_to_unicode_names_give_text`; (46) `raster::tests::stencil_masks_are_drawn_at_the_fill_opacity_once`; (47) `raster::tests::a_five_point_polyline_is_not_painted_as_its_bounding_box`, `raster::tests::a_path_that_visits_every_corner_out_of_order_is_not_a_rectangle`, `raster::tests::a_rectangle_is_still_painted_as_a_rectangle`; (48) `raster::tests::icc_profile_cache::icc_profiles_with_identical_dictionaries_draw_their_own_colours`, `raster::tests::icc_profile_cache::icc_profiles_used_again_are_read_once`; (49) `raster::tests::a_font_whose_post_version_has_swapped_halves_is_still_used`; (50) `font::blob::tests::glyph_names_resolve_to_the_first_glyph_with_that_name`; (51) `context::saved_state_tests::repeated_saves_stay_bounded_and_balanced`; (52) `font::cid::tests::w2_run_past_the_largest_cid_keeps_the_rest_of_the_table` (hayro-interpret); (55) `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_evaluated_draws_the_rest_of_the_page_and_warns`, `raster::tests::devicen_inks::a_tint_transform_that_cannot_be_read_falls_back_and_warns`; (56) `raster::tests::invisible_unknown_annotations_and_popups_paint_nothing`; (57) `substitute_widths::a_substitute_keeps_its_glyph_shapes_at_wider_advances`, `substitute_widths::a_substitute_still_narrows_glyphs_to_narrower_advances` (pdfcraft-render `tests/it`); (58) `cid_fallback_query::a_cid_font_fallback_request_carries_its_descendants_style`, `cid_fallback_query::a_cid_font_without_a_descriptor_asks_for_the_default_style` (pdfcraft-render integration tests); (59) `raster::tests::no_rotate_notes_stay_upright_at_their_corner_on_rotated_pages` (hayro-interpret); (63) `color::device_cmyk_gray_tests::{each_ink_darkens_by_its_iso_weight, ink_past_full_coverage_is_black_and_bad_components_read_as_zero}` (hayro-interpret), `it::luminosity_group_space::{black_ink_in_a_device_cmyk_group_masks_fully_and_no_ink_shows_fully, each_process_ink_in_a_device_cmyk_group_masks_by_its_weight, a_device_cmyk_backdrop_colour_masks_by_its_gray, gray_and_rgb_groups_mask_as_before, device_cmyk_on_the_page_keeps_its_display_colour}` (pdfcraft-render); (64) `type3_text_clip::{clip_only_type3_text_is_not_rendered_and_leaves_no_clip, invisible_type3_text_is_not_rendered, other_modes_render_type3_glyphs_filled_and_never_clip, only_outline_glyphs_shape_a_clip_shared_with_type3_text, self_nesting_type3_text_in_a_clip_mode_stays_bounded}` (`cargo test -p pdfcraft-render --test it`), `raster::tests::rendering_modes_but_3_and_7_draw_type3_glyphs_as_filled`, `text::tests::clipping_mode_type3_text_is_kept_by_the_ocr_filter`; (66) `separation_all::{separation_all_fills_paint_the_complemented_tint_as_gray, separation_all_strokes_paint_the_complemented_tint_as_gray, separation_all_images_paint_each_sample_as_the_complemented_gray, separation_all_shadings_paint_the_complemented_gray, separation_none_paints_nothing, a_named_separation_still_paints_through_its_alternate, a_device_n_space_naming_all_still_paints_through_its_alternate}` (`cargo test -p pdfcraft-render --test it`); (71) `raster::tests::an_indexed_lookup_table_is_read_in_every_legal_form` (pdfcraft-render); (72) `raster::tests::an_uncoloured_pattern_uses_its_underlying_space_in_every_form` (pdfcraft-render); (73) `raster::tests::the_jbig2_images_of_a_page_share_one_allowance`, `a_picture_whose_jbig2_mask_is_past_the_pages_allowance_is_not_drawn` and `a_pages_jbig2_allowance_ends_with_the_page` (pdfcraft-render); (74) `raster::tests::{a_chain_of_colour_spaces_ends, colour_spaces_are_read_to_the_limit_of_their_nesting, a_chain_built_on_spaces_already_read_ends, a_profile_read_at_the_limit_keeps_its_alternate_for_a_read_nearer_the_top}` (pdfcraft-render) |
 | hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) `/Interpolate` governs the pre-resize too (#624): a minified image that does not request interpolation is pre-resized with nearest-neighbour, planned without the Catmull-Rom filter limits (`image_resampling_size` takes the flag); a Type 3 glyph image is sampled bicubically only when interpolated; a minified image with a matching soft mask is nearest-sampled straight into premultiplied RGBA; (11) `may_paint_rect`: an image whose stream-size box, mapped to the device, misses the canvas is skipped before decoding (decoded data can only shrink against that box), so a tile of an image-heavy page no longer decodes, resamples and rasterizes every image on it; (12) preview renders (`InterpreterSettings::preview`: backdrops, thumbnails, grid cells, signature-drag backgrounds) skip images under `PREVIEW_MIN_IMAGE_AREA` device pixels, while final renders always draw them; (13) reading colours (#897): `RenderSettings::color_replacement` takes a `ColorReplacement` (text colour, background, `only_black`, `line_art`) that remaps solid text and line-art paint while rendering, glyph outlines counting as text and stencil-mask ink as line art; images, image alpha masks, soft masks and pattern cells keep their colours; `render_pdf` gains a `color_replacement: Option<ColorReplacement>` argument (pass `None` for true colours); the upstream-only `[dev-dependencies.log]` entry is removed from `Cargo.toml` (log is a normal dependency since the logging patch), so `cargo test -p hayro` runs this crate's unit tests; (14) a shrunk, interpolated, axis-aligned image is snapped to whole device pixels: shrunk once to its rounded device rectangle and drawn 1:1 at the rounded corner, instead of a ceil-sized raster resampled again at a fractional scale and offset (`snap_minified_image`; scans looked soft next to Acrobat); (15) a soft mask of another size than its image is filtered when shrunk, whatever its `/Interpolate` (#1649): such a mask carries the shape on its own (Word saves text as a tiny black image with a glyph-bitmap mask), and nearest-neighbour dropped every stroke thinner than the shrink factor; (16) under a soft mask or a blend mode, axial and radial shadings are sampled instead of drawn as native gradients (#2128): vello_cpu 0.0.8 copies an opaque gradient over fully covered tiles without the mask or blend mode, so PowerPoint's faded gradient fills came out solid; (17) the renderer keeps annotation paints out of the reading-colours mapping between `begin_annotations` and `end_annotations` (#1548); (18) the page renders as one transparency group; under reading colours its background is painted inside it as the initial backdrop, so a Multiply highlight blends with the dark background instead of staying an opaque block, and otherwise the background stays outside, so a blend mode over an empty part of the page keeps its colour instead of blending with the white paper (#2970); (19) `set_paint` samples a mesh shading's texture over its triangles alone (`EncodedShadingPattern::extent`, padded rather than repeated) and skips a mesh with none on the canvas: a BricsCAD plan's 310 one-triangle `sh` each covered the whole tile, 2 s per 1024 px tile at any zoom (the watchdog gave the page up on a busy machine), now about 70 ms; (20) a tiling pattern whose step is too large for a cell pixmap, where what is painted (a fill, or a stroke with its width) can only show the first cell (PowerPoint's `/XStep 2147480100` for a picture fill drawn once), has its `/BBox` drawn at full scale with a transparent border and padded instead of tiled (`shows_one_cell`; a cell whose scale isn't finite and positive, from a `/BBox` too thin to divide by, keeps the old path: `usable_cell_scale`); shrinking the cell to fit the 3000 px limit of (3) left the picture under a pixel, so network diagrams lost their pictures (#3349); (22) knockout groups: while one is innermost, fills, strokes, glyph outlines and shadings are drawn with `Compose::Copy` (weighted by coverage), so each element replaces what earlier elements of the group drew instead of compositing over it; an image or nested group, drawn into a layer of its own, first has what is under its shape cleared (`knockout_image` for an unmasked image's rectangle, only when `draw_image` will draw it, decoded at the size it is drawn; a knockout erase pass that draws a nested group's content with every paint clearing instead of painting, a shading fill's clear clipped to the shading's `/BBox` as its paint is) and then composites over it (#2971); (23) backport of hayro 0.8: shadings that `as_svg_gradient` can represent are painted as a `vello_cpu` linear or two-point radial gradient instead of a texture sampled pixel by pixel through the shading function (InDesign fades are luminosity soft masks of one full-page axial `sh`: 40 on a report page took 15 s at 144 dpi, now under 1 s); without upstream's half-pixel shift, which suits vello_cpu 0.3 but moves 0.0.8's gradients off pixel centres; (25) a tiling cell is drawn at the scale that makes one `/XStep` (`/YStep`) exactly the cell pixmap's whole number of pixels (`tiling_cell_pixels`, at least 1 and at most the cap), so the repeated pixmap puts cells at whole multiples of the step at any device scale; drawing at the unrounded scale repeated the cell up to half a pixel off at every step, and the error grew with distance from the pattern's origin (ISO 32000-2 8.7.3.1) | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::non_interpolated_images_are_not_smoothed_when_minified`, `raster::tests::non_interpolated_gray_images_are_not_smoothed_when_minified`, `raster::tests::non_integer_minification_samples_the_same_columns`, `raster::tests::non_integer_minification_samples_colour_and_mask_from_the_same_columns`, `raster::tests::non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified`, `raster::tests::non_interpolated_type3_glyph_images_are_not_smoothed_when_minified`, `raster::tests::image_resampling_nearest_accepts_wide_sources_the_filter_refuses`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking`; (11) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (12) `raster::tests::preview_renders_skip_tiny_images_but_finals_draw_everything`; (13) `color_replacement_tests::{black_maps_to_text_colour, white_maps_to_background, midgrey_interpolates, alpha_copied_verbatim, only_black_threshold, line_art_false_skips_paths_but_not_text}`, `color_replacement_render_tests::{color_replacement_maps_text_and_line_art, color_replacement_maps_stencil_mask_ink}`; (14) `raster::tests::interpolated_minified_image_edges_snap_to_whole_pixels` (`cargo test -p hayro`); (15) `raster::tests::shrunk_soft_mask_larger_than_its_image_keeps_thin_strokes`; (16) `raster::tests::soft_mask_applies_to_a_shading_pattern_fill`; (17), (18) `raster::tests::reading_colors_keep_highlight_annotations_readable`; (19) `mesh_extent_tests::{a_mesh_paints_its_triangles_alone, a_mesh_keeps_the_graphics_state_alpha, a_mesh_off_the_canvas_paints_nothing}` (`cargo test -p hayro`); (20) `raster::tests::a_tiling_pattern_drawn_once_shows_its_cell`, `raster::tests::a_large_step_still_tiles_where_the_next_cell_shows`, `raster::tests::a_tiling_cell_too_thin_to_scale_keeps_the_old_path`; (22) `raster::tests::knockout_groups_replace_what_their_elements_cover`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`; (25) `tiling_cell_placement::{far_cells_of_a_fill_sit_at_whole_steps, far_cells_sit_at_whole_steps_under_a_turned_scaled_matrix, far_cells_of_a_stroke_sit_at_whole_steps, a_cell_pixmap_spans_exactly_one_step}` (`cargo test -p pdfcraft-render --test it`) |
-| hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap and page bitmap, and 2^25 cells per halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one, and a 4-byte value per cell); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer); (4) a segment header's long-form referred-to segment count is capped at `u16::MAX` and a larger count is refused before its retention or referred-to bytes are read: the 29-bit count went straight to `Vec::with_capacity`, a reservation of about 2 GiB whose failure aborts the process (from storytold/craft-libs#176); (5) what a page's segments hold for later ones (intermediate regions, pattern and symbol dictionaries with their headers and retained contexts, and Huffman tables) is at most 64 MiB, two square bitmaps of 16,384 a side (`MAX_RETAINED_WORDS`), and a dictionary's new and exported symbols are counted against it as they are made: each was bounded on its own, but a few dozen bytes an intermediate region held 33 MB each, and 8 MiB symbols exported again and again killed the process, so a few kilobytes could exhaust memory; (6) a segment may refer to at most 2^20 symbols, checked before any are collected: references may repeat, and 65,535 of them to one dictionary, in a 78 KB stream, asked for 17 GB; (7) a pattern dictionary keeps at most 16 MiB of shifted copies, which only speed up drawing, and none that wouldn't fit what the page has left (`MAX_SHIFTED_WORDS`); (8) a custom Huffman table has at most 2^16 lines, and a stream with its globals at most 2^20 segments and 2^22 references, checked as they are read: both grew before anything counted them, and PDFs of a kilobyte or so reached 5 GB and more behind nested Flate; (9) a page past the bounds of (1) is refused when the stream is opened: a caller sizes its output from the header before the page bitmap is made, and an Indexed image in a 743-byte PDF asked for 137 GB, which aborts; (10) a stream may ask for at most 2^30 units of decoding work, four of the largest pages, about 6 s to 17 s (`MAX_WORK`): decoding a bitmap costs a pixel each and 4 a row, copying one a word each and 1 a row, and each integer an item reads costs 38, what one takes at worst, so one with no pixels pays too, before it is decoded: each bitmap was bounded, but nothing bounded how many there were, and a 795-byte PDF took 265 s; (11) `Image::decode_within` spends from what a run of images may still do, starting with its page's pixels, and `charge_reading` charges reading a stream and its globals before anything is parsed, so an operation over a document can bound what `MAX_WORK` bounds for one image, and images that fail or decode nothing add up too: a file of thousands of images made to reach that limit took as many times as long | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`, `raster::tests::jbig2_halftone_grids_past_their_bound_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate`; (4) `segment::tests::test_referred_to_count_is_capped` (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`); (5) `raster::tests::jbig2_regions_held_past_a_pages_bound_are_refused`, `jbig2_symbols_without_pixels_count_towards_a_pages_bound`, `jbig2_retained_contexts_count_towards_a_pages_bound`, `jbig2_huffman_tables_count_towards_a_pages_bound`, `jbig2_new_symbols_count_towards_a_pages_bound`, `jbig2_new_symbols_are_held_to_what_a_page_has_left`, `jbig2_pattern_dictionaries_count_towards_a_pages_bound`, and in the crate (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`) `decode::symbol::tests::exported_symbols_are_counted_before_they_are_copied`, `tests::the_room_left_shrinks_as_segments_are_stored`; (6) `raster::tests::jbig2_segments_referring_to_too_many_symbols_are_refused`; (7) `raster::tests::jbig2_pattern_dictionaries_too_large_to_shift_still_draw`, `jbig2_shifted_patterns_never_refuse_an_image`; (8) `raster::tests::jbig2_huffman_tables_of_too_many_lines_are_refused`, `jbig2_streams_of_too_many_segments_are_refused`, `jbig2_streams_of_too_many_references_are_refused`, and in the crate `tests::the_segments_of_a_stream_and_its_globals_count_together`; (9) `raster::tests::jbig2_pages_past_the_bounds_are_refused_before_anything_is_sized_from_them`, `tests::a_page_past_the_bounds_is_refused_when_opened`; (10) `raster::tests::jbig2_decoding_work_is_counted_item_by_item`; (11) `jbig2::decode::tests::a_run_of_images_spends_its_allowance_down_to_the_step` (pdfcraft-filters) |
+| hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap and page bitmap, and 2^25 cells per halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one, and a 4-byte value per cell); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer); (4) a segment header's long-form referred-to segment count is capped at `u16::MAX` and a larger count is refused before its retention or referred-to bytes are read: the 29-bit count went straight to `Vec::with_capacity`, a reservation of about 2 GiB whose failure aborts the process (from storytold/craft-libs#176); (5) what a page's segments hold for later ones (intermediate regions, pattern and symbol dictionaries with their headers and retained contexts, and Huffman tables) is at most 64 MiB, two square bitmaps of 16,384 a side (`MAX_RETAINED_WORDS`), and a dictionary's new and exported symbols are counted against it as they are made: each was bounded on its own, but a few dozen bytes an intermediate region held 33 MB each, and 8 MiB symbols exported again and again killed the process, so a few kilobytes could exhaust memory; (6) a segment may refer to at most 2^20 symbols, checked before any are collected: references may repeat, and 65,535 of them to one dictionary, in a 78 KB stream, asked for 17 GB; (7) a pattern dictionary keeps at most 16 MiB of shifted copies, which only speed up drawing, and none that wouldn't fit what the page has left (`MAX_SHIFTED_WORDS`); (8) a custom Huffman table has at most 2^16 lines, and a stream with its globals at most 2^20 segments and 2^22 references, checked as they are read: both grew before anything counted them, and PDFs of a kilobyte or so reached 5 GB and more behind nested Flate; (9) a page past the bounds of (1) is refused when the stream is opened: a caller sizes its output from the header before the page bitmap is made, and an Indexed image in a 743-byte PDF asked for 137 GB, which aborts; (10) a stream may ask for at most 2^30 units of decoding work, four of the largest pages, about 6 s to 17 s (`MAX_WORK`): decoding a bitmap costs a pixel each and 4 a row, copying one a word each and 1 a row, and each integer an item reads costs 38, what one takes at worst, so one with no pixels pays too, before it is decoded: each bitmap was bounded, but nothing bounded how many there were, and a 795-byte PDF took 265 s; (11) `Image::decode_within` spends from what a run of images may still do, starting with its page's pixels, and `charge_reading` charges reading a stream and its globals before anything is parsed, so an operation over a document can bound what `MAX_WORK` bounds for one image, and images that fail or decode nothing add up too: a file of thousands of images made to reach that limit took as many times as long; (12) adding to a location, a reference offset, a symbol's corner or a Huffman range line near the end of an `i32`, and negating a decoded integer of 2^31, overflowed: a panic wherever overflow is checked. The refinement context, a text region's corners, the integer decoder and the Huffman table wrap, as a release build did, and `Bitmap::combine` saturates, which comes to the same, as a location that overflows is past the end of any page. What is drawn doesn't change | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`, `raster::tests::jbig2_halftone_grids_past_their_bound_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate`; (4) `segment::tests::test_referred_to_count_is_capped` (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`); (5) `raster::tests::jbig2_regions_held_past_a_pages_bound_are_refused`, `jbig2_symbols_without_pixels_count_towards_a_pages_bound`, `jbig2_retained_contexts_count_towards_a_pages_bound`, `jbig2_huffman_tables_count_towards_a_pages_bound`, `jbig2_new_symbols_count_towards_a_pages_bound`, `jbig2_new_symbols_are_held_to_what_a_page_has_left`, `jbig2_pattern_dictionaries_count_towards_a_pages_bound`, and in the crate (`cargo test --manifest-path vendor/hayro-jbig2/Cargo.toml`) `decode::symbol::tests::exported_symbols_are_counted_before_they_are_copied`, `tests::the_room_left_shrinks_as_segments_are_stored`; (6) `raster::tests::jbig2_segments_referring_to_too_many_symbols_are_refused`; (7) `raster::tests::jbig2_pattern_dictionaries_too_large_to_shift_still_draw`, `jbig2_shifted_patterns_never_refuse_an_image`; (8) `raster::tests::jbig2_huffman_tables_of_too_many_lines_are_refused`, `jbig2_streams_of_too_many_segments_are_refused`, `jbig2_streams_of_too_many_references_are_refused`, and in the crate `tests::the_segments_of_a_stream_and_its_globals_count_together`; (9) `raster::tests::jbig2_pages_past_the_bounds_are_refused_before_anything_is_sized_from_them`, `tests::a_page_past_the_bounds_is_refused_when_opened`; (10) `raster::tests::jbig2_decoding_work_is_counted_item_by_item`; (11) `jbig2::decode::tests::a_run_of_images_spends_its_allowance_down_to_the_step` (pdfcraft-filters); (12) `raster::tests::jbig2_placements_at_the_end_of_an_i32_draw_nothing` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589); (4) the object lookup keeps its cycle history through compressed objects, requires an ordinary in-file container, and caps the chain of indirect lookups at 16 (a chain of new objects, each a `/Length` compressed in a container whose own `/Length` names the next, or a stream whose `/Length` names the next stream, overflowed the stack: a dev build's 2 MiB thread within 800 hops); (5) object-stream members are parsed within their own extent (up to the next distinct offset), an entry whose offset repeats an earlier entry's is skipped (so a repeated object number can resolve to its earlier entry), and offsets are processed in index order; (6) `find_latest_trailer`: a rebuild takes a `/Type /XRef` stream dictionary as the trailer when the file has no `trailer` keyword (the latest in the file wins, as a later `trailer` would), so a concatenated or truncated file keeps its /Info and /ID instead of failing to load; a candidate whose /Root is the catalog beats one whose /Root is another dictionary, and an in-file /Root must match its generation (#2365) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding`; (4) `inspect::tests::compressed_object_self_container_does_not_recurse`, `inspect::tests::compressed_object_mutual_containers_do_not_recurse`, `inspect::tests::object_stream_length_cycle_does_not_recurse`, `inspect::tests::compressed_object_container_chain_does_not_recurse`, `inspect::tests::compressed_length_chain_does_not_recurse`, `inspect::tests::plain_stream_length_chain_does_not_recurse`, `inspect::tests::compressed_objects_and_indirect_stream_length_still_load`, `inspect::tests::compressed_length_in_a_container_with_an_indirect_length_still_loads`; (5) `inspect::tests::object_stream_member_extents_bound_owned_strings`, `inspect::tests::object_stream_member_extents_preserve_index_order_and_whitespace`; (6) `inspect::tests::rebuilt_file_keeps_the_info_of_its_cross_reference_stream`, `inspect::tests::rebuilt_file_prefers_a_trailer_whose_root_is_the_catalog` |
-| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); an EI followed by a delimiter (EI%..., EI[...) ends the image like one followed by white space; only a regular character after EI skips the candidate; (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW, RunLength and ASCII85 never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong; (15) page content is read a piece at a time (`page::ContentReader`, `Page::content_reader`): plain streams and Flate streams without a predictor are decoded as they are read, with a budget of 64 times their compressed size and never less than `MAX_DECODED_STREAM` (a stream that expands past it is cut and reported); other streams are decoded whole, as before, and share `MAX_DECODED_STREAM`. The content tokenizer reads a window at a time (`UntypedIter::new_window`, `TypedIter::needs_more`, `TypedIter::committed`): an instruction that runs past the window is not decided until more data follows, which `Reader` records by flagging reads and `at_end` past the end of the data, including through the clones the parser makes. The Flate decoder keeps its own 32 KiB history, so it pauses at any output size. `ContentReader::new` reuses raw/decrypted stream bytes for budget accounting and piece creation, and `decoded_raw_within` applies the existing Whole-stream filters and limits to those bytes without decrypting twice; (16) revision 5–6 (AES-256) passwords are tried in their SASLprep form (RFC 4013, then UTF-8, at most 127 bytes, as ISO 32000-2 §7.6.4.3.3 Algorithm 2.A asks and pdfcraft-crypt writes them) and then, if that differs, as given (`aes256_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Do the above.`; `stringprep`, already in the tree through pdfcraft-crypt, is an optional dependency enabled by `std`, and without `std` passwords are used as given): the renderer used the password as typed, so one that SASLprep changes (a decomposed `café`, a no-break space, the fullwidth `ａｂ` a Japanese IME types in full-width mode) was wrong, although pdfcraft-cos accepted it: protecting a document with such an open password was rolled back ("the password is incorrect"), and a file with such a password did not open with it.; (17) CCITT `/Rows 0` means the height is not predetermined (ISO 32000-2 Table 11), not zero rows: scanned Group 4 pages written that way rendered blank; (18) The streaming Flate decoder (`lzw_flate::flate::fallback`) copies a back-reference in runs of up to its distance (`extend_from_within`), not byte by byte. The copy reads only bytes already in the output, and a copy whose source does not exist still writes nothing, so the bytes are those a byte-by-byte copy writes. Inflating the A1 sample's content stream (278.6 MB) takes about 14% less time (0.66 s to 0.56 s); the output is identical; (19) CCITT `/Rows` below the image's `/Height` decodes to the height: a plotter driver wrote `/Rows` equal to `/Columns`, so only the first rows were decoded and the rest drawn black (#3308) (20) `stream` followed by spaces or tabs and then the line break (`stream \r\n`, as Microsoft Reporting Services writes it) starts the data after the line break; the content stream was taken to start at the space and the page rendered blank.; (21) a JP2 colour specification naming an enumerated colour space the decoder refuses (CIEJab in a veraPDF fixture, YCbCr, PhotoYCC, YPbPr, bilevel…) no longer fails the image: it is decoded again from a copy whose `colr` names the space the decoder assumes without one, greyscale, sRGB or CMYK by component count, as MuPDF and Poppler draw it (`without_refused_enumerated_colour`; the page drew blank, #3306); (22) an object stream's index of `objnum offset` pairs is parsed once per stream and kept beside its decoded data (`ObjectStreamIndexes`, `XRef::with_object_stream_indexes`), and an offset past `usize` is malformed instead of wrapping: `XRef::get_with` parsed the whole index again for every object it fetched from the stream, so reading all of a stream of N objects took N² steps (a Firefox page whose 65,542 objects share one stream took 37 s to draw and 40 s to extract its text); (23) the inline-image end-of-data look-ahead no longer rejects a candidate `EI` because a byte above 0x7F lies between it and the next one: when the candidate is the end, those bytes are the content stream that follows the image, and its strings carry such bytes (WinAnsi `(Grüße) Tj`, the two-byte codes of any Type 0 font), so the operator check that follows decides alone, bounded as in (4) (a scanned page whose OCR text held an accented word and a later capital "EI" — EINGANG, BEI, KLEIN — drew and extracted nothing after the image: 40 of 275 pages across five real documents); (24) `xref::prev_offset`: a trailer `/Prev` written as a reference `N G R` is read as the offset that object holds when the section's own entries place it (iText's `indirectPrev.pdf`; each section's entries are read before its `Prev` is followed), and otherwise as offset N (tiff2pdf; JHOVE's PDF-HUL-157 files, #2366), as `pdfcraft-cos` and other readers take it, so the earlier sections' pages are seen instead of one; (25) direct arrays and dictionaries share a reader-local nesting cap of 128, counted while skipping and while parsing a dictionary (its lenient repair reads, rather than skips, an object found where a key belongs, so `<< << …` recursed through that read); deeper objects return `None` instead of overflowing the stack (including unused trailer values, trailer entries, content operands and marked-content properties); a chain of 65 direct stitching functions now stops at this cap, before the 64-function guard; (26) an xref stream subsection must be backed by its decoded data: all-zero `/W` widths (an entry reads no bytes) and a declared count longer than the data are refused before any entry is inserted, where a tiny stream with a large `/Size` or `/Index` count inserted that many entries (from storytold/craft-libs#239); a subsection running past object number `i32::MAX` is refused instead of overflowing or turning negative; (27) an xref stream's type field is read big-endian at its full `/W[0]` width, where only its first byte was read and wider fields shifted every later entry, and `/W[0]` over 8 bytes is refused like `/W[1]` (from storytold/craft-libs#241); (28) a content instruction keeps up to 256 operands (`MAX_OPERANDS`) instead of 10, and past that drops the oldest instead of ending the content stream: the eleventh operand of a twelve-ink DeviceN `scn` (ISO 32000-2 §8.6.6.5 allows any number of components) blanked the rest of the page (#4260); (29) a `/JBIG2Globals` stream that is itself JBIG2 isn't decoded: globals are raw segments, and a chain of 16,000 such streams overflowed the stack, which aborts the process; (31) `set_page_jbig2_work`: the JBIG2 images decoded on a thread spend one allowance, set per page, 2^30 steps (`MAX_PAGE_JBIG2_WORK`), so a page of many images made to reach their own limit stops at one, and what they cost to read counts, whether they decode or not; unbounded until a page sets it | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`, `content::tests::inline_image_ei_may_be_followed_by_a_delimiter`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open`; (15) `content::tests::windows_keep_every_instruction_at_every_split`, `content::tests::windows_keep_every_instruction_in_pieces_of_any_size`, `content::tests::windows_match_the_slice_on_random_content`, `content::tests::windows_drop_blanks_and_keep_a_comment_that_may_go_on`, `page::content_reader_tests::content_past_the_cap_is_read_to_the_end`, `page::content_reader_tests::a_stream_that_expands_past_the_budget_is_cut_there`, `page::content_reader_tests::a_small_expansion_under_the_cap_is_not_cut`, `raster::tests::page_content_past_the_old_cap_renders`, `raster::tests::content_reader_returns_the_same_bytes_in_any_pieces`, `raster::tests::content_bombs_stop_at_the_budget_and_say_so`, `page::content_reader_tests::plain_and_whole_pieces_keep_their_bytes`, `page::content_reader_tests::repeated_content_reference_counts_compressed_bytes_once`, `page::content_reader_tests::whole_cap_still_counts_later_unique_streams`; (16) `crypto::pdfcraft_password_tests::aes256_passwords_are_tried_in_their_saslprep_form_then_as_given`, `crypto::pdfcraft_password_tests::aes256_passwords_open_as_typed_and_in_their_saslprep_form`, `pdfcraft-engine` `tests::aes256_open_passwords_that_saslprep_changes_protect_and_reopen_as_typed`, `tests::aes256_files_whose_passwords_saslprep_changes_open_as_typed`; (17) `raster::tests::group4_fax_with_rows_zero_decodes_to_the_image_height`; (18) `filter::lzw_flate::tests::back_reference_longer_than_its_distance_repeats_its_source`, `back_reference_cut_by_the_limit_resumes_in_the_next_call` and `back_reference_reads_bytes_written_by_an_earlier_call`; each fails when the copy returns the wrong remaining count; (19) `raster::tests::group4_fax_with_rows_below_its_height_decodes_to_the_image_height`; (20) `raster::tests::space_before_the_line_break_after_stream_still_renders`; (21) `raster::tests::a_jp2_image_in_a_refused_enumerated_colour_space_is_drawn`, `filter::jpx::tests::refused_enumerated_colour_spaces_become_the_component_counts_default`, `filter::jpx::tests::what_the_decoder_handles_or_cant_be_read_is_left_alone` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (22) `raster::tests::objects_in_one_large_object_stream_are_read_in_linear_time`; (23) `text::tests::text_after_an_inline_image_survives_a_non_ascii_byte_before_a_later_ei`, `content::tests::an_inline_image_ends_at_its_own_ei_when_later_text_holds_a_non_ascii_byte` (hayro-syntax); (24) `xref::tests::prev_as_reference_reaches_the_earlier_section`, `xref::tests::prev_as_reference_to_an_object_holding_the_offset_reads_that_offset`, `pdfcraft-cos` `document::tests::a_prev_written_as_a_reference_still_reaches_the_earlier_sections`, `document::tests::a_prev_reference_to_an_object_holding_the_offset_reads_that_offset`; (25) `raster::tests::deeply_nested_direct_objects_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap`, `raster::tests::nesting_at_the_cap_fits_a_512_kib_stack` (native only), `raster::tests::function_limits_depth_guard_refuses_a_chain_of_references`; (26) `xref::tests::xref_stream_entries_need_backing_bytes`; (27) `xref::tests::xref_stream_type_field_uses_the_full_w0_width`, `xref::tests::xref_stream_loader_rejects_oversized_w0` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (28) `content::ops::tests::scn_with_twelve_components_keeps_them_all`, `content::ops::tests::operands_past_the_cap_keep_the_latest_in_order` (hayro-syntax), `raster::tests::devicen_inks::a_twelve_ink_devicen_colour_paints`, `raster::tests::devicen_inks::a_four_ink_devicen_colour_paints`, `raster::tests::devicen_inks::an_operator_with_hundreds_of_operands_does_not_end_the_content`; (29) `raster::tests::jbig2_globals_that_are_jbig2_themselves_are_not_decoded`, `raster::tests::jbig2_globals_are_read`, `raster::tests::the_jbig2_images_of_a_page_share_one_allowance`, `raster::tests::an_image_that_fails_spends_the_pages_allowance_too` |
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); an EI followed by a delimiter (EI%..., EI[...) ends the image like one followed by white space; only a regular character after EI skips the candidate; (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW, RunLength and ASCII85 never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong; (15) page content is read a piece at a time (`page::ContentReader`, `Page::content_reader`): plain streams and Flate streams without a predictor are decoded as they are read, with a budget of 64 times their compressed size and never less than `MAX_DECODED_STREAM` (a stream that expands past it is cut and reported); other streams are decoded whole, as before, and share `MAX_DECODED_STREAM`. The content tokenizer reads a window at a time (`UntypedIter::new_window`, `TypedIter::needs_more`, `TypedIter::committed`): an instruction that runs past the window is not decided until more data follows, which `Reader` records by flagging reads and `at_end` past the end of the data, including through the clones the parser makes. The Flate decoder keeps its own 32 KiB history, so it pauses at any output size. `ContentReader::new` reuses raw/decrypted stream bytes for budget accounting and piece creation, and `decoded_raw_within` applies the existing Whole-stream filters and limits to those bytes without decrypting twice; (16) revision 5–6 (AES-256) passwords are tried in their SASLprep form (RFC 4013, then UTF-8, at most 127 bytes, as ISO 32000-2 §7.6.4.3.3 Algorithm 2.A asks and pdfcraft-crypt writes them) and then, if that differs, as given (`aes256_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Do the above.`; `stringprep`, already in the tree through pdfcraft-crypt, is an optional dependency enabled by `std`, and without `std` passwords are used as given): the renderer used the password as typed, so one that SASLprep changes (a decomposed `café`, a no-break space, the fullwidth `ａｂ` a Japanese IME types in full-width mode) was wrong, although pdfcraft-cos accepted it: protecting a document with such an open password was rolled back ("the password is incorrect"), and a file with such a password did not open with it.; (17) CCITT `/Rows 0` means the height is not predetermined (ISO 32000-2 Table 11), not zero rows: scanned Group 4 pages written that way rendered blank; (18) The streaming Flate decoder (`lzw_flate::flate::fallback`) copies a back-reference in runs of up to its distance (`extend_from_within`), not byte by byte. The copy reads only bytes already in the output, and a copy whose source does not exist still writes nothing, so the bytes are those a byte-by-byte copy writes. Inflating the A1 sample's content stream (278.6 MB) takes about 14% less time (0.66 s to 0.56 s); the output is identical; (19) CCITT `/Rows` below the image's `/Height` decodes to the height: a plotter driver wrote `/Rows` equal to `/Columns`, so only the first rows were decoded and the rest drawn black (#3308) (20) `stream` followed by spaces or tabs and then the line break (`stream \r\n`, as Microsoft Reporting Services writes it) starts the data after the line break; the content stream was taken to start at the space and the page rendered blank.; (21) a JP2 colour specification naming an enumerated colour space the decoder refuses (CIEJab in a veraPDF fixture, YCbCr, PhotoYCC, YPbPr, bilevel…) no longer fails the image: it is decoded again from a copy whose `colr` names the space the decoder assumes without one, greyscale, sRGB or CMYK by component count, as MuPDF and Poppler draw it (`without_refused_enumerated_colour`; the page drew blank, #3306); (22) an object stream's index of `objnum offset` pairs is parsed once per stream and kept beside its decoded data (`ObjectStreamIndexes`, `XRef::with_object_stream_indexes`), and an offset past `usize` is malformed instead of wrapping: `XRef::get_with` parsed the whole index again for every object it fetched from the stream, so reading all of a stream of N objects took N² steps (a Firefox page whose 65,542 objects share one stream took 37 s to draw and 40 s to extract its text); (23) the inline-image end-of-data look-ahead no longer rejects a candidate `EI` because a byte above 0x7F lies between it and the next one: when the candidate is the end, those bytes are the content stream that follows the image, and its strings carry such bytes (WinAnsi `(Grüße) Tj`, the two-byte codes of any Type 0 font), so the operator check that follows decides alone, bounded as in (4) (a scanned page whose OCR text held an accented word and a later capital "EI" — EINGANG, BEI, KLEIN — drew and extracted nothing after the image: 40 of 275 pages across five real documents); (24) `xref::prev_offset`: a trailer `/Prev` written as a reference `N G R` is read as the offset that object holds when the section's own entries place it (iText's `indirectPrev.pdf`; each section's entries are read before its `Prev` is followed), and otherwise as offset N (tiff2pdf; JHOVE's PDF-HUL-157 files, #2366), as `pdfcraft-cos` and other readers take it, so the earlier sections' pages are seen instead of one; (25) direct arrays and dictionaries share a reader-local nesting cap of 128, counted while skipping and while parsing a dictionary (its lenient repair reads, rather than skips, an object found where a key belongs, so `<< << …` recursed through that read); deeper objects return `None` instead of overflowing the stack (including unused trailer values, trailer entries, content operands and marked-content properties); a chain of 65 direct stitching functions now stops at this cap, before the 64-function guard; (26) an xref stream subsection must be backed by its decoded data: all-zero `/W` widths (an entry reads no bytes) and a declared count longer than the data are refused before any entry is inserted, where a tiny stream with a large `/Size` or `/Index` count inserted that many entries (from storytold/craft-libs#239); a subsection running past object number `i32::MAX` is refused instead of overflowing or turning negative; (27) an xref stream's type field is read big-endian at its full `/W[0]` width, where only its first byte was read and wider fields shifted every later entry, and `/W[0]` over 8 bytes is refused like `/W[1]` (from storytold/craft-libs#241); (28) a content instruction keeps up to 256 operands (`MAX_OPERANDS`) instead of 10, and past that drops the oldest instead of ending the content stream: the eleventh operand of a twelve-ink DeviceN `scn` (ISO 32000-2 §8.6.6.5 allows any number of components) blanked the rest of the page (#4260); (29) a `/JBIG2Globals` stream that is itself JBIG2 isn't decoded: globals are raw segments, and a chain of 16,000 such streams overflowed the stack, which aborts the process; (31) `set_page_jbig2_work`: the JBIG2 images decoded on a thread spend one allowance, set per page, 2^30 steps (`MAX_PAGE_JBIG2_WORK`), so a page of many images made to reach their own limit stops at one, and what they cost to read counts, whether they decode or not; unbounded until a page sets it; (32) a group of array items read together (a tuple: an image's `/Decode`, `/W`, `/W2`, and a function's `/Domain`, `/Range`, `/Encode` and `/Decode`) can start with a reference: it was taken for the whole group and lost, which ended the array, so an image with `/Decode [7 0 R 0]` didn't draw and CID widths fell back to `/DW`; (33) an object that holds only a reference stands for what that names, stored on its own or in an object stream, up to 32 references: read as a number it was the reference's own object number, so a `/Decode` or `/W` entry naming such an object took a wrong value, and as anything else it was lost. Past 32, as any cycle goes, it reads as a missing object. An object stream isn't reached that way, as its checks are of the object named; reading its index counts against the 64 nested loads and reads its dictionary alone, as a chain of them, each with a member of the next for its `/N`, `/First` or `/Length`, ran out of stack; and a comment inside a reference counts as white space | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`, `content::tests::inline_image_ei_may_be_followed_by_a_delimiter`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open`; (15) `content::tests::windows_keep_every_instruction_at_every_split`, `content::tests::windows_keep_every_instruction_in_pieces_of_any_size`, `content::tests::windows_match_the_slice_on_random_content`, `content::tests::windows_drop_blanks_and_keep_a_comment_that_may_go_on`, `page::content_reader_tests::content_past_the_cap_is_read_to_the_end`, `page::content_reader_tests::a_stream_that_expands_past_the_budget_is_cut_there`, `page::content_reader_tests::a_small_expansion_under_the_cap_is_not_cut`, `raster::tests::page_content_past_the_old_cap_renders`, `raster::tests::content_reader_returns_the_same_bytes_in_any_pieces`, `raster::tests::content_bombs_stop_at_the_budget_and_say_so`, `page::content_reader_tests::plain_and_whole_pieces_keep_their_bytes`, `page::content_reader_tests::repeated_content_reference_counts_compressed_bytes_once`, `page::content_reader_tests::whole_cap_still_counts_later_unique_streams`; (16) `crypto::pdfcraft_password_tests::aes256_passwords_are_tried_in_their_saslprep_form_then_as_given`, `crypto::pdfcraft_password_tests::aes256_passwords_open_as_typed_and_in_their_saslprep_form`, `pdfcraft-engine` `tests::aes256_open_passwords_that_saslprep_changes_protect_and_reopen_as_typed`, `tests::aes256_files_whose_passwords_saslprep_changes_open_as_typed`; (17) `raster::tests::group4_fax_with_rows_zero_decodes_to_the_image_height`; (18) `filter::lzw_flate::tests::back_reference_longer_than_its_distance_repeats_its_source`, `back_reference_cut_by_the_limit_resumes_in_the_next_call` and `back_reference_reads_bytes_written_by_an_earlier_call`; each fails when the copy returns the wrong remaining count; (19) `raster::tests::group4_fax_with_rows_below_its_height_decodes_to_the_image_height`; (20) `raster::tests::space_before_the_line_break_after_stream_still_renders`; (21) `raster::tests::a_jp2_image_in_a_refused_enumerated_colour_space_is_drawn`, `filter::jpx::tests::refused_enumerated_colour_spaces_become_the_component_counts_default`, `filter::jpx::tests::what_the_decoder_handles_or_cant_be_read_is_left_alone` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (22) `raster::tests::objects_in_one_large_object_stream_are_read_in_linear_time`; (23) `text::tests::text_after_an_inline_image_survives_a_non_ascii_byte_before_a_later_ei`, `content::tests::an_inline_image_ends_at_its_own_ei_when_later_text_holds_a_non_ascii_byte` (hayro-syntax); (24) `xref::tests::prev_as_reference_reaches_the_earlier_section`, `xref::tests::prev_as_reference_to_an_object_holding_the_offset_reads_that_offset`, `pdfcraft-cos` `document::tests::a_prev_written_as_a_reference_still_reaches_the_earlier_sections`, `document::tests::a_prev_reference_to_an_object_holding_the_offset_reads_that_offset`; (25) `raster::tests::deeply_nested_direct_objects_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_content_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_in_the_trailer_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_as_marked_content_properties_do_not_overflow_the_stack`, `raster::tests::dictionaries_nested_without_keys_are_read_up_to_the_nesting_cap`, `raster::tests::nesting_at_the_cap_fits_a_512_kib_stack` (native only), `raster::tests::function_limits_depth_guard_refuses_a_chain_of_references`; (26) `xref::tests::xref_stream_entries_need_backing_bytes`; (27) `xref::tests::xref_stream_type_field_uses_the_full_w0_width`, `xref::tests::xref_stream_loader_rejects_oversized_w0` (`cargo test --manifest-path vendor/hayro-syntax/Cargo.toml`); (28) `content::ops::tests::scn_with_twelve_components_keeps_them_all`, `content::ops::tests::operands_past_the_cap_keep_the_latest_in_order` (hayro-syntax), `raster::tests::devicen_inks::a_twelve_ink_devicen_colour_paints`, `raster::tests::devicen_inks::a_four_ink_devicen_colour_paints`, `raster::tests::devicen_inks::an_operator_with_hundreds_of_operands_does_not_end_the_content`; (29) `raster::tests::jbig2_globals_that_are_jbig2_themselves_are_not_decoded`, `raster::tests::jbig2_globals_are_read`, `raster::tests::the_jbig2_images_of_a_page_share_one_allowance`, `raster::tests::an_image_that_fails_spends_the_pages_allowance_too`; (32) `raster::tests::a_decode_array_with_references_in_it_is_read`, `raster::tests::a_functions_arrays_can_start_with_a_reference` (pdfcraft-render), `font::cid::width_tests::a_width_group_can_start_with_a_reference` (hayro-interpret); (33) `raster::tests::a_reference_to_a_reference_is_what_it_names`, `raster::tests::a_decode_array_with_references_in_it_is_read` (pdfcraft-render), `font::cid::width_tests::a_width_group_can_start_with_a_reference` (hayro-interpret), `xref::tests::an_object_stream_isnt_reached_through_a_reference`, `xref::tests::a_chain_of_object_streams_ends_at_the_limit_of_nested_loads`, `xref::tests::a_chain_of_object_streams_takes_no_more_work_for_two_ways_on`, `xref::tests::a_reference_held_in_either_storage_is_followed`, `xref::tests::a_page_a_reference_is_held_to_is_found_once` (hayro-syntax) |
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. (2) on Wayland, a seat's text input is destroyed when the seat goes away, not whenever it loses a capability: losing any capability (a touch screen or tablet unplugged, a remote-desktop session ending) destroyed it, and only an added capability recreated it, so IME stopped working until restart. Port of [winit#4747](https://github.com/rust-windowing/winit/pull/4747); (3) on Windows, an IME composition reports its cursor from `GCS_CURSORPOS` only when `WM_IME_COMPOSITION` says it is set, and at the end of the composition otherwise: the Microsoft Korean IME never sets it, so the cursor read as 0 (egui then drew no caret while composing; it now draws it after the syllable). Port of [winit#4746](https://github.com/rust-windowing/winit/pull/4746); (4) on Windows, a hidden window is not maximized until it is shown, and a hidden window shown while maximized gets one `ShowWindow(SW_MAXIMIZE)`: `SW_MAXIMIZE` shows a hidden window, so PdfCraft, which eframe keeps hidden until its first frame is drawn, appeared unpainted (white) when it restored a maximized window, and could lose its focus. Port of [winit#4587](https://github.com/rust-windowing/winit/pull/4587) (the later, focus-safe form of [winit#4575](https://github.com/rust-windowing/winit/pull/4575)); (5) on X11, when allowing or disallowing IME replaces the focused window's input context (egui does it each time a text field gains or loses focus), the new context is focused: no focus event follows, so it stayed unfocused until the window lost and regained focus. Port of [winit#4727](https://github.com/rust-windowing/winit/pull/4727); (6) on macOS, `insertText` commits through IME when a composition was started (`pending_commit`, set by `setMarkedText`) rather than when marked text is left: input methods that end a composition with `unmarkText` before `insertText` lost the text, and Apple Korean dropped the key typed after a syllable (`한` then `5` or `;`); other `insertText` calls stay `KeyboardInput`; a commit outside a key press (a candidate clicked with the mouse, dictation) clears the marked text and leaves no key to swallow, as in [winit#4748](https://github.com/rust-windowing/winit/pull/4748) (without it the next key, such as Backspace, was lost). `validAttributesForMarkedText` lists the underline and marked-clause attributes, without which some input methods don't compose. Port of [winit#4650](https://github.com/rust-windowing/winit/pull/4650), the 0.30 backport of [winit#4651](https://github.com/rust-windowing/winit/pull/4651) (merged on winit master), with the underline attribute spelled as AppKit's `NSUnderlineStyleAttributeName` (`NSUnderline`); (7) on macOS, disallowing IME with a composition in progress (focus leaving a text field) tells the input method to discard its marked text (`discardMarkedText`): it kept composing it once IME was allowed again, so the abandoned syllable came back (`하`, then `가` typed in the next field, became `학`, then `하` + `가`; Japanese `か` then `さ` became `傘`). Port of [winit#4745](https://github.com/rust-windowing/winit/pull/4745); (8) on macOS, text inserted outside a key press without a composition (the emoji picker) is reported as `Ime::Commit`; it was dropped. Port of the emoji-picker part of [winit#4749](https://github.com/rust-windowing/winit/pull/4749) (0.30 backport of [winit#4748](https://github.com/rust-windowing/winit/pull/4748)); its `selectedRange` change for dictation is left out because it switches on press-and-hold for every held key (an accent menu instead of key repeat, and the chosen accent added after the repeated letters); (9) on macOS, a key whose text was committed through IME isn't also sent as `KeyboardInput` unless AppKit forwards it as a command (Enter): Apple Korean answers Space with no syllable in progress with `setMarkedText(" ")`, `insertText(" ")`, `setMarkedText("")`, and the last call reset winit's state, so the space arrived twice. Same goal as [winit#4478](https://github.com/rust-windowing/winit/pull/4478), whose changes don't reach this call order (macOS 14); to be proposed upstream there; (10) on macOS, when the first key in a fresh app reaches Apple Korean's `insertText` as a raw compatibility jamo instead of starting a composition, that key is interpreted once more, synchronously, before it is sent as `KeyboardInput` (g k s typed ㅎㅏㄴ instead of 한); only an unmodified, non-repeated first key whose one callback inserts that same jamo, with IME enabled and nothing composed, focus and input source unchanged, is retried (`ime_startup.rs`). Port of [winit#4744](https://github.com/rust-windowing/winit/pull/4744), with its policy tests.; (11) on X11 without `Xft.dpi`, the scale factor comes from the X screen's configured DPI (its size in pixels and millimetres) before the output's physical density from RandR: Xorg can deliberately run a dense panel at 96 DPI, and only winit applications then looked zoomed; `Xft.dpi` still wins, `WINIT_X11_SCALE_FACTOR` still overrides, and a screen reporting no size keeps the RandR fallback. PdfCraft patch (#1150, replacing the launcher pin proposed in #908). (12) on macOS, `WinitView` answers `mouseDownCanMoveWindow` with the window's `movable_by_window_background` attribute (NO unless asked): NSView answers YES for a view that isn't opaque, so with the transparent title bar and full-size content view PdfCraft uses, AppKit moved the window for any drag that began in the 28 pt title-bar band before the app saw it, and document tabs (which live in that band) could not be dragged to reorder them. The empty strip still moves the window through `ViewportCommand::StartDrag`. PdfCraft patch. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build; (13) on Wayland, pixel-only wheel, wheel-tilt and continuous-source scroll events report `Moved` rather than starting an unterminated finger gesture, so egui follows modifier release instead of keeping Ctrl zoom latched (#991). Finger gestures and unknown sources retain their existing phase policy | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11; (2) `pdfcraft` `tests/winit_wayland_text_input.rs`; the capability change itself needs a Wayland session and an input method; (3) `pdfcraft` `tests/winit_windows_ime_cursor.rs`; composing itself needs the Microsoft Korean IME; (4) `pdfcraft` `tests/winit_windows_hidden_maximized.rs`; the start-up itself needs Windows and a window that was closed maximized; (5) `pdfcraft` `tests/winit_x11_ime_focus.rs`; switching fields itself needs an X11 session and an input method (IBus, fcitx5); (6) `pdfcraft` `tests/winit_macos_ime_commit.rs`; composing itself needs macOS and an input method; (7) `pdfcraft` `tests/winit_macos_ime_discard.rs`; composing itself needs macOS and an input method; (8) `pdfcraft` `tests/winit_macos_emoji_picker.rs`; the picker itself needs macOS; (9) `pdfcraft` `tests/winit_macos_korean_space.rs`; composing itself needs macOS and Apple Korean; (10) `pdfcraft` `tests/winit_macos_korean_first_key.rs` and `ime_startup.rs`'s own tests (run them with `rustc --test`); typing itself needs macOS and Apple Korean; (11) `pdfcraft` `tests/winit_x11_dpi.rs` keeps the patch in the build, and `util::randr` tests the policy (run them in the vendored crate); the scale itself needs an X11 session; (12) `pdfcraft` `tests/winit_macos_title_bar_drag.rs` keeps the patch in the build; the drag itself needs macOS and a pointer; (13) `pdfcraft` `tests/winit_wayland_scroll.rs` compiles the production phase policy and exercises modifier release through egui; live COSMIC confirmation remains open |
 | egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag; (2) `winit::catch_errors`: a new window's surface is configured inside wgpu error scopes (validation, out of memory, internal), and a failure is returned as `WgpuError::ConfigureSurface` (for the root window at start-up eframe returns it as `Error::Wgpu`, which PdfCraft retries with OpenGL); nothing is kept for the window. wgpu's default handler panicked instead, and eframe configures the root surface before the app is created, so a driver that can't configure one closed PdfCraft at launch (a 2015 Intel GPU through wgpu's GL backend timed out waiting for the GPU to go idle, `GpuWaitTimeout`, #519). Unchanged, so still a panic: an error in a later reconfigure (resize, a lost surface), a device lost during the first configure (wgpu reports it only to a callback), and a window shown at zero size (first configured on resize) | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::vendor_provenance_egui_wgpu_surface_fit_identity`, which keeps the patch in the build and in the paths that size a surface; (2) `pdfcraft` `tests::a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic` (a real device: an error inside `catch_errors` is returned, not a panic) and `tests::vendor_provenance_egui_wgpu_catch_errors_identity`, which keeps it around `add_surface`'s configure |
 | vello_common | 0.0.8 | Apache-2.0 OR MIT | (1) `clip::intersect` (the clip step every clipped path passes through) starts its row walk at the first row both paths have strips in, not the earlier of the two first rows. The walk visited every row from the top of the clip for each path (on the A1 sample's full-page canvas, about half its strip rows per stroke), and rows where one path has no strips produce no output, so the strips are unchanged (vello_common 0.1 starts at the later row too). Its cost grew with the page, and a full-page render of the A1 sample was about 30% faster; the output is byte-identical | (1) `clip::tests::intersect_walks_only_rows_both_paths_have_strips` counts the rows the walk visits (`cargo test --manifest-path vendor/vello_common/Cargo.toml`) and fails without the patch; the render crate's pixel tests run through the patched crate |
diff --git a/vendor/hayro-interpret/src/color.rs b/vendor/hayro-interpret/src/color.rs
index 29a74a6de8..b93b69c73c 100644
--- a/vendor/hayro-interpret/src/color.rs
+++ b/vendor/hayro-interpret/src/color.rs
@@ -166,12 +166,24 @@ fn icc_stream_object(array: &Array<'_>, stream: &Stream<'_>) -> Option<object::O
     dict.obj_id()
 }
 
+/// PdfCraft patch (74): how deeply colour spaces may nest. A legal file goes five levels at most:
+/// a Pattern's underlying space, an Indexed base, a Separation's alternate, an ICC profile, and
+/// that profile's alternate. Reading an object already being read is refused, which ends a cycle
+/// but not a chain: 5,000 spaces each naming the next, 180 KB of file, overflowed the stack, and
+/// that aborts the process.
+const MAX_COLOR_SPACE_DEPTH: u32 = 32;
+
 impl ColorSpaceType {
-    fn new(object: Object<'_>, cache: &Cache) -> Option<Self> {
-        Self::new_inner(object, cache)
+    fn new(object: Object<'_>, cache: &Cache, depth: u32) -> Option<Self> {
+        if depth >= MAX_COLOR_SPACE_DEPTH {
+            warn!("colour spaces nest past the limit of {MAX_COLOR_SPACE_DEPTH} levels");
+            return None;
+        }
+
+        Self::new_inner(object, cache, depth)
     }
 
-    fn new_inner(object: Object<'_>, cache: &Cache) -> Option<Self> {
+    fn new_inner(object: Object<'_>, cache: &Cache, depth: u32) -> Option<Self> {
         if let Object::Name(name) = object {
             return Self::new_from_name(&name);
         } else if let Object::Array(color_array) = object {
@@ -186,6 +198,9 @@ impl ColorSpaceType {
 
                     // PdfCraft patch (48): cached by what the profile is read from (see
                     // `IccProfileKey`), not by the stream dictionary's bytes alone.
+                    // PdfCraft patch (74): what's kept is what the profile itself reads as. What
+                    // it falls back to depends on how deep it was met, and kept with the profile
+                    // a page could build a chain past the limit on spaces already read.
                     let read = || {
                         let data = icc_stream.raw_data();
                         let content = IccProfileKey::Content {
@@ -194,40 +209,37 @@ impl ColorSpaceType {
                         };
                         cache.get_or_insert_with(hash128(&content), || {
                             cache.count_icc_profile_read();
-                            if let Some(decoded) = icc_stream.decoded().ok().as_ref() {
-                                ICCProfile::new(decoded, num_components)
-                                    .map(|icc| {
-                                        // TODO: For SVG and PNG we can assume that the output color space is
-                                        // sRGB. If we ever implement PDF-to-PDF, we probably want to
-                                        // let the user pass the native color type and don't make this optimization
-                                        // if it's not sRGB.
-                                        if icc.is_srgb() {
-                                            Self::DeviceRgb
-                                        } else {
-                                            Self::ICCBased(icc)
-                                        }
-                                    })
-                                    .or_else(|| {
-                                        dict.get::<Object<'_>>(ALTERNATE)
-                                            .and_then(|o| Self::new(o, cache))
-                                    })
-                                    .or_else(|| match dict.get::<u8>(N) {
-                                        Some(1) => Some(Self::DeviceGray),
-                                        Some(3) => Some(Self::DeviceRgb),
-                                        Some(4) => Some(Self::DeviceCmyk),
-                                        _ => None,
-                                    })
-                            } else {
-                                None
-                            }
+                            let decoded = icc_stream.decoded().ok()?;
+                            Some(ICCProfile::new(&decoded, num_components).map(|icc| {
+                                // TODO: For SVG and PNG we can assume that the output color space is
+                                // sRGB. If we ever implement PDF-to-PDF, we probably want to
+                                // let the user pass the native color type and don't make this optimization
+                                // if it's not sRGB.
+                                if icc.is_srgb() {
+                                    Self::DeviceRgb
+                                } else {
+                                    Self::ICCBased(icc)
+                                }
+                            }))
                         })
                     };
-                    return match icc_stream_object(&color_array, &icc_stream) {
+                    let profile = match icc_stream_object(&color_array, &icc_stream) {
                         Some(object) => {
                             cache.get_or_insert_with(hash128(&IccProfileKey::Object(object)), read)
                         }
                         None => read(),
                     };
+                    return profile?
+                        .or_else(|| {
+                            dict.get::<Object<'_>>(ALTERNATE)
+                                .and_then(|o| Self::new(o, cache, depth + 1))
+                        })
+                        .or_else(|| match dict.get::<u8>(N) {
+                            Some(1) => Some(Self::DeviceGray),
+                            Some(3) => Some(Self::DeviceRgb),
+                            Some(4) => Some(Self::DeviceCmyk),
+                            _ => None,
+                        });
                 }
                 CALCMYK => return Some(Self::DeviceCmyk),
                 CALGRAY => {
@@ -246,19 +258,20 @@ impl ColorSpaceType {
                     return Some(Self::Lab(Lab::new(&lab_dict)?));
                 }
                 INDEXED | I => {
-                    return Some(Self::Indexed(Indexed::new(&color_array, cache)?));
+                    return Some(Self::Indexed(Indexed::new(&color_array, cache, depth)?));
                 }
                 SEPARATION => {
-                    return Some(Self::Separation(Separation::new(&color_array, cache)?));
+                    return Some(Self::Separation(Separation::new(&color_array, cache, depth)?));
                 }
                 DEVICE_N => {
-                    return Some(Self::DeviceN(DeviceN::new(&color_array, cache)?));
+                    return Some(Self::DeviceN(DeviceN::new(&color_array, cache, depth)?));
                 }
                 PATTERN => {
-                    let _ = iter.next::<Name<'_>>();
+                    // PdfCraft patch (72): the family is already read. Reading a name here too took
+                    // the underlying space when it was a name or a reference.
                     let cs = iter
                         .next::<Object<'_>>()
-                        .and_then(|o| ColorSpace::new(o, cache))
+                        .and_then(|o| ColorSpace::within(o, cache, depth + 1))
                         .unwrap_or(ColorSpace::device_rgb());
                     return Some(Self::Pattern(cs));
                 }
@@ -291,7 +304,12 @@ pub struct ColorSpace(Arc<ColorSpaceType>);
 impl ColorSpace {
     /// Create a new color space from the given object.
     pub(crate) fn new(object: Object<'_>, cache: &Cache) -> Option<Self> {
-        Some(Self(Arc::new(ColorSpaceType::new(object, cache)?)))
+        Self::within(object, cache, 0)
+    }
+
+    /// A colour space named by another, `depth` levels down.
+    fn within(object: Object<'_>, cache: &Cache, depth: u32) -> Option<Self> {
+        Some(Self(Arc::new(ColorSpaceType::new(object, cache, depth)?)))
     }
 
     /// Create a new color space from the name.
@@ -991,21 +1009,22 @@ pub(crate) struct Indexed {
 }
 
 impl Indexed {
-    fn new(array: &Array<'_>, cache: &Cache) -> Option<Self> {
+    fn new(array: &Array<'_>, cache: &Cache, depth: u32) -> Option<Self> {
         let mut iter = array.flex_iter();
         // Skip name
         let _ = iter.next::<Name<'_>>()?;
-        let base_color_space = ColorSpace::new(iter.next::<Object<'_>>()?, cache)?;
+        let base_color_space = ColorSpace::within(iter.next::<Object<'_>>()?, cache, depth + 1)?;
         let hival = iter.next::<u32>()?.min(u8::MAX as u32) as u8;
 
         let values = {
-            let data = iter
-                .next::<Stream<'_>>()
-                .and_then(|s| s.decoded().ok())
-                .or_else(|| {
-                    iter.next::<object::String<'_>>()
-                        .map(|s| Cow::Owned(s.to_vec()))
-                })?;
+            // PdfCraft patch (71): read once, as whichever it is. A failed read as a stream leaves
+            // a direct string in place but uses up a reference, so a table in an indirect string
+            // was lost, and the space with it.
+            let data = match iter.next::<Object<'_>>()? {
+                Object::Stream(s) => s.decoded().ok()?,
+                Object::String(s) => Cow::Owned(s.to_vec()),
+                _ => return None,
+            };
 
             let num_components = base_color_space.num_components();
 
@@ -1080,12 +1099,12 @@ fn eval_tint_transform(
 }
 
 impl Separation {
-    fn new(array: &Array<'_>, cache: &Cache) -> Option<Self> {
+    fn new(array: &Array<'_>, cache: &Cache, depth: u32) -> Option<Self> {
         let mut iter = array.flex_iter();
         // Skip `/Separation`
         let _ = iter.next::<Name<'_>>()?;
         let name = iter.next::<Name<'_>>()?;
-        let alternate_space = ColorSpace::new(iter.next::<Object<'_>>()?, cache)?;
+        let alternate_space = ColorSpace::within(iter.next::<Object<'_>>()?, cache, depth + 1)?;
         // PdfCraft patch (55): an unreadable tint transform keeps the space (see
         // `eval_tint_transform`).
         let tint_transform = iter.next::<Object<'_>>().and_then(|f| Function::new(&f));
@@ -1147,7 +1166,7 @@ pub(crate) struct DeviceN {
 }
 
 impl DeviceN {
-    fn new(array: &Array<'_>, cache: &Cache) -> Option<Self> {
+    fn new(array: &Array<'_>, cache: &Cache, depth: u32) -> Option<Self> {
         let mut iter = array.flex_iter();
         // Skip `/DeviceN`
         let _ = iter.next::<Name<'_>>()?;
@@ -1158,7 +1177,7 @@ impl DeviceN {
             .collect::<Vec<_>>();
         let num_components = u8::try_from(names.len()).ok()?;
         let all_none = names.iter().all(|n| n.as_str() == "None");
-        let alternate_space = ColorSpace::new(iter.next::<Object<'_>>()?, cache)?;
+        let alternate_space = ColorSpace::within(iter.next::<Object<'_>>()?, cache, depth + 1)?;
         // PdfCraft patch (55): an unreadable tint transform keeps the space (see
         // `eval_tint_transform`).
         let tint_transform = iter.next::<Object<'_>>().and_then(|f| Function::new(&f));
diff --git a/vendor/hayro-interpret/src/font/cid.rs b/vendor/hayro-interpret/src/font/cid.rs
index 44e076b4b1..43b558b050 100644
--- a/vendor/hayro-interpret/src/font/cid.rs
+++ b/vendor/hayro-interpret/src/font/cid.rs
@@ -698,3 +698,75 @@ mod tests {
         assert_eq!(map.len(), 12);
     }
 }
+
+#[cfg(test)]
+mod width_tests {
+    use super::*;
+    use hayro_syntax::Pdf;
+    use hayro_syntax::object::ObjectIdentifier;
+
+    /// A PDF whose object 5 is `array`, for what references in it can reach.
+    fn with_array(array: &str) -> Pdf {
+        let pdf = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 10 10] >> endobj\n\
+             4 0 obj 20 endobj\n5 0 obj {array} endobj\n6 0 obj 22 endobj\n\
+             7 0 obj 7 0 R endobj\n8 0 obj 9 0 R endobj\n9 0 obj 8 0 R endobj\n\
+             10 0 obj 4 0 R endobj\n11 0 obj [500 600] endobj\n12 0 obj [-1000 500 880] endobj\n\
+             trailer << /Root 1 0 R >>\n%%EOF\n"
+        );
+        Pdf::new(pdf.into_bytes()).unwrap()
+    }
+
+    /// `/W` and `/W2` read groups of items, and either kind can start with a reference: taken for
+    /// the whole group it was lost, with all that followed, and those glyphs fell back to `/DW`.
+    #[test]
+    fn a_width_group_can_start_with_a_reference() {
+        let widths = |array: &str| {
+            let pdf = with_array(array);
+            let array = pdf.xref().get::<Array<'_>>(ObjectIdentifier::new(5, 0)).unwrap();
+            let mut read: Vec<_> = read_widths(&array).unwrap().into_iter().collect();
+            read.sort_by_key(|(cid, _)| *cid);
+            read
+        };
+        let by_list = vec![(20, 500.0), (21, 600.0)];
+        assert_eq!(widths("[20 [500 600]]"), by_list);
+        assert_eq!(widths("[4 0 R [500 600]]"), by_list);
+        let by_range = vec![(20, 700.0), (21, 700.0), (22, 700.0)];
+        assert_eq!(widths("[20 22 700]"), by_range);
+        assert_eq!(widths("[4 0 R 22 700]"), by_range);
+        assert_eq!(widths("[4 0 R 6 0 R 700]"), by_range);
+        assert_eq!(widths("[1 [100] 4 0 R [500 600]]"), vec![(1, 100.0), (20, 500.0), (21, 600.0)], "after a group");
+
+        let vertical = |array: &str| {
+            let pdf = with_array(array);
+            let array = pdf.xref().get::<Array<'_>>(ObjectIdentifier::new(5, 0)).unwrap();
+            let mut read: Vec<_> = read_widths2(&array).unwrap().into_iter().collect();
+            read.sort_by_key(|(cid, _)| *cid);
+            read
+        };
+        let by_list = vec![(20, [-1000.0, 500.0, 880.0])];
+        assert_eq!(vertical("[20 [-1000 500 880]]"), by_list);
+        assert_eq!(vertical("[4 0 R [-1000 500 880]]"), by_list);
+        let by_range = vec![(20, [-900.0, 400.0, 800.0]), (21, [-900.0, 400.0, 800.0]), (22, [-900.0, 400.0, 800.0])];
+        assert_eq!(vertical("[20 22 -900 400 800]"), by_range);
+        assert_eq!(vertical("[4 0 R 22 -900 400 800]"), by_range);
+
+        // A group's list can be given by reference too, and a reference to a reference is what it
+        // names.
+        let by_list = vec![(20, 500.0), (21, 600.0)];
+        assert_eq!(widths("[20 11 0 R]"), by_list);
+        assert_eq!(widths("[10 0 R [500 600]]"), by_list);
+        assert_eq!(widths("[10 0 R 11 0 R]"), by_list);
+        assert_eq!(vertical("[20 12 0 R]"), vec![(20, [-1000.0, 500.0, 880.0])]);
+
+        // A reference that only leads back to itself holds no number, so those glyphs keep `/DW`.
+        for array in ["[7 0 R [500 600]]", "[8 0 R [500 600]]", "[20 7 0 R 700]", "[7 0 R 8 0 R 700]", "[20 [7 0 R 600]]"] {
+            assert!(widths(array).is_empty(), "{array}");
+        }
+        for array in ["[7 0 R [-1000 500 880]]", "[8 0 R 22 -900 400 800]", "[20 [7 0 R 500 880]]"] {
+            assert!(vertical(array).is_empty(), "{array}");
+        }
+    }
+}
diff --git a/vendor/hayro-jbig2/src/bitmap.rs b/vendor/hayro-jbig2/src/bitmap.rs
index 216255bf44..87738a849d 100644
--- a/vendor/hayro-jbig2/src/bitmap.rs
+++ b/vendor/hayro-jbig2/src/bitmap.rs
@@ -200,7 +200,8 @@ impl Bitmap {
         // TODO: Figure out how we can optimize this, especially since this is a
         // bottleneck for symbols/patterns.
         let dest_x_start = x.max(0);
-        let dest_x_end = (x + other.width as i32).min(self.width as i32);
+        // Saturating: a location can be anywhere an `i32` reaches, and past the end it is off the page.
+        let dest_x_end = x.saturating_add(other.width as i32).min(self.width as i32);
 
         if dest_x_start >= dest_x_end {
             return;
@@ -211,7 +212,7 @@ impl Bitmap {
         let dest_x_end = dest_x_end as u32;
 
         for src_y in 0..other.height {
-            let dest_y = y + src_y as i32;
+            let dest_y = y.saturating_add(src_y as i32);
             if dest_y < 0 || dest_y >= self.height as i32 {
                 continue;
             }
diff --git a/vendor/hayro-jbig2/src/decode/generic_refinement.rs b/vendor/hayro-jbig2/src/decode/generic_refinement.rs
index a566b8de58..a6634439d4 100644
--- a/vendor/hayro-jbig2/src/decode/generic_refinement.rs
+++ b/vendor/hayro-jbig2/src/decode/generic_refinement.rs
@@ -179,10 +179,12 @@ impl<'a> RefinementContextGatherer<'a> {
 
     pub(crate) fn start_row(&mut self, region: &Bitmap, reference: &Bitmap, y: u32) {
         self.reg_y = y;
-        let ref_y = y as i32 - self.reference_dy;
+        // The offsets can be anywhere an `i32` reaches, so coordinates in the reference wrap here and
+        // below. Wrapped, they are off the reference, whose pixels there read as 0.
+        let ref_y = (y as i32).wrapping_sub(self.reference_dy);
         // This will on purpose wrap to a very large `u32` for negative values, such that
         // they resolve to 0 in `ContextGatherer::load_word`.
-        let ref_x0 = (-self.reference_dx) as u32;
+        let ref_x0 = self.reference_dx.wrapping_neg() as u32;
 
         self.reg_cur_x = 0;
         self.reg_m1 = if y >= 1 {
@@ -193,9 +195,9 @@ impl<'a> RefinementContextGatherer<'a> {
         self.reg_cur = 0;
 
         self.ref_cur_x = 0;
-        self.ref_m1 = ContextGatherer::load_word(reference, (ref_y - 1) as u32, 0);
+        self.ref_m1 = ContextGatherer::load_word(reference, ref_y.wrapping_sub(1) as u32, 0);
         self.ref_cur = ContextGatherer::load_word(reference, ref_y as u32, 0);
-        self.ref_p1 = ContextGatherer::load_word(reference, (ref_y + 1) as u32, 0);
+        self.ref_p1 = ContextGatherer::load_word(reference, ref_y.wrapping_add(1) as u32, 0);
 
         self.ctx = match self.template {
             RefinementTemplate::Template1 => {
@@ -257,7 +259,7 @@ impl<'a> RefinementContextGatherer<'a> {
             self.reg_cur = ContextGatherer::load_word(region, self.reg_y, new_start);
         }
 
-        let ref_x_signed = x as i32 - self.reference_dx;
+        let ref_x_signed = (x as i32).wrapping_sub(self.reference_dx);
         if ref_x_signed < 0 {
             self.ref_cur_x = 0;
             self.ref_m1 = 0;
@@ -268,18 +270,20 @@ impl<'a> RefinementContextGatherer<'a> {
 
             if ref_x + 1 >= self.ref_cur_x + WORD_BITS || ref_x < self.ref_cur_x {
                 let new_start = ref_x.saturating_sub(1);
-                let ref_y = self.reg_y as i32 - self.reference_dy;
+                let ref_y = (self.reg_y as i32).wrapping_sub(self.reference_dy);
                 self.ref_cur_x = new_start;
-                self.ref_m1 = ContextGatherer::load_word(reference, (ref_y - 1) as u32, new_start);
+                self.ref_m1 =
+                    ContextGatherer::load_word(reference, ref_y.wrapping_sub(1) as u32, new_start);
                 self.ref_cur = ContextGatherer::load_word(reference, ref_y as u32, new_start);
-                self.ref_p1 = ContextGatherer::load_word(reference, (ref_y + 1) as u32, new_start);
+                self.ref_p1 =
+                    ContextGatherer::load_word(reference, ref_y.wrapping_add(1) as u32, new_start);
             }
         }
     }
 
     #[inline(always)]
     pub(crate) fn tpgr_all_same(&self, x: u32) -> bool {
-        let ref_x = (x as i32 - self.reference_dx) as u32;
+        let ref_x = (x as i32).wrapping_sub(self.reference_dx) as u32;
         let rbx = ref_x.wrapping_sub(self.ref_cur_x);
 
         #[inline(always)]
@@ -310,7 +314,7 @@ impl<'a> RefinementContextGatherer<'a> {
 
     #[inline(always)]
     pub(crate) fn ref_center_pixel(&self, x: u32) -> u8 {
-        let ref_x = (x as i32 - self.reference_dx) as u32;
+        let ref_x = (x as i32).wrapping_sub(self.reference_dx) as u32;
         let rbx = ref_x.wrapping_sub(self.ref_cur_x);
 
         ContextGatherer::get_buf_pixel(self.ref_cur, rbx) as u8
@@ -329,7 +333,7 @@ impl<'a> RefinementContextGatherer<'a> {
     #[inline(always)]
     fn gather_template0_default(&mut self, _region: &Bitmap, _reference: &Bitmap, x: u32) -> u16 {
         let bx = x - self.reg_cur_x;
-        let ref_x = (x as i32 - self.reference_dx) as u32;
+        let ref_x = (x as i32).wrapping_sub(self.reference_dx) as u32;
         let rbx = ref_x.wrapping_sub(self.ref_cur_x);
 
         let new_pixels = (ContextGatherer::get_buf_pixel(self.reg_m1, bx + 1) << 10)
@@ -345,12 +349,12 @@ impl<'a> RefinementContextGatherer<'a> {
     #[inline(always)]
     fn gather_template0_custom(&mut self, region: &Bitmap, reference: &Bitmap, x: u32) -> u16 {
         let bx = x - self.reg_cur_x;
-        let ref_x_i = x as i32 - self.reference_dx;
+        let ref_x_i = (x as i32).wrapping_sub(self.reference_dx);
         let rbx = ref_x_i as u32 - self.ref_cur_x;
 
         let xi = x as i32;
         let yi = self.reg_y as i32;
-        let ref_y = yi - self.reference_dy;
+        let ref_y = yi.wrapping_sub(self.reference_dy);
         let at1 = self.at_pixels[0];
         let at2 = self.at_pixels[1];
 
@@ -360,8 +364,8 @@ impl<'a> RefinementContextGatherer<'a> {
             | (ContextGatherer::get_buf_pixel(self.reg_m1, bx + 1) << 10)
             | (ContextGatherer::get_buf_pixel(self.reg_cur, bx.wrapping_sub(1)) << 9)
             | ((reference.get_pixel(
-                (ref_x_i + at2.x as i32) as u32,
-                (ref_y + at2.y as i32) as u32,
+                ref_x_i.wrapping_add(at2.x as i32) as u32,
+                ref_y.wrapping_add(at2.y as i32) as u32,
             ) as u16)
                 << 8)
             | (ContextGatherer::get_buf_pixel(self.ref_m1, rbx.wrapping_add(1)) << 6)
@@ -375,7 +379,7 @@ impl<'a> RefinementContextGatherer<'a> {
     #[inline(always)]
     fn gather_template1(&mut self, _region: &Bitmap, _reference: &Bitmap, x: u32) -> u16 {
         let bx = x - self.reg_cur_x;
-        let ref_x = (x as i32 - self.reference_dx) as u32;
+        let ref_x = (x as i32).wrapping_sub(self.reference_dx) as u32;
         let rbx = ref_x.wrapping_sub(self.ref_cur_x);
 
         let new_pixels = (ContextGatherer::get_buf_pixel(self.reg_m1, bx + 1) << 7)
diff --git a/vendor/hayro-jbig2/src/decode/text.rs b/vendor/hayro-jbig2/src/decode/text.rs
index 068ce6ec3a..5406ffeb46 100644
--- a/vendor/hayro-jbig2/src/decode/text.rs
+++ b/vendor/hayro-jbig2/src/decode/text.rs
@@ -182,23 +182,26 @@ pub(crate) fn decode_with(
             }
 
             let symbol_s = current_s;
+            // From the corner a symbol is placed by to its far side. The strip and the offset can
+            // be anywhere an `i32` reaches, and wrapped, the symbol is off the region.
+            let back = |corner: i32, size: i32| corner.wrapping_sub(size).wrapping_add(1);
 
             let (x, y) = if !header.flags.transposed {
                 match header.flags.reference_corner {
                     ReferenceCorner::TopLeft => (symbol_s, symbol_t),
-                    ReferenceCorner::TopRight => (symbol_s - symbol_width + 1, symbol_t),
-                    ReferenceCorner::BottomLeft => (symbol_s, symbol_t - symbol_height + 1),
+                    ReferenceCorner::TopRight => (back(symbol_s, symbol_width), symbol_t),
+                    ReferenceCorner::BottomLeft => (symbol_s, back(symbol_t, symbol_height)),
                     ReferenceCorner::BottomRight => {
-                        (symbol_s - symbol_width + 1, symbol_t - symbol_height + 1)
+                        (back(symbol_s, symbol_width), back(symbol_t, symbol_height))
                     }
                 }
             } else {
                 match header.flags.reference_corner {
                     ReferenceCorner::TopLeft => (symbol_t, symbol_s),
-                    ReferenceCorner::TopRight => (symbol_t - symbol_width + 1, symbol_s),
-                    ReferenceCorner::BottomLeft => (symbol_t, symbol_s - symbol_height + 1),
+                    ReferenceCorner::TopRight => (back(symbol_t, symbol_width), symbol_s),
+                    ReferenceCorner::BottomLeft => (symbol_t, back(symbol_s, symbol_height)),
                     ReferenceCorner::BottomRight => {
-                        (symbol_t - symbol_width + 1, symbol_s - symbol_height + 1)
+                        (back(symbol_t, symbol_width), back(symbol_s, symbol_height))
                     }
                 }
             };
diff --git a/vendor/hayro-jbig2/src/huffman_table.rs b/vendor/hayro-jbig2/src/huffman_table.rs
index 91df78b4cd..1a20da5281 100644
--- a/vendor/hayro-jbig2/src/huffman_table.rs
+++ b/vendor/hayro-jbig2/src/huffman_table.rs
@@ -467,11 +467,11 @@ impl HuffmanNode {
                     // 4) "Otherwise, if table line I is the lower range table line for this
                     //    table, then set: HTVAL = RANGELOW[I] − HTOFFSET"
                     // 5) "Otherwise, set: HTVAL = RANGELOW[I] + HTOFFSET"
-                    // `HTVAL`
+                    // `HTVAL`. Wrapping: a range line's offset can take it past what an `i32` holds.
                     let value = if leaf.is_lower {
-                        leaf.range_low - range_offset
+                        leaf.range_low.wrapping_sub(range_offset)
                     } else {
-                        leaf.range_low + range_offset
+                        leaf.range_low.wrapping_add(range_offset)
                     };
 
                     return Ok(Some(value));
diff --git a/vendor/hayro-jbig2/src/integer_decoder.rs b/vendor/hayro-jbig2/src/integer_decoder.rs
index 8b7656d296..7f9f7831a2 100644
--- a/vendor/hayro-jbig2/src/integer_decoder.rs
+++ b/vendor/hayro-jbig2/src/integer_decoder.rs
@@ -70,7 +70,8 @@ impl IntegerDecoder {
         if s == 0 {
             Some(v as i32)
         } else if v > 0 {
-            Some(-(v as i32))
+            // Wrapping: `V` can be 2^31, whose negative is `i32::MIN`, as the cast already reads it.
+            Some((v as i32).wrapping_neg())
         } else {
             None
         }
diff --git a/vendor/hayro-syntax/src/data.rs b/vendor/hayro-syntax/src/data.rs
index 9d5e2030f8..90c44f89c9 100644
--- a/vendor/hayro-syntax/src/data.rs
+++ b/vendor/hayro-syntax/src/data.rs
@@ -1,5 +1,4 @@
 use crate::object::ObjectIdentifier;
-use crate::object::Stream;
 use crate::reader::ReaderContext;
 use crate::sync::HashMap;
 use crate::sync::{Arc, Mutex, MutexExt};
@@ -92,6 +91,12 @@ impl Data {
         &self.data
     }
 
+    /// PdfCraft patch: (hayro-syntax (33)) enter the gate for what an object stream's index depends
+    /// on, once its data is read and [`Self::get_with`] has let go of it.
+    pub(crate) fn enter_loading(&self, id: ObjectIdentifier) -> Option<LoadGuard<'_>> {
+        self.loading.enter(id)
+    }
+
     /// Get access to the data of a decoded object stream.
     pub(crate) fn get_with(&self, id: ObjectIdentifier, ctx: &ReaderContext<'_>) -> Option<&[u8]> {
         // PdfCraft patch: (#307, see vendor/README.md hayro-syntax (10)) register exactly once:
@@ -110,7 +115,8 @@ impl Data {
         let _loading = self.loading.enter(id)?;
         self.decoded
             .get_or_init(idx, || {
-                let stream = ctx.xref().get_with::<Stream<'_>>(id, ctx)?;
+                // PdfCraft patch: (hayro-syntax (33)) only ever an object stream.
+                let stream = ctx.xref().object_stream(id, ctx)?;
                 stream.decoded().ok().map(Cow::into_owned)
             })?
             .as_deref()
@@ -244,7 +250,7 @@ mod tests {
     }
 }
 
-struct LoadGuard<'a>(&'a LoadGate);
+pub(crate) struct LoadGuard<'a>(&'a LoadGate);
 
 impl Drop for LoadGuard<'_> {
     fn drop(&mut self) {
diff --git a/vendor/hayro-syntax/src/object/array.rs b/vendor/hayro-syntax/src/object/array.rs
index d39230f7db..fb136e867a 100644
--- a/vendor/hayro-syntax/src/object/array.rs
+++ b/vendor/hayro-syntax/src/object/array.rs
@@ -191,6 +191,12 @@ impl<'a> FlexArrayIter<'a> {
         self.reader.skip_white_spaces_and_comments();
 
         if !self.reader.at_end() {
+            // PdfCraft patch (32): its items each follow a reference. Read as one that might be, a
+            // reference at the start was taken for the whole group, which it can't be, and lost.
+            if T::GROUP {
+                return self.reader.read_with_context::<T>(&self.ctx);
+            }
+
             return match self.reader.read_with_context::<MaybeRef<T>>(&self.ctx)? {
                 MaybeRef::Ref(r) => self.ctx.xref().get_with::<T>(r.into(), &self.ctx),
                 MaybeRef::NotRef(i) => Some(i),
diff --git a/vendor/hayro-syntax/src/object/mod.rs b/vendor/hayro-syntax/src/object/mod.rs
index d692db8b38..6ad97b64e4 100644
--- a/vendor/hayro-syntax/src/object/mod.rs
+++ b/vendor/hayro-syntax/src/object/mod.rs
@@ -32,7 +32,11 @@ pub mod dict;
 pub mod stream;
 
 /// A trait for PDF objects.
-pub(crate) trait ObjectLike<'a>: TryFrom<Object<'a>> + Readable<'a> + Debug + Clone {}
+pub(crate) trait ObjectLike<'a>: TryFrom<Object<'a>> + Readable<'a> + Debug + Clone {
+    /// PdfCraft patch (32): whether this is several items of an array, read one by one (a tuple).
+    /// Such a thing can't itself be given by reference, so one at its start is its first item's.
+    const GROUP: bool = false;
+}
 
 /// A trait for PDF objects that can be borrowed directly from an [`Object`].
 pub(crate) trait ObjectRefLike<'a>: Sized {
diff --git a/vendor/hayro-syntax/src/object/ref.rs b/vendor/hayro-syntax/src/object/ref.rs
index 71951f4d82..3d3cbffbe1 100644
--- a/vendor/hayro-syntax/src/object/ref.rs
+++ b/vendor/hayro-syntax/src/object/ref.rs
@@ -39,10 +39,11 @@ impl From<ObjectIdentifier> for ObjRef {
 
 impl Skippable for ObjRef {
     fn skip(r: &mut Reader<'_>, _: bool) -> Option<()> {
+        // PdfCraft patch: (hayro-syntax (33)) a comment counts as white space, here too.
         r.skip::<i32>(false)?;
-        r.skip_white_spaces();
+        r.skip_white_spaces_and_comments();
         r.skip::<i32>(false)?;
-        r.skip_white_spaces();
+        r.skip_white_spaces_and_comments();
         r.forward_tag(b"R")?;
 
         Some(())
@@ -52,9 +53,9 @@ impl Skippable for ObjRef {
 impl Readable<'_> for ObjRef {
     fn read(r: &mut Reader<'_>, _: &ReaderContext<'_>) -> Option<Self> {
         let obj_ref = r.read_without_context::<i32>()?;
-        r.skip_white_spaces();
+        r.skip_white_spaces_and_comments();
         let gen_num = r.read_without_context::<i32>()?;
-        r.skip_white_spaces();
+        r.skip_white_spaces_and_comments();
         r.forward_tag(b"R")?;
 
         Some(Self::new(obj_ref, gen_num))
diff --git a/vendor/hayro-syntax/src/object/tuple.rs b/vendor/hayro-syntax/src/object/tuple.rs
index 4a7190e916..c76c1b408c 100644
--- a/vendor/hayro-syntax/src/object/tuple.rs
+++ b/vendor/hayro-syntax/src/object/tuple.rs
@@ -39,6 +39,7 @@ where
     T: ObjectLike<'a> + Debug + Clone,
     U: ObjectLike<'a> + Debug + Clone,
 {
+    const GROUP: bool = true;
 }
 
 impl<'a, T, U, V> Readable<'a> for (T, U, V)
@@ -78,6 +79,7 @@ where
     U: ObjectLike<'a> + Debug + Clone,
     V: ObjectLike<'a> + Debug + Clone,
 {
+    const GROUP: bool = true;
 }
 
 impl<'a, T, U, V, W> Readable<'a> for (T, U, V, W)
@@ -122,6 +124,7 @@ where
     V: ObjectLike<'a> + Debug + Clone,
     W: ObjectLike<'a> + Debug + Clone,
 {
+    const GROUP: bool = true;
 }
 
 impl<'a, T, U, V, W, X> Readable<'a> for (T, U, V, W, X)
@@ -171,4 +174,5 @@ where
     W: ObjectLike<'a> + Debug + Clone,
     X: ObjectLike<'a> + Debug + Clone,
 {
+    const GROUP: bool = true;
 }
diff --git a/vendor/hayro-syntax/src/xref.rs b/vendor/hayro-syntax/src/xref.rs
index 745af95556..356bad6b15 100644
--- a/vendor/hayro-syntax/src/xref.rs
+++ b/vendor/hayro-syntax/src/xref.rs
@@ -12,7 +12,7 @@ use crate::object::dict::keys::{
 };
 use crate::object::dict::{DictCache, probe_dict};
 use crate::object::indirect::IndirectObject;
-use crate::object::{Array, MaybeRef};
+use crate::object::{Array, MaybeRef, ObjRef};
 use crate::object::{DateTime, Dict};
 use crate::object::{Object, ObjectLike};
 use crate::pdf::PdfVersion;
@@ -31,6 +31,17 @@ use core::ops::Deref;
 
 pub(crate) const XREF_ENTRY_LEN: usize = 20;
 
+/// PdfCraft patch: (hayro-syntax (33)) how many references a read follows through objects that hold
+/// nothing else. Past it, as any cycle goes, the object reads as a missing one.
+const MAX_REFERENCE_HOPS: usize = 32;
+
+/// PdfCraft patch: (hayro-syntax (33)) what [`XRef::fetch`] found at an object's place.
+enum Fetched<T> {
+    Object(T),
+    /// All the object holds is a reference to this one.
+    Reference(ObjectIdentifier),
+}
+
 #[derive(Debug, Copy, Clone)]
 pub(crate) enum XRefError {
     Unknown,
@@ -492,7 +503,11 @@ impl XRef {
 
                 iter::from_fn(move || {
                     for next in iter.by_ref() {
-                        if let Some(obj) = self.get_with(next.0, &ReaderContext::new(self, false)) {
+                        // PdfCraft patch: (hayro-syntax (33)) an object that only refers to another
+                        // isn't one of its own: followed, that one came out once more for each.
+                        if let Some(Fetched::Object(obj)) =
+                            self.fetch(next.0, &ReaderContext::new(self, false))
+                        {
                             return Some(obj);
                         } else {
                             // Skip invalid objects.
@@ -563,12 +578,48 @@ impl XRef {
     }
 
     /// Return the object with the given identifier.
+    ///
+    /// PdfCraft patch: (hayro-syntax (33)) an object that holds only a reference stands for what
+    /// that names. Read as a number it was the reference's own object number, and as anything else
+    /// it was lost. This is a loop, so a long chain takes no stack.
     #[allow(private_bounds)]
     pub(crate) fn get_with<'a, T>(
         &'a self,
         id: ObjectIdentifier,
         ctx: &ReaderContext<'a>,
     ) -> Option<T>
+    where
+        T: ObjectLike<'a>,
+    {
+        let mut id = id;
+        for _ in 0..=MAX_REFERENCE_HOPS {
+            match self.fetch::<T>(id, ctx)? {
+                Fetched::Object(object) => return Some(object),
+                Fetched::Reference(next) => id = next,
+            }
+        }
+        warn!("references lead on past the limit, or in a cycle: {id:?}");
+
+        None
+    }
+
+    /// PdfCraft patch: (hayro-syntax (33)) the object stream `id`. It has to be a stream stored as
+    /// that object (ISO 32000-2 7.5.7), so this follows no reference: the check of where it is stored
+    /// is of that object, and one reached through a reference could be a stream stored inside
+    /// another.
+    pub(crate) fn object_stream<'a>(
+        &'a self,
+        id: ObjectIdentifier,
+        ctx: &ReaderContext<'a>,
+    ) -> Option<Stream<'a>> {
+        match self.fetch::<Stream<'a>>(id, ctx)? {
+            Fetched::Object(stream) => Some(stream),
+            Fetched::Reference(_) => None,
+        }
+    }
+
+    /// What is stored at the object with the given identifier.
+    fn fetch<'a, T>(&'a self, id: ObjectIdentifier, ctx: &ReaderContext<'a>) -> Option<Fetched<T>>
     where
         T: ObjectLike<'a>,
     {
@@ -597,9 +648,13 @@ impl XRef {
                 ctx.set_in_object_stream(false);
                 r.jump(offset);
 
+                if let Some(next) = held_reference(r.clone(), id) {
+                    return Some(Fetched::Reference(next));
+                }
+
                 if let Some(object) = r.read_with_context::<IndirectObject<T>>(&ctx) {
                     if object.id() == &id {
-                        return Some(object.get());
+                        return Some(Fetched::Object(object.get()));
                     }
                 } else {
                     // There is a valid object at the offset, it's just not of the type the caller
@@ -622,7 +677,7 @@ impl XRef {
                     self.repair();
 
                     // Now try reading again.
-                    self.get_with::<T>(id, &ctx)
+                    self.fetch::<T>(id, &ctx)
                 }
             }
             EntryType::ObjStream(obj_stram_gen_num, index) => {
@@ -657,11 +712,20 @@ impl XRef {
                     // A stream whose pairs don't parse stays unreadable, as it was.
                     Some(offsets) => offsets?,
                     None => {
-                        let stream = self.get_with::<Stream<'_>>(obj_stream_id, &ctx)?;
+                        // PdfCraft patch: (hayro-syntax (33)) this read can reach another object
+                        // stream, whose `/N` or `/First` can be a member of the next: the gate's
+                        // limit holds here too, or a chain of them ran out of stack. It reads the
+                        // dictionary, which is all it needs: parsing the stream reads `/Length`
+                        // too, a second way to the next stream's index, which doubled at each.
+                        let _loading = repr.data.enter_loading(obj_stream_id)?;
+                        let Fetched::Object(dict) = self.fetch::<Dict<'_>>(obj_stream_id, &ctx)?
+                        else {
+                            return None;
+                        };
                         // `/N` and `/First` may be references that can't be followed while
                         // another stream loads: reading them fails without being remembered.
-                        let num_objects = stream.dict().get::<usize>(N)?;
-                        let first_offset = stream.dict().get::<usize>(FIRST)?;
+                        let num_objects = dict.get::<usize>(N)?;
+                        let first_offset = dict.get::<usize>(FIRST)?;
                         let parsed =
                             read_object_stream_index(num_objects, first_offset, data).map(Arc::new);
                         self.with_object_stream_indexes(|indexes| {
@@ -673,7 +737,12 @@ impl XRef {
                         .unwrap_or(parsed)?
                     }
                 };
-                ObjectStream::with_offsets(data, &ctx, offsets).get(index)
+                let stream = ObjectStream::with_offsets(data, &ctx, offsets);
+                if let Some(next) = stream.reference(index) {
+                    return Some(Fetched::Reference(next));
+                }
+
+                stream.get(index).map(Fetched::Object)
             }
         }
     }
@@ -1232,6 +1301,28 @@ impl<'a> ObjectStream<'a> {
 
         r.read_with_context::<T>(&self.ctx)
     }
+
+    /// PdfCraft patch: (hayro-syntax (33)) what the object at `index` refers to, when a reference is
+    /// all it holds.
+    fn reference(&self, index: u32) -> Option<ObjectIdentifier> {
+        let offset = self.offsets.get(index as usize)?.1;
+        let mut r = Reader::new(self.data);
+        r.jump(offset);
+        r.skip_white_spaces_and_comments();
+
+        Some(r.read_without_context::<ObjRef>()?.into())
+    }
+}
+
+/// PdfCraft patch: (hayro-syntax (33)) what the indirect object `id` at `r` refers to, when a
+/// reference is all it holds.
+fn held_reference(mut r: Reader<'_>, id: ObjectIdentifier) -> Option<ObjectIdentifier> {
+    if r.read_without_context::<ObjectIdentifier>()? != id {
+        return None;
+    }
+    r.skip_white_spaces_and_comments();
+
+    Some(r.read_without_context::<ObjRef>()?.into())
 }
 
 fn parse_metadata(info_dict: &Dict<'_>) -> Metadata {
@@ -1266,6 +1357,203 @@ fn parse_metadata(info_dict: &Dict<'_>) -> Metadata {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::Pdf;
+
+    /// A file with an xref stream: `stored` are objects on their own, as they would follow
+    /// `n 0 obj`, and `packed` says of each object in an object stream which stream and place.
+    fn with_xref_stream(stored: &[(u32, Vec<u8>)], packed: &[(u32, u32, u16)]) -> Vec<u8> {
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = alloc::collections::BTreeMap::new();
+        for (num, body) in stored {
+            offsets.insert(*num, out.len());
+            out.extend_from_slice(alloc::format!("{num} 0 obj ").as_bytes());
+            out.extend_from_slice(body);
+            out.extend_from_slice(b"\nendobj\n");
+        }
+        let last = stored.iter().map(|o| o.0).chain(packed.iter().map(|o| o.0)).max().unwrap_or(0);
+        let (xref, size) = (last + 1, last + 2);
+        let at = out.len();
+        offsets.insert(xref, at);
+        let packed: alloc::collections::BTreeMap<u32, (u32, u16)> = packed.iter().map(|o| (o.0, (o.1, o.2))).collect();
+        let mut rows = Vec::new();
+        for num in 0..size {
+            if let Some(offset) = offsets.get(&num) {
+                rows.push(1);
+                rows.extend_from_slice(&(*offset as u32).to_be_bytes());
+                rows.extend_from_slice(&[0, 0]);
+            } else if let Some((stream, index)) = packed.get(&num) {
+                rows.push(2);
+                rows.extend_from_slice(&stream.to_be_bytes());
+                rows.extend_from_slice(&index.to_be_bytes());
+            } else {
+                rows.extend_from_slice(&[0; 7]);
+            }
+        }
+        out.extend_from_slice(
+            alloc::format!(
+                "{xref} 0 obj << /Type /XRef /Size {size} /W [1 4 2] /Root 1 0 R /Length {} >> stream\n",
+                rows.len()
+            )
+            .as_bytes(),
+        );
+        out.extend_from_slice(&rows);
+        out.extend_from_slice(alloc::format!("\nendstream endobj\nstartxref\n{at}\n%%EOF\n").as_bytes());
+        out
+    }
+
+    /// `/Type /ObjStm` around `members`, each stored at its offset, and `entries` of its own.
+    fn object_stream_of(members: &[(u32, &[u8])], entries: &str) -> Vec<u8> {
+        let (mut head, mut body) = (alloc::string::String::new(), Vec::new());
+        for (num, member) in members {
+            head.push_str(&alloc::format!("{num} {} ", body.len()));
+            body.extend_from_slice(member);
+            body.push(b'\n');
+        }
+        head.push('\n');
+        let dict = alloc::format!(
+            "<< /Type /ObjStm /N {} /First {} /Length {} {entries} >> stream\n",
+            members.len(),
+            head.len(),
+            head.len() + body.len()
+        );
+        let mut out = dict.into_bytes();
+        out.extend_from_slice(head.as_bytes());
+        out.extend_from_slice(&body);
+        out.extend_from_slice(b"\nendstream");
+        out
+    }
+
+    fn page_objects() -> Vec<(u32, Vec<u8>)> {
+        vec![
+            (1, b"<< /Type /Catalog /Pages 2 0 R >>".to_vec()),
+            (2, b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec()),
+            (3, b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 10 10] >>".to_vec()),
+        ]
+    }
+
+    /// An object stream is a stream stored as that object, however many references lead to one.
+    /// Object 10 holds a reference to 11, a stream stored inside object stream 12, and 31 claims to
+    /// be in 10, with 11's `/N`, `/First` or `/Length` being 31: reading it recursed until the
+    /// stack ran out. It reads as missing, and so does a member of such a stream.
+    #[test]
+    fn an_object_stream_isnt_reached_through_a_reference() {
+        for key in ["N", "First", "Length"] {
+            let inner = alloc::format!("<< /Type /ObjStm /{key} 31 0 R >> stream\n31 0 1\n\nendstream");
+            let mut stored = page_objects();
+            stored.push((10, b"11 0 R".to_vec()));
+            stored.push((12, object_stream_of(&[(11, inner.as_bytes())], "")));
+            let pdf = Pdf::new(with_xref_stream(&stored, &[(11, 12, 0), (31, 10, 0)])).unwrap();
+            assert_eq!(pdf.xref().get::<i32>(ObjectIdentifier::new(31, 0)), None, "{key}");
+        }
+        let inner = b"<< /Type /ObjStm /N 1 /First 5 /Length 8 >> stream\n20 0 7\n\nendstream";
+        let mut stored = page_objects();
+        stored.push((10, b"11 0 R".to_vec()));
+        stored.push((12, object_stream_of(&[(11, inner)], "")));
+        let pdf = Pdf::new(with_xref_stream(&stored, &[(11, 12, 0), (20, 10, 0)])).unwrap();
+        assert_eq!(pdf.xref().get::<i32>(ObjectIdentifier::new(20, 0)), None);
+    }
+
+    /// `count` object streams stored as themselves, the `keys` of each a member of the next, or
+    /// with `ring` of the first after the last. Reading the first member reads them all, and it is
+    /// `count + 100` to tell.
+    #[cfg(feature = "std")]
+    fn chain_of_object_streams(count: u32, keys: &[&str], ring: bool) -> Vec<u8> {
+        let mut stored = page_objects();
+        let mut packed = Vec::new();
+        for i in 0..count {
+            let (stream, member) = (100 + 2 * i, 101 + 2 * i);
+            let value = if i == 0 { count + 100 } else { 1 };
+            let data = alloc::format!("{member} 0 \n{value}\n");
+            let (first, length) = (alloc::format!("{}", alloc::format!("{member} 0 \n").len()), alloc::format!("{}", data.len()));
+            let next = match (i + 1 == count, ring) {
+                (true, true) => "101 0 R".into(),
+                (true, false) => "1".into(),
+                _ => alloc::format!("{} 0 R", member + 2),
+            };
+            let entry = |key, own: &'_ str| if keys.contains(&key) { next.clone() } else { own.into() };
+            let (n, first, length): (alloc::string::String, alloc::string::String, alloc::string::String) =
+                (entry("N", "1"), entry("First", &first), entry("Length", &length));
+            let body = alloc::format!("<< /Type /ObjStm /N {n} /First {first} /Length {length} >> stream\n{data}\nendstream");
+            stored.push((stream, body.into_bytes()));
+            packed.push((member, stream, 0));
+        }
+        with_xref_stream(&stored, &packed)
+    }
+
+    /// A chain of object streams, each with a member of the next for its `/N`, `/First` or
+    /// `/Length`, had no limit: one read recursed through all of them, holding a copy of the chain
+    /// at each, and 50,000 ran out of an 8 MiB stack. It stops at the gate's limit, on half the stack
+    /// of a render worker. Past that `/N` and `/First` can't be read, so the member reads as missing,
+    /// and a `/Length` that can't be read falls back on `endstream`, so it reads. A short chain reads.
+    #[cfg(feature = "std")]
+    #[test]
+    fn a_chain_of_object_streams_ends_at_the_limit_of_nested_loads() {
+        for key in ["N", "First", "Length"] {
+            let pdf = chain_of_object_streams(50_000, &[key], false);
+            std::thread::Builder::new()
+                .stack_size(1 << 20)
+                .spawn(move || {
+                    let pdf = Pdf::new(pdf).unwrap();
+                    let read = pdf.xref().get::<i32>(ObjectIdentifier::new(101, 0));
+                    assert_eq!(read, (key == "Length").then_some(50_100), "{key}");
+                })
+                .unwrap()
+                .join()
+                .unwrap();
+        }
+        let pdf = Pdf::new(chain_of_object_streams(10, &["N"], false)).unwrap();
+        assert_eq!(pdf.xref().get::<i32>(ObjectIdentifier::new(101, 0)), Some(110));
+    }
+
+    /// `/Length` and `/N` or `/First` both by reference were two ways to the next stream's index,
+    /// and an index that fails isn't remembered, so the work doubled at each stream: 65 streams, one
+    /// past the limit, in 8 KB, didn't finish, and other threads waited at the gate. The index reads
+    /// the dictionary alone now. Without that this doesn't end, so the time allowed can't fail it.
+    #[cfg(feature = "std")]
+    #[test]
+    fn a_chain_of_object_streams_takes_no_more_work_for_two_ways_on() {
+        for (count, ring) in [(65, false), (20, true), (5_000, false)] {
+            for keys in [&["Length", "N"][..], &["Length", "First"]] {
+                let pdf = chain_of_object_streams(count, keys, ring);
+                let (done, finished) = std::sync::mpsc::channel();
+                std::thread::Builder::new()
+                    .stack_size(1 << 20)
+                    .spawn(move || {
+                        let pdf = Pdf::new(pdf).unwrap();
+                        let _ = pdf.xref().get::<i32>(ObjectIdentifier::new(101, 0));
+                        let _ = done.send(());
+                    })
+                    .unwrap();
+                assert!(finished.recv_timeout(std::time::Duration::from_secs(120)).is_ok(), "{keys:?} of {count}");
+            }
+        }
+    }
+
+    /// Object 5, a member of a real object stream, holds a reference to object 6 stored on its own,
+    /// and 7, stored on its own, to 8, a member: each reads as what it names.
+    #[test]
+    fn a_reference_held_in_either_storage_is_followed() {
+        let mut stored = page_objects();
+        stored.push((6, b"42".to_vec()));
+        stored.push((7, b"8 0 R".to_vec()));
+        stored.push((9, object_stream_of(&[(5, b"6 0 R"), (8, b"43")], "")));
+        let pdf = Pdf::new(with_xref_stream(&stored, &[(5, 9, 0), (8, 9, 1)])).unwrap();
+        assert_eq!(pdf.xref().get::<i32>(ObjectIdentifier::new(5, 0)), Some(42));
+        assert_eq!(pdf.xref().get::<i32>(ObjectIdentifier::new(7, 0)), Some(43));
+    }
+
+    /// With no page tree, every page object is a page, and one that another object only refers to
+    /// is one page, not two.
+    #[test]
+    fn a_page_a_reference_is_held_to_is_found_once() {
+        let mut stored = page_objects();
+        stored[0].1 = b"<< /Type /Catalog /Pages 99 0 R >>".to_vec();
+        stored[2].1 = b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 10 10] /Contents 4 0 R >>".to_vec();
+        stored.push((4, b"<< /Length 0 >> stream\n\nendstream".to_vec()));
+        stored.push((12, b"3 0 R".to_vec()));
+        let pdf = Pdf::new(with_xref_stream(&stored, &[])).unwrap();
+        assert_eq!(pdf.pages().len(), 1);
+    }
 
     // PdfCraft patch tests (ported from craft-libs): xref stream entries are bounded by the
     // decoded data, and the type field is read at its full width.
diff --git a/xtask/src/gates.rs b/xtask/src/gates.rs
index 0212e165a5..58efe66777 100644
--- a/xtask/src/gates.rs
+++ b/xtask/src/gates.rs
@@ -116,7 +116,7 @@ pub fn ci(_: &[String]) -> anyhow::Result<()> {
         ("i18n-report", Box::new(|| i18n_report(&["--workspace".to_string()]))),
         ("layers", Box::new(|| layers(&[]))),
         ("wasm", Box::new(|| wasm(&[]))),
-        ("assets", Box::new(|| crate::assets::run(&[]))),
+        ("license-check", Box::new(|| crate::license_check::run(&[]))),
         ("deny", Box::new(|| deny(&[]))),
         ("parity", Box::new(|| crate::parity::run(&[]))),
     ];
diff --git a/xtask/src/license_check.rs b/xtask/src/license_check.rs
new file mode 100644
index 0000000000..c845101db6
--- /dev/null
+++ b/xtask/src/license_check.rs
@@ -0,0 +1,471 @@
+//! Offline source-document checks. This does not inspect completed packages or dependencies.
+use std::collections::BTreeSet;
+use std::path::Path;
+
+use anyhow::{Context, Result, bail};
+use serde::Deserialize;
+
+use crate::assets;
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Documents {
+    document: Vec<Document>,
+    bundled: Vec<Bundled>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Document {
+    source: String,
+    destination: String,
+    sha256: String,
+    /// Audited identifiers of the full licence texts in this document, not inferred from its contents.
+    #[serde(default)]
+    licences: Vec<String>,
+    #[serde(default)]
+    origin: Option<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(deny_unknown_fields)]
+struct Bundled {
+    #[serde(rename = "crate")]
+    krate: String,
+    path: String,
+    licence: String,
+    documents: Vec<String>,
+}
+
+pub fn run(args: &[String]) -> Result<()> {
+    if !args.is_empty() {
+        bail!("usage: cargo xtask license-check (no downloads or write mode)");
+    }
+    let root = assets::root();
+    // Reuse the existing policy and generated-attribution validator, once.
+    assets::run(&[])?;
+    validate(&root)?;
+    println!("license-check: source documents and licensing metadata are consistent");
+    Ok(())
+}
+
+fn validate(root: &Path) -> Result<()> {
+    let text = std::fs::read_to_string(root.join("LICENSES.toml")).context("reading LICENSES.toml")?;
+    let docs: Documents = toml::from_str(&text).context("parsing LICENSES.toml")?;
+    let attribution = assets::load(root)?;
+    let mut problems = check(root, &docs, &attribution);
+    let ocr_source = std::fs::read_to_string(root.join("crates/ocr/src/lib.rs")).context("reading OCR model filename constants")?;
+    problems.extend(check_required_ocr_metadata(&ocr_source, &attribution)?);
+    if !problems.is_empty() {
+        bail!("source licensing errors:\n{}", problems.join("\n"));
+    }
+    Ok(())
+}
+
+/// Read only the two filename constants consumed by the OCR application. Fail closed if their
+/// declaration format changes; do not guess filenames or add a dependency on the OCR engine.
+fn check_required_ocr_metadata(source: &str, attribution: &assets::Manifest) -> Result<Vec<String>> {
+    let mut problems = Vec::new();
+    for name in ["DETECTION_MODEL", "RECOGNITION_MODEL"] {
+        let prefix = format!("pub const {name}: &str = \"");
+        let declarations: Vec<_> = source.lines().map(str::trim).filter_map(|line| line.strip_prefix(&prefix)).collect();
+        let file = declarations.first().and_then(|value| value.strip_suffix("\";"));
+        let Some(file) = file.filter(|file| declarations.len() == 1 && safe_path(file) && !file.contains('/')) else {
+            bail!(
+                "OCR constant {name}: expected one literal filename declaration in crates/ocr/src/lib.rs; update the source validator if its syntax changed"
+            );
+        };
+        let entries: Vec<_> = attribution.fetched.iter().filter(|f| f.file == file).collect();
+        if entries.is_empty() {
+            problems.push(format!("{file}: required OCR licensing metadata missing from ATTRIBUTION.toml"));
+        } else {
+            if entries.len() != 1 {
+                problems.push(format!("{file}: required OCR licensing metadata must have exactly one entry"));
+            }
+            if entries.iter().any(|f| f.kind != "model") {
+                problems.push(format!("{file}: required OCR licensing metadata must have kind = \"model\""));
+            }
+        }
+    }
+    Ok(problems)
+}
+
+/// The audited bundle inventory currently uses identifiers and flat AND/OR expressions only.
+/// Keep their semantics distinct, and fail closed on mixed operators, grouping or exceptions
+/// rather than introducing a general SPDX parser or flattening an unsupported expression.
+fn licence_coverage(expression: &str, covered: &BTreeSet<&str>) -> Result<bool> {
+    let mut tokens = expression.split_whitespace();
+    let Some(first) = tokens.next().filter(|id| assets::ALLOWED_LICENCES.contains(id)) else {
+        bail!("unsupported bundle licence expression `{expression}`");
+    };
+    let mut ids = vec![first];
+    let mut operator = None;
+    while let Some(op) = tokens.next() {
+        if !matches!(op, "AND" | "OR") || operator.is_some_and(|previous| previous != op) {
+            bail!("unsupported bundle licence expression `{expression}`; audit its applicability before extending the validator");
+        }
+        operator = Some(op);
+        let Some(id) = tokens.next().filter(|id| assets::ALLOWED_LICENCES.contains(id)) else {
+            bail!("unsupported bundle licence expression `{expression}`");
+        };
+        ids.push(id);
+    }
+    Ok(if operator == Some("OR") { ids.iter().any(|id| covered.contains(id)) } else { ids.iter().all(|id| covered.contains(id)) })
+}
+
+// A portable relative path, including on Windows; reject aliases before comparing mappings.
+fn safe_path(s: &str) -> bool {
+    !s.is_empty()
+        && !s.contains(['\\', ':'])
+        && s.split('/').all(|p| {
+            !p.is_empty()
+                && p != "."
+                && p != ".."
+                && !p.ends_with(['.', ' '])
+                && p.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.'))
+                && !matches!(
+                    p.split('.').next().unwrap_or_default().to_ascii_uppercase().as_str(),
+                    "CON"
+                        | "PRN"
+                        | "AUX"
+                        | "NUL"
+                        | "COM1"
+                        | "COM2"
+                        | "COM3"
+                        | "COM4"
+                        | "COM5"
+                        | "COM6"
+                        | "COM7"
+                        | "COM8"
+                        | "COM9"
+                        | "LPT1"
+                        | "LPT2"
+                        | "LPT3"
+                        | "LPT4"
+                        | "LPT5"
+                        | "LPT6"
+                        | "LPT7"
+                        | "LPT8"
+                        | "LPT9"
+                )
+        })
+}
+
+fn hash(s: &str) -> bool {
+    s.len() == 64 && s.bytes().all(|b| b.is_ascii_hexdigit())
+}
+
+fn check(root: &Path, docs: &Documents, attribution: &assets::Manifest) -> Vec<String> {
+    let mut problems = Vec::new();
+    let mut sources = BTreeSet::new();
+    let mut destinations = BTreeSet::new();
+    for d in &docs.document {
+        if !safe_path(&d.source) || !safe_path(&d.destination) {
+            problems.push(format!("{}: unsafe document source or destination", d.source));
+            continue;
+        }
+        let new_source = sources.insert(d.source.as_str());
+        let new_destination = destinations.insert(d.destination.to_ascii_lowercase());
+        if !new_source || !new_destination {
+            problems.push(format!("{}: duplicate document source or destination", d.source));
+        }
+        if d.origin.as_ref().is_some_and(|u| !u.starts_with("https://") || u.trim().len() <= 8) {
+            problems.push(format!("{}: invalid document origin", d.source));
+        }
+        let mut identifiers = BTreeSet::new();
+        for id in &d.licences {
+            if !assets::ALLOWED_LICENCES.contains(&id.as_str()) || !identifiers.insert(id.as_str()) {
+                problems.push(format!("{}: invalid or duplicate audited licence identifier `{id}`", d.source));
+            }
+        }
+        let path = root.join(&d.source);
+        // Canonical confinement also catches symlinks escaping the checkout.
+        let confined = root.canonicalize().and_then(|r| path.canonicalize().map(|p| p.starts_with(r))).unwrap_or(false);
+        if !confined || !path.is_file() {
+            problems.push(format!("{}: required document missing or outside checkout", d.source));
+            continue;
+        }
+        match std::fs::read_to_string(&path) {
+            Ok(text) if !text.trim().is_empty() && !text.contains('\0') => {
+                if !hash(&d.sha256) || assets::sha256_hex(text.as_bytes()) != d.sha256 {
+                    problems.push(format!("{}: document hash mismatch; re-audit the source before updating LICENSES.toml", d.source));
+                }
+            }
+            _ => problems.push(format!("{}: required document empty or invalid UTF-8 text", d.source)),
+        }
+    }
+    for destination in &destinations {
+        for (i, _) in destination.match_indices('/') {
+            if destination.get(..i).is_some_and(|prefix| destinations.contains(prefix)) {
+                problems.push(format!("{destination}: document destination conflicts with a parent file"));
+            }
+        }
+    }
+    for required in ["LICENSE-MIT", "LICENSE-APACHE", "NOTICE", "vendor/hayro-interpret/assets/LICENSE_FOXIT"]
+        .into_iter()
+        .chain(attribution.asset.iter().map(|a| a.licence_file.as_str()))
+    {
+        if !sources.contains(required) {
+            problems.push(format!("{required}: required document has no LICENSES.toml mapping"));
+        }
+    }
+    // One mapping per bundled asset, using the existing attribution's licence expression.
+    let mut seen = BTreeSet::new();
+    for b in &docs.bundled {
+        if !seen.insert((b.krate.as_str(), b.path.as_str())) {
+            problems.push(format!("{} {}: duplicate bundled mapping", b.krate, b.path));
+        }
+        if !attribution.bundled.iter().any(|a| a.krate == b.krate && a.path == b.path && a.licence == b.licence) {
+            problems.push(format!("{} {}: bundled mapping disagrees with ATTRIBUTION.toml", b.krate, b.path));
+        }
+        if b.documents.is_empty() || b.documents.iter().any(|d| !sources.contains(d.as_str())) {
+            problems.push(format!("{} {}: bundled licence documents missing", b.krate, b.path));
+        }
+        for document in docs.document.iter().filter(|d| b.documents.contains(&d.source)) {
+            if !document.licences.iter().any(|id| b.licence.split_whitespace().any(|token| token == id)) {
+                problems.push(format!("{} {}: inapplicable mapped document {}", b.krate, b.path, document.source));
+            }
+        }
+        let covered: BTreeSet<_> =
+            docs.document.iter().filter(|d| b.documents.contains(&d.source)).flat_map(|d| d.licences.iter().map(String::as_str)).collect();
+        match licence_coverage(&b.licence, &covered) {
+            Ok(true) => {}
+            Ok(false) => problems
+                .push(format!("{} {}: inapplicable licence documents; mapped audited identifiers do not cover `{}`", b.krate, b.path, b.licence)),
+            Err(error) => problems.push(format!("{} {}: {error}", b.krate, b.path)),
+        }
+    }
+    for b in &attribution.bundled {
+        if !seen.contains(&(b.krate.as_str(), b.path.as_str())) {
+            problems.push(format!("{} {}: bundled asset has no licence document mapping", b.krate, b.path));
+        }
+    }
+    for a in attribution.asset.iter().filter(|a| a.licence_file == "assets/icons/LICENSE-lucide.txt") {
+        if a.licence != "ISC AND MIT" {
+            problems.push(format!("{}: Lucide collection must credit ISC and Feather MIT", a.path));
+        }
+    }
+    check_model_metadata(attribution, &mut problems);
+    problems
+}
+
+fn check_model_metadata(attribution: &assets::Manifest, problems: &mut Vec<String>) {
+    let mut model_paths = BTreeSet::new();
+    for f in attribution.fetched.iter().filter(|f| f.kind == "model") {
+        if [f.title.as_str(), &f.author, &f.source, &f.usage, &f.licence].iter().any(|v| v.trim().is_empty())
+            || !hash(&f.sha256)
+            || !hash(&f.licence_sha256)
+            || !f.url.starts_with("https://")
+            || !f.licence_url.starts_with("https://")
+        {
+            problems.push(format!("{}: incomplete OCR model licensing metadata", f.file));
+        }
+        for path in [f.file.clone(), format!("{}.LICENCE.txt", f.file)] {
+            if !safe_path(&path)
+                || path.contains('/')
+                || path.eq_ignore_ascii_case("ATTRIBUTION.txt")
+                || !model_paths.insert(path.to_ascii_lowercase())
+            {
+                problems.push(format!("{}: duplicate or unsafe OCR model destination", f.file));
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    fn fixture() -> (std::path::PathBuf, Documents) {
+        static NEXT: AtomicU64 = AtomicU64::new(0);
+        let root = std::env::temp_dir().join(format!("pdfcraft-license-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+        std::fs::create_dir_all(&root).unwrap();
+        let document = ["LICENSE-MIT", "LICENSE-APACHE", "NOTICE", "vendor/hayro-interpret/assets/LICENSE_FOXIT"]
+            .into_iter()
+            .map(|p| {
+                let path = root.join(p);
+                std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+                std::fs::write(path, "synthetic licence text\n").unwrap();
+                Document {
+                    source: p.into(),
+                    destination: p.into(),
+                    sha256: assets::sha256_hex(b"synthetic licence text\n"),
+                    licences: match p {
+                        "LICENSE-MIT" => vec!["MIT".into()],
+                        "LICENSE-APACHE" => vec!["Apache-2.0".into()],
+                        _ => vec![],
+                    },
+                    origin: None,
+                }
+            })
+            .collect();
+        (root, Documents { document, bundled: vec![] })
+    }
+
+    #[test]
+    fn missing_license_fails_and_restoring_recovers() {
+        let (root, docs) = fixture();
+        let m = assets::Manifest::default();
+        assert!(check(&root, &docs, &m).is_empty());
+        std::fs::remove_file(root.join("LICENSE-MIT")).unwrap();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("LICENSE-MIT: required document missing")));
+        std::fs::write(root.join("LICENSE-MIT"), "synthetic licence text\n").unwrap();
+        assert!(check(&root, &docs, &m).is_empty());
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn empty_invalid_and_changed_documents_fail() {
+        let (root, docs) = fixture();
+        for text in [b" ".as_slice(), b"\xff", b"changed licence", b"text\0"] {
+            std::fs::write(root.join("NOTICE"), text).unwrap();
+            assert!(!check(&root, &docs, &assets::Manifest::default()).is_empty());
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn duplicate_and_unsafe_destinations_fail() {
+        let (root, mut docs) = fixture();
+        for dest in ["license-mit", "../NOTICE", "/NOTICE", "C:/NOTICE", "a\\NOTICE", "a//NOTICE", "CON.txt", "NOTICE."] {
+            docs.document.get_mut(2).unwrap().destination = dest.into();
+            assert!(!check(&root, &docs, &assets::Manifest::default()).is_empty(), "{dest}");
+        }
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn removing_required_mapping_fails() {
+        let (root, mut docs) = fixture();
+        docs.document.retain(|d| d.source != "LICENSE-MIT");
+        assert!(check(&root, &docs, &assets::Manifest::default()).iter().any(|p| p.contains("LICENSE-MIT: required document has no")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn bundled_documents_must_match_attribution() {
+        let (root, mut docs) = fixture();
+        let mut m = assets::Manifest::default();
+        m.bundled.push(assets::Bundled {
+            krate: "synthetic".into(),
+            version: "1.0.0".into(),
+            path: "font.ttf".into(),
+            title: "test".into(),
+            author: "test".into(),
+            source: "https://example.org".into(),
+            licence: "MIT".into(),
+            kind: "font".into(),
+            usage: "test".into(),
+            sha256: "a".repeat(64),
+            adobe_data: false,
+        });
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("no licence document mapping")));
+        docs.bundled.push(Bundled {
+            krate: "synthetic".into(),
+            path: "font.ttf".into(),
+            licence: "MIT".into(),
+            documents: vec!["LICENSE-MIT".into()],
+        });
+        assert!(check(&root, &docs, &m).is_empty());
+        docs.bundled.get_mut(0).unwrap().documents = vec!["LICENSE-APACHE".into()];
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("inapplicable")));
+        docs.bundled.get_mut(0).unwrap().documents = vec!["LICENSE-MIT".into(), "LICENSE-APACHE".into()];
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("inapplicable mapped document")));
+        docs.bundled.get_mut(0).unwrap().documents = vec!["LICENSE-MIT".into()];
+        docs.bundled.get_mut(0).unwrap().licence = "ISC".into();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("disagrees")));
+        docs.bundled.get_mut(0).unwrap().documents.clear();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("documents missing")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn ocr_metadata_and_destinations_are_checked_without_models() {
+        let (root, docs) = fixture();
+        let mut m = assets::Manifest::default();
+        m.fetched.push(assets::Fetched {
+            file: "synthetic.rten".into(),
+            url: "https://example.org/model".into(),
+            title: "test model".into(),
+            author: "test".into(),
+            source: "https://example.org/card".into(),
+            licence: "CC-BY-SA-4.0".into(),
+            licence_url: "https://example.org/licence".into(),
+            licence_sha256: "a".repeat(64),
+            kind: "model".into(),
+            usage: "test".into(),
+            sha256: "b".repeat(64),
+        });
+        assert!(check(&root, &docs, &m).is_empty());
+        m.fetched.get_mut(0).unwrap().licence_sha256 = "z".repeat(64);
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("incomplete OCR")));
+        m.fetched.get_mut(0).unwrap().file = "../outside.rten".into();
+        assert!(check(&root, &docs, &m).iter().any(|p| p.contains("unsafe OCR")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[test]
+    fn required_ocr_models_cannot_be_missing() {
+        let source = include_str!("../../crates/ocr/src/lib.rs");
+        let original = assets::load(&assets::root()).unwrap();
+        assert_eq!(original.fetched.iter().filter(|f| f.kind == "model").count(), 2);
+        assert!(check_required_ocr_metadata(source, &original).unwrap().is_empty());
+        for model in original.fetched.iter().filter(|f| f.kind == "model") {
+            let mut m = assets::load(&assets::root()).unwrap();
+            m.fetched.retain(|f| f.file != model.file);
+            assert!(check_required_ocr_metadata(source, &m).unwrap().iter().any(|p| p.contains(&model.file) && p.contains("missing")));
+        }
+    }
+
+    #[test]
+    fn required_ocr_models_cannot_be_misclassified() {
+        let source = include_str!("../../crates/ocr/src/lib.rs");
+        let original = assets::load(&assets::root()).unwrap();
+        assert_eq!(original.fetched.iter().filter(|f| f.kind == "model").count(), 2);
+        for model in original.fetched.iter().filter(|f| f.kind == "model") {
+            let mut m = assets::load(&assets::root()).unwrap();
+            m.fetched.iter_mut().find(|f| f.file == model.file).unwrap().kind = "font".into();
+            assert!(check_required_ocr_metadata(source, &m).unwrap().iter().any(|p| p.contains(&model.file) && p.contains("kind")));
+        }
+    }
+
+    #[test]
+    fn licence_alternatives_and_combined_obligations_are_distinct() {
+        let mit = BTreeSet::from(["MIT"]);
+        assert!(licence_coverage("MIT OR Apache-2.0", &mit).unwrap());
+        assert!(!licence_coverage("MIT AND Apache-2.0", &mit).unwrap());
+        let both = BTreeSet::from(["MIT", "Bitstream-Vera"]);
+        assert!(licence_coverage("MIT AND Bitstream-Vera", &both).unwrap());
+        assert!(!licence_coverage("MIT OR Apache-2.0", &BTreeSet::from(["OFL-1.1"])).unwrap());
+        for expression in ["", "MIT AND", "MIT OR Apache-2.0 AND ISC", "(MIT OR Apache-2.0)", "MIT WITH exception"] {
+            assert!(licence_coverage(expression, &both).is_err(), "{expression}");
+        }
+    }
+
+    #[test]
+    fn changed_ocr_constant_syntax_fails_closed() {
+        assert!(check_required_ocr_metadata("", &assets::Manifest::default()).is_err());
+    }
+
+    #[test]
+    fn parent_file_destination_conflicts_fail() {
+        let (root, mut docs) = fixture();
+        docs.document.get_mut(2).unwrap().destination = "LICENSE-MIT/NOTICE".into();
+        assert!(check(&root, &docs, &assets::Manifest::default()).iter().any(|p| p.contains("parent file")));
+        std::fs::remove_dir_all(root).unwrap();
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn symlink_escape_fails() {
+        let (root, docs) = fixture();
+        let outside = root.with_extension("outside");
+        std::fs::write(&outside, "synthetic licence text\n").unwrap();
+        std::fs::remove_file(root.join("LICENSE-MIT")).unwrap();
+        std::os::unix::fs::symlink(&outside, root.join("LICENSE-MIT")).unwrap();
+        assert!(check(&root, &docs, &assets::Manifest::default()).iter().any(|p| p.contains("outside checkout")));
+        std::fs::remove_dir_all(root).unwrap();
+        std::fs::remove_file(outside).unwrap();
+    }
+}
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 24ddd16d16..8e3255d5e6 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -8,6 +8,7 @@ mod demo_pdf;
 mod fuzz;
 mod gates;
 mod layers;
+mod license_check;
 mod macos_integration;
 mod parity;
 mod screenshots;
@@ -23,11 +24,12 @@ const COMMANDS: &[(&str, &str, Command)] = &[
     ("deny", "Dependency licences, bans, sources and advisories (deny.toml; needs cargo-deny)", gates::deny),
     (
         "ci",
-        "fmt --check, clippy -D warnings, the CLI without default features, test, i18n-report, layers, wasm, assets, deny, parity (stops at first failure)",
+        "fmt --check, clippy -D warnings, the CLI without default features, test, i18n-report, layers, wasm, license-check, deny, parity (stops at first failure)",
         gates::ci,
     ),
     ("test", "Workspace tests: cargo nextest (cargo test when it is missing), then doctests", gates::test),
     ("i18n-report", "Print the strings each interface language lacks (counts and a few keys); never fails", gates::i18n_report),
+    ("license-check", "Offline source licence documents, attribution and metadata", license_check::run),
     ("assets", "Enforce the asset policy (AGENTS.md §1) against ATTRIBUTION.toml; --write regenerates ATTRIBUTION.md", assets::run),
     ("corpus", "Fetch the pinned pdf.js test corpus into corpus/ (git-ignored) and verify it; --update-pin re-records the pin", gates::corpus),
     ("check", "Robustness sweep over corpus/ with pdfcraft-cli; fails on crashes or regressions vs xtask/baselines", gates::check),