diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e0c05964..48bb2549 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,13 +27,13 @@ jobs:
         # and release.yml builds macOS (a failing release is fixed and rebuilt).
         os: [ubuntu-latest, windows-latest]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # The optional craft-fonts build input (Japanese fonts), so the Japanese font tests run on
       # Linux; Windows tests the build without it. See craftrules standards/fonts.md.
       - name: Check out craft-fonts (Linux)
         if: runner.os == 'Linux'
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: storytold/craft-fonts
           ref: 8dcdacd5153e64560d109541a47d806f26f048c0
@@ -47,8 +47,9 @@ jobs:
             libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev \
             libgl1-mesa-dev libgtk-3-dev
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
         with:
+          toolchain: stable
           components: clippy, rustfmt
 
       - name: Require Windows executable resources
@@ -56,7 +57,7 @@ jobs:
         run: Add-Content -Path $env:GITHUB_ENV -Value 'PDFCRAFT_REQUIRE_WINRES=1'
         shell: pwsh
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
       - name: Format
         if: runner.os == 'Linux'
@@ -91,11 +92,12 @@ jobs:
     name: wasm32 check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
         with:
+          toolchain: stable
           targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: wasm32
       - name: Check library crates for wasm32
@@ -105,7 +107,7 @@ jobs:
     name: dependency licences and advisories
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
           command: check
@@ -115,9 +117,11 @@ jobs:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: fuzz
       - name: Fetch the pdf.js corpus (seeds)
@@ -126,7 +130,7 @@ jobs:
         run: cargo xtask fuzz --time 900 --seed ${{ github.run_number }}
       - name: Upload findings
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: fuzz-findings
           path: fuzz-out/findings
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
index b852d863..37e9fbde 100644
--- a/.github/workflows/freebsd.yml
+++ b/.github/workflows/freebsd.yml
@@ -23,30 +23,7 @@ permissions:
 
 jobs:
   freebsd:
-    name: FreeBSD 14 (build + test)
-    runs-on: ubuntu-latest
-    timeout-minutes: 300
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build and test in a FreeBSD VM
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc # v1
-        with:
-          release: "14.3"
-          usesh: true
-          cpu: 4
-          mem: 12288
-          # Nothing to bring back; copying the target dir out of the VM fails on large builds.
-          copyback: false
-          prepare: |
-            pkg install -y bash git curl pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2 alsa-lib
-            curl -fsSL https://sh.rustup.rs | sh -s -- -y --profile minimal
-          run: |
-            . "$HOME/.cargo/env"
-            # The checkout is synced in under another owner; let tests that call git read it.
-            git config --global --add safe.directory "*"
-            rustc --version
-            CARGO_PROFILE_DEV_DEBUG=0 cargo build --workspace --all-targets --locked
-            CARGO_PROFILE_DEV_DEBUG=0 cargo test --workspace --locked
-            # The release packaging, end to end (a quicker release profile than the real release).
-            CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 packaging/freebsd/package.sh
-            tar -tzf dist/release/pdfcraft-*-freebsd-*.tar.gz | grep -E '/bin/pdfcraft$|/bin/pdfcraft-cli$|applications/|/share/pdfcraft/models/.+\.rten$'
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/freebsd.yml@main
+    with:
+      craft-fonts-ref: 8dcdacd5153e64560d109541a47d806f26f048c0
diff --git a/.github/workflows/packaging-lint.yml b/.github/workflows/packaging-lint.yml
index aed79a90..f54b0538 100644
--- a/.github/workflows/packaging-lint.yml
+++ b/.github/workflows/packaging-lint.yml
@@ -19,48 +19,5 @@ concurrency:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
-    env:
-      ACTIONLINT_VERSION: 1.7.12
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends shellcheck desktop-file-utils appstream libxml2-utils python3-yaml
-          curl -fsSL "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
-            | tar -xz -C "$RUNNER_TEMP" actionlint
-      - name: actionlint
-        run: |
-          "$RUNNER_TEMP/actionlint" -color
-      - name: shellcheck
-        run: shellcheck packaging/*.sh packaging/*/*.sh
-      - name: PowerShell
-        shell: pwsh
-        run: |
-          foreach ($f in Get-ChildItem packaging/windows/*.ps1) {
-            $errors = $null
-            [System.Management.Automation.Language.Parser]::ParseFile($f.FullName, [ref]$null, [ref]$errors) | Out-Null
-            if ($errors) { $errors | ForEach-Object { Write-Output "::error file=$($f.Name)::$_" }; exit 1 }
-            Write-Output "ok $($f.Name)"
-          }
-      - name: XML, desktop entry, AppStream, Flatpak manifest
-        run: |
-          xmllint --noout packaging/windows/*.wxs packaging/macos/*.plist* packaging/linux/*.xml*
-          # Windows Installer needs Icon ids ending in .ico or .exe, or shortcuts show a blank icon (#57).
-          if grep -oE '<Icon Id="[^"]*"' packaging/windows/pdfcraft.wxs | grep -vE '\.(ico|exe)"$'; then
-            echo "::error file=packaging/windows/pdfcraft.wxs::Icon Id must end in .ico or .exe"; exit 1
-          fi
-          desktop-file-validate packaging/linux/ai.storyteller.pdfcraft.desktop
-          sed -e 's/@VERSION@/0.0.0/' -e 's/@DATE@/2026-01-01/' packaging/linux/ai.storyteller.pdfcraft.metainfo.xml.in >"$RUNNER_TEMP/ai.storyteller.pdfcraft.metainfo.xml"
-          appstreamcli validate --no-net --explain "$RUNNER_TEMP/ai.storyteller.pdfcraft.metainfo.xml"
-          python3 - <<'EOF'
-          import yaml
-          src = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.pdfcraft.yml"))
-          bundle = yaml.safe_load(open("packaging/linux/flatpak/ai.storyteller.pdfcraft.bundle.yml"))
-          for m in (src, bundle):
-              assert m["id"] == "ai.storyteller.pdfcraft" and m["command"] == "pdfcraft", m["id"]
-          for key in ("runtime", "runtime-version", "sdk", "finish-args"):
-              assert src[key] == bundle[key], f"Flatpak manifests disagree on {key}: {src[key]} vs {bundle[key]}"
-          print("Flatpak manifests ok")
-          EOF
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/packaging-lint.yml@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index af34d040..b5929d06 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,12 +1,3 @@
-# Release pipeline: every push to `release` builds signed installers for every platform and
-# creates or updates the draft GitHub Release "PdfCraft v<version>". See docs/releasing.md.
-#
-# The jobs that sign (macOS, Windows) and the one that drafts the release run in the `release`
-# environment (restricted to the `release` branch), which holds the signing secrets. Every secret
-# is optional: missing ones produce unsigned artifacts and a warning, never a failed build. The
-# other jobs use no secrets and so no environment: a dispatch on another branch builds and checks
-# them (a dry run), while the signing jobs are refused there and the draft-release job, which
-# needs them, is skipped.
 name: Release
 
 on:
@@ -20,494 +11,27 @@ on:
         default: ""
 
 permissions:
-  contents: read
+  contents: write
 
 concurrency:
   group: release-${{ github.ref }}
-  # Never cancel a run mid-notarization or mid-upload; a newer push waits its turn.
   cancel-in-progress: false
 
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: 0
-  RUST_BACKTRACE: 1
-  PDFCRAFT_BUILD_SHA: ${{ github.sha }}
-  INPUT_VERSION: ${{ inputs.version }}
-
 jobs:
-  version:
-    name: version
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.v.outputs.version }}
-      date: ${{ steps.v.outputs.date }}
-      prerelease: ${{ steps.v.outputs.prerelease }}
-    steps:
-      - uses: actions/checkout@v4
-      - id: v
-        name: Resolve version
-        run: |
-          . packaging/env.sh
-          v="${INPUT_VERSION#v}"
-          v="${v:-$VERSION}"
-          if ! printf '%s' "$v" | grep -Eq '^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'; then
-            echo "::error::'$v' is not a version like 1.2.3 or 1.2.3-rc.1"
-            exit 1
-          fi
-          case "$v" in *-*) pre=true ;; *) pre=false ;; esac
-          {
-            echo "version=$v"
-            echo "date=$(date -u +%Y-%m-%d)"
-            echo "prerelease=$pre"
-          } >>"$GITHUB_OUTPUT"
-          echo "### PdfCraft v$v (\`${GITHUB_SHA::9}\`)" >>"$GITHUB_STEP_SUMMARY"
-
-  macos:
-    name: macOS universal
-    needs: version
-    runs-on: macos-15-xlarge  # M2 Pro larger runner; use only in release.yml (actions_macos_xl budget caps spend)
-    environment: release
-    env:
-      PDFCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      PDFCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      # The craft-fonts build input (Japanese fonts): every release embeds it. Bump deliberately.
-      - name: Check out craft-fonts
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          repository: storytold/craft-fonts
-          ref: 8dcdacd5153e64560d109541a47d806f26f048c0
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: aarch64-apple-darwin, x86_64-apple-darwin
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-macos-universal
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo xtask version set "$PDFCRAFT_VERSION"
-      - name: Import signing certificate
-        env:
-          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
-          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
-        run: packaging/macos/import-cert.sh
-      - name: Build, sign, notarize
-        env:
-          APPLE_ID: ${{ secrets.APPLE_ID }}
-          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: packaging/macos/package.sh --arch universal
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-macos
-          path: dist/release/*
-          if-no-files-found: error
-      - name: Remove temporary keychain
-        if: always()
-        run: |
-          if [ -n "${MACOS_KEYCHAIN:-}" ]; then security delete-keychain "$MACOS_KEYCHAIN" || true; fi
-
-  windows:
-    name: Windows ${{ matrix.arch }}
-    needs: version
-    runs-on: windows-latest
-    environment: release
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x64, target: x86_64-pc-windows-msvc }
-          - { arch: x86, target: i686-pc-windows-msvc }
-          # Windows on ARM (#61): cross-compiled on the x64 runner, so signing and WiX run as above.
-          # .github/workflows/windows-arm64.yml installs and runs it on ARM64 hardware.
-          - { arch: arm64, target: aarch64-pc-windows-msvc }
-    env:
-      PDFCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      PDFCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      # The craft-fonts build input (Japanese fonts): every release embeds it. Bump deliberately.
-      - name: Check out craft-fonts
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          repository: storytold/craft-fonts
-          ref: 8dcdacd5153e64560d109541a47d806f26f048c0
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-windows-${{ matrix.arch }}
-      - name: Apply version override
-        if: inputs.version != ''
-        shell: bash
-        run: cargo xtask version set "$PDFCRAFT_VERSION"
-      - name: Install WiX
-        shell: pwsh
-        run: dotnet tool install --global wix --version 5.0.2
-      - name: Build, sign, package
-        shell: pwsh
-        env:
-          WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
-          WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
-          AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
-          AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
-          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-          AZURE_SIGNING_ENDPOINT: ${{ secrets.AZURE_SIGNING_ENDPOINT }}
-          AZURE_SIGNING_ACCOUNT: ${{ secrets.AZURE_SIGNING_ACCOUNT }}
-          AZURE_CERT_PROFILE: ${{ secrets.AZURE_CERT_PROFILE }}
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: ./packaging/windows/package.ps1 -Arch ${{ matrix.arch }}
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-windows-${{ matrix.arch }}
-          path: dist/release/*
-          if-no-files-found: error
-
-  linux:
-    name: Linux ${{ matrix.arch }}
-    needs: version
-    # The oldest GitHub-hosted image, so the binaries only need glibc >= 2.35 (Ubuntu 22.04+,
-    # Debian 12+, Fedora 36+, RHEL 10). See docs/releasing.md.
-    runs-on: ${{ matrix.runner }}
-    # No `environment: release`: this job signs nothing, so it gets no release secrets.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x86_64, runner: ubuntu-22.04, deb: amd64 }
-          - { arch: aarch64, runner: ubuntu-22.04-arm, deb: arm64 }
-    env:
-      PDFCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      PDFCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-      NFPM_VERSION: 2.47.0
-    steps:
-      - uses: actions/checkout@v4
-      # The craft-fonts build input (Japanese fonts): every release embeds it. Bump deliberately.
-      - name: Check out craft-fonts
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          repository: storytold/craft-fonts
-          ref: 8dcdacd5153e64560d109541a47d806f26f048c0
-          path: craft-fonts
-      - name: Install build and packaging tools
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
-            libxkbcommon-dev libwayland-dev libx11-dev libxrandr-dev libxi-dev libgl1-mesa-dev \
-            desktop-file-utils appstream python3-yaml zsync
-          curl -fsSL -o "$RUNNER_TEMP/nfpm.deb" \
-            "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${{ matrix.deb }}.deb"
-          sudo dpkg -i "$RUNNER_TEMP/nfpm.deb"
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-linux-${{ matrix.arch }}
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo xtask version set "$PDFCRAFT_VERSION"
-      - name: Build and package (AppImage, deb, rpm, tar.gz, CLI tar.gz)
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: packaging/linux/package.sh
-      - name: Check the packages
-        run: |
-          dpkg-deb --info dist/release/*.deb
-          dpkg-deb --contents dist/release/*.deb | grep -E 'usr/bin/pdfcraft$|metainfo|applications'
-          # The OCR models (#103), where the installed app looks: <bin>/../share/pdfcraft/models.
-          dpkg-deb --contents dist/release/*.deb | grep -E 'usr/share/pdfcraft/models/.+\.rten$'
-          # Named exactly: dist/release also holds the CLI-only tar.gz, and `tar -tzf a b` reads b as a member.
-          tar -tzf "dist/release/pdfcraft-$PDFCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz" | grep -E '/share/pdfcraft/models/.+\.rten$'
-          ldd target/release/pdfcraft
-          # The CLI-only archive: the binary and its licences, and it runs.
-          cli="dist/release/pdfcraft-cli-$PDFCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
-          tar -tzf "$cli" | grep -E '/pdfcraft-cli$'
-          tar -tzf "$cli" | grep -E '/LICENSE-APACHE$'
-          mkdir -p "$RUNNER_TEMP/cli" && tar -xzf "$cli" -C "$RUNNER_TEMP/cli"
-          "$RUNNER_TEMP/cli/pdfcraft-cli-$PDFCRAFT_VERSION-linux-${{ matrix.arch }}/pdfcraft-cli" --version
-          python3 -c "import yaml; m = yaml.safe_load(open('packaging/linux/flatpak/ai.storyteller.pdfcraft.yml')); assert m['id'] == 'ai.storyteller.pdfcraft'"
-          for appimage in dist/release/*.AppImage; do
-            chmod +x "$appimage"
-            APPIMAGE_EXTRACT_AND_RUN=1 "$appimage" --version
-            # Update information is embedded, and the .zsync for delta updates sits beside it.
-            "$appimage" --appimage-updateinformation | grep -F 'gh-releases-zsync|'
-            test -s "$appimage.zsync"
-          done
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-linux-${{ matrix.arch }}
-          path: dist/release/*
-          if-no-files-found: error
-
-  linux-riscv64:
-    name: Linux riscv64
-    needs: version
-    # Cross-compiled on x86_64 (no hosted RISC-V runners) against the runner's own Ubuntu release
-    # from ports.ubuntu.com, so the binaries need that release's glibc (24.04: 2.39). 22.04's
-    # riscv64 ports lag its amd64 updates, which breaks the multiarch install. tar.gz only (the
-    # app tree and the CLI-only archive); the CLI is smoke-tested under QEMU.
-    runs-on: ubuntu-24.04
-    # No `environment: release`: this job signs nothing, so it gets no release secrets.
-    env:
-      PDFCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      PDFCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      # The craft-fonts build input (Japanese fonts): every release embeds it. Bump deliberately.
-      - name: Check out craft-fonts
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          repository: storytold/craft-fonts
-          ref: 8dcdacd5153e64560d109541a47d806f26f048c0
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: riscv64gc-unknown-linux-gnu
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-linux-riscv64
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo xtask version set "$PDFCRAFT_VERSION"
-      - name: Install cross-compilation dependencies
-        run: |
-          . /etc/os-release
-          sudo dpkg --add-architecture riscv64
-          # Pin the existing (archive.ubuntu.com) sources to amd64; riscv64 comes from ports.
-          if [ -f /etc/apt/sources.list.d/ubuntu.sources ]; then
-            sudo sed -i '/^Types: deb/a Architectures: amd64' /etc/apt/sources.list.d/ubuntu.sources
-          fi
-          if [ -f /etc/apt/sources.list ]; then
-            sudo sed -i 's/^deb /deb [arch=amd64] /g' /etc/apt/sources.list
-            sudo sed -i 's/^deb-src /deb-src [arch=amd64] /g' /etc/apt/sources.list
-          fi
-          for suite in "$VERSION_CODENAME" "$VERSION_CODENAME-updates" "$VERSION_CODENAME-security"; do
-            echo "deb [arch=riscv64] http://ports.ubuntu.com/ubuntu-ports $suite main universe restricted multiverse"
-          done | sudo tee /etc/apt/sources.list.d/riscv64.list
-          sudo apt-get update
-          # The same -dev packages as the linux job, for riscv64; the C toolchain also builds
-          # aws-lc-sys and ring (signing, TLS).
-          sudo apt-get install -y --no-install-recommends \
-            gcc-riscv64-linux-gnu g++-riscv64-linux-gnu binutils-riscv64-linux-gnu libc6-dev-riscv64-cross \
-            libc6-dev:riscv64 qemu-user \
-            libxkbcommon-dev:riscv64 libwayland-dev:riscv64 libx11-dev:riscv64 libxrandr-dev:riscv64 \
-            libxi-dev:riscv64 libgl1-mesa-dev:riscv64
-      - name: Build and package (tar.gz, CLI tar.gz)
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-          CARGO_TARGET_RISCV64GC_UNKNOWN_LINUX_GNU_LINKER: riscv64-linux-gnu-gcc
-          CC_riscv64gc_unknown_linux_gnu: riscv64-linux-gnu-gcc
-          CXX_riscv64gc_unknown_linux_gnu: riscv64-linux-gnu-g++
-          AR_riscv64gc_unknown_linux_gnu: riscv64-linux-gnu-ar
-          PKG_CONFIG_SYSROOT_DIR: /
-          PKG_CONFIG_PATH: /usr/lib/riscv64-linux-gnu/pkgconfig:/usr/share/pkgconfig
-          PKG_CONFIG_ALLOW_CROSS: "1"
-          CROSS_ARCH: riscv64
-          CROSS_TARGET: riscv64gc-unknown-linux-gnu
-          CROSS_COMPILE: riscv64-linux-gnu-
-          EMULATOR: qemu-riscv64
-          QEMU_LD_PREFIX: /usr/riscv64-linux-gnu
-        run: packaging/linux/package.sh --formats "tar cli"
-      - name: Check the packages
-        run: |
-          tar -tzf "dist/release/pdfcraft-$PDFCRAFT_VERSION-linux-riscv64.tar.gz" | grep -E '/bin/pdfcraft$'
-          # The OCR models (#103), where the installed app looks: <bin>/../share/pdfcraft/models.
-          tar -tzf "dist/release/pdfcraft-$PDFCRAFT_VERSION-linux-riscv64.tar.gz" | grep -E '/share/pdfcraft/models/.+\.rten$'
-          cli="dist/release/pdfcraft-cli-$PDFCRAFT_VERSION-linux-riscv64.tar.gz"
-          tar -tzf "$cli" | grep -E '/pdfcraft-cli$'
-          tar -tzf "$cli" | grep -E '/LICENSE-APACHE$'
-          file target/riscv64gc-unknown-linux-gnu/release/pdfcraft | grep -F 'RISC-V'
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-linux-riscv64
-          path: dist/release/*.tar.gz
-          if-no-files-found: error
-
-  flatpak:
-    name: Flatpak ${{ matrix.arch }}
-    needs: [version, linux]
-    # Repackages the Linux job's tarball (the same binaries as the AppImage/deb/rpm); no Rust
-    # build here. 24.04 for a newer flatpak-builder (1.4) than 22.04 ships.
-    runs-on: ${{ matrix.runner }}
-    # No `environment: release`: this job signs nothing, so it gets no release secrets.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - { arch: x86_64, runner: ubuntu-24.04 }
-          - { arch: aarch64, runner: ubuntu-24.04-arm }
-    env:
-      PDFCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      PDFCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
-        with:
-          name: release-linux-${{ matrix.arch }}
-          path: dist/linux
-      - name: Install flatpak-builder
-        run: |
-          sudo apt-get update
-          # librsvg2-common: the SVG pixbuf loader. flatpak-builder runs the host's
-          # `appstreamcli compose`, which renders the scalable icon and fails without it.
-          sudo apt-get install -y --no-install-recommends flatpak flatpak-builder librsvg2-common
-          # Ubuntu 24.04's AppArmor blocks the unprivileged user namespaces bubblewrap needs.
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-      - name: Build the Flatpak bundle
-        run: packaging/linux/flatpak-bundle.sh "dist/linux/pdfcraft-$PDFCRAFT_VERSION-linux-${{ matrix.arch }}.tar.gz"
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-flatpak-${{ matrix.arch }}
-          path: dist/release/*.flatpak
-          if-no-files-found: error
-
-  freebsd:
-    name: FreeBSD x86_64
-    needs: version
-    # GitHub has no FreeBSD runners: build in a FreeBSD VM (see .github/workflows/freebsd.yml).
-    runs-on: ubuntu-latest
-    timeout-minutes: 180
-    # No `environment: release`: this job signs nothing, so it gets no release secrets.
-    env:
-      PDFCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      PDFCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-      VERSION_OVERRIDE: ${{ inputs.version }}
-    steps:
-      - uses: actions/checkout@v4
-      # The craft-fonts build input (Japanese fonts): every release embeds it. Bump deliberately.
-      - name: Check out craft-fonts
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          repository: storytold/craft-fonts
-          ref: 8dcdacd5153e64560d109541a47d806f26f048c0
-          path: craft-fonts
-      - name: Build and package in a FreeBSD VM (tar.gz)
-        # vmactions/freebsd-vm v1.5.9, pinned by commit (it runs our build).
-        uses: vmactions/freebsd-vm@c46abacb49f09938ca4e1702d15d836285d694cc
-        with:
-          release: "14.3"
-          usesh: true
-          cpu: 4
-          mem: 12288
-          envs: "PDFCRAFT_VERSION PDFCRAFT_BUILD_DATE VERSION_OVERRIDE"
-          # The same packages as the FreeBSD CI workflow, plus bash for the packaging script.
-          prepare: |
-            pkg install -y bash git curl pkgconf cmake python3 libxkbcommon wayland libX11 libXcursor libXrandr libXi libxcb mesa-libs vulkan-loader gtk3 fontconfig freetype2 alsa-lib
-            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable
-          run: |
-            set -e
-            . "$HOME/.cargo/env"
-            git config --global --add safe.directory "$PWD"
-            export CRAFT_FONTS_DIR="$PWD/craft-fonts" CRAFT_FONTS_REQUIRED=1
-            if [ -n "$VERSION_OVERRIDE" ]; then cargo xtask version set "$PDFCRAFT_VERSION"; fi
-            packaging/freebsd/package.sh
-            # Only dist/ comes back out of the VM: copying the target dir back fails on large builds.
-            rm -rf target
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-freebsd-x86_64
-          path: dist/release/*
-          if-no-files-found: error
-
-  web:
-    name: Web (wasm)
-    needs: version
-    runs-on: ubuntu-latest
-    # No `environment: release`: this job signs nothing, so it gets no release secrets.
-    env:
-      PDFCRAFT_VERSION: ${{ needs.version.outputs.version }}
-      PDFCRAFT_BUILD_DATE: ${{ needs.version.outputs.date }}
-      TRUNK_VERSION: 0.21.14
-    steps:
-      - uses: actions/checkout@v4
-      # The craft-fonts build input (Japanese fonts): every release embeds it. Bump deliberately.
-      - name: Check out craft-fonts
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          repository: storytold/craft-fonts
-          ref: 8dcdacd5153e64560d109541a47d806f26f048c0
-          path: craft-fonts
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: release-web
-      - name: Install trunk
-        run: |
-          curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
-            | tar -xz -C "$HOME/.cargo/bin" trunk
-          trunk --version
-      - name: Apply version override
-        if: inputs.version != ''
-        run: cargo xtask version set "$PDFCRAFT_VERSION"
-      - name: Build and zip
-        env:
-          CRAFT_FONTS_DIR: ${{ github.workspace }}/craft-fonts
-          CRAFT_FONTS_REQUIRED: "1"
-        run: packaging/web/package.sh
-      - uses: actions/upload-artifact@v4
-        with:
-          name: release-web
-          path: dist/release/*
-          if-no-files-found: error
-
   release:
-    name: Draft GitHub Release
-    # Needs the signing jobs, which only run on `release`: a branch dry run never drafts a release.
-    needs: [version, macos, windows, linux, linux-riscv64, flatpak, freebsd, web]
-    runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      contents: write
-    env:
-      VERSION: ${{ needs.version.outputs.version }}
-      PRERELEASE: ${{ needs.version.outputs.prerelease }}
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      GH_REPO: ${{ github.repository }}
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: release-*
-          path: artifacts
-          merge-multiple: true
-      - name: Checksums
-        working-directory: artifacts
-        run: |
-          sha256sum -- * | tee SHA256SUMS.txt
-      - name: Create or update the draft release
-        working-directory: artifacts
-        run: |
-          tag="v$VERSION"
-          title="PdfCraft v$VERSION"
-          pre=()
-          if [ "$PRERELEASE" = true ]; then pre=(--prerelease); fi
-          if draft="$(gh release view "$tag" --json isDraft --jq .isDraft 2>/dev/null)"; then
-            if [ "$draft" != "true" ]; then
-              echo "::error::Release $tag is already published. Bump the version (cargo xtask version set) before pushing to release."
-              exit 1
-            fi
-            echo "Updating draft $tag: replacing its assets"
-            gh release view "$tag" --json assets --jq '.assets[].name' | while read -r asset; do
-              gh release delete-asset "$tag" "$asset" --yes
-            done
-            gh release edit "$tag" --draft --title "$title" --target "$GITHUB_SHA" --prerelease="$PRERELEASE"
-            gh release upload "$tag" --clobber -- *
-          else
-            echo "Creating draft $tag"
-            gh release create "$tag" --draft --title "$title" --target "$GITHUB_SHA" --generate-notes "${pre[@]}" -- *
-          fi
-          {
-            echo "Draft release **$title** at \`${GITHUB_SHA::9}\`:"
-            echo
-            sed 's/^/    /' SHA256SUMS.txt
-          } >>"$GITHUB_STEP_SUMMARY"
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/release.yml@main
+    with:
+      app-name: pdfcraft
+      app-title: PdfCraft
+      craft-fonts-ref: 8dcdacd5153e64560d109541a47d806f26f048c0
+      version: ${{ inputs.version }}
+    secrets:
+      APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+      APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+      KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
+      APPLE_ID: ${{ secrets.APPLE_ID }}
+      APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+      WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index 2ddcf82a..d470419d 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -25,134 +25,10 @@ concurrency:
 permissions:
   contents: read
 
-env:
-  CARGO_TERM_COLOR: always
-  CARGO_INCREMENTAL: 0
-  RUST_BACKTRACE: 1
-
 jobs:
-  package:
-    name: package (cross-compiled on x64)
-    runs-on: windows-latest
-    timeout-minutes: 90
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: aarch64-pc-windows-msvc
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: windows-arm64-package
-      - name: Install WiX
-        shell: pwsh
-        run: dotnet tool install --global wix --version 5.0.2
-      - name: Build and package (unsigned)
-        shell: pwsh
-        env:
-          DIST: ${{ github.workspace }}\dist\arm64
-        run: ./packaging/windows/package.ps1 -Arch arm64
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pdfcraft-windows-arm64
-          path: dist/arm64/*
-          if-no-files-found: error
-          retention-days: 7
-
-  install:
-    name: install and run on ARM64
-    needs: package
-    runs-on: windows-11-arm
-    timeout-minutes: 30
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          name: pdfcraft-windows-arm64
-          path: dist
-      - name: Install the MSI, check it, run it, uninstall it, reinstall without the desktop shortcut
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $msi = (Get-ChildItem dist/*.msi | Select-Object -First 1).FullName
-          # A command-line override must not put files in a user profile while registering
-          # their handlers machine-wide (#305). This runs on a disposable CI runner.
-          $p = Start-Process msiexec.exe -WindowStyle Hidden -ArgumentList '/i', "`"$msi`"", '/qn', 'ALLUSERS=2', 'MSIINSTALLPERUSER=1', '/l*v', 'per-user.log' -Wait -PassThru
-          if ($p.ExitCode -ne 1603) { Get-Content per-user.log -Tail 60; throw "per-user install should fail with 1603, got $($p.ExitCode)" }
-          if (-not (Select-String -Path per-user.log -SimpleMatch 'PdfCraft must be installed for all users.')) {
-            Get-Content per-user.log -Tail 60; throw 'per-user install did not fail on the scope guard'
-          }
-          $p = Start-Process msiexec.exe -ArgumentList '/i', "`"$msi`"", '/qn', '/l*v', 'install.log' -Wait -PassThru
-          if ($p.ExitCode -ne 0) { Get-Content install.log -Tail 60; throw "msiexec /i exited $($p.ExitCode)" }
-          $shortcuts = @(
-            (Join-Path ([Environment]::GetFolderPath('CommonPrograms')) 'PdfCraft.lnk'),
-            (Join-Path ([Environment]::GetFolderPath('CommonDesktopDirectory')) 'PdfCraft.lnk')
-          )
-          # Plain shortcuts to the program (#143), not advertised ones, so TargetPath is the exe.
-          $exePath = Join-Path $env:ProgramFiles 'PdfCraft\pdfcraft.exe'
-          $wsh = New-Object -ComObject WScript.Shell
-          foreach ($shortcut in $shortcuts) {
-            if (-not (Test-Path -LiteralPath $shortcut)) { throw "installer did not create $shortcut" }
-            $target = $wsh.CreateShortcut($shortcut).TargetPath
-            if ($target -ne $exePath) { throw "$shortcut points to '$target', not $exePath" }
-            Write-Output "ok $shortcut -> $target"
-          }
-          $dir = Join-Path $env:ProgramFiles 'PdfCraft'
-          foreach ($exe in 'pdfcraft.exe', 'pdfcraft-cli.exe') {
-            $path = Join-Path $dir $exe
-            if (-not (Test-Path $path)) { Get-ChildItem -Recurse $env:ProgramFiles -Filter $exe | Select-Object -First 3; throw "$exe not installed in $dir" }
-            $bytes = [System.IO.File]::ReadAllBytes($path)
-            $machine = [BitConverter]::ToUInt16($bytes, [BitConverter]::ToInt32($bytes, 0x3C) + 4)
-            if ($machine -ne 0xAA64) { throw "$exe is for machine 0x$('{0:X}' -f $machine), not ARM64" }
-            Write-Output "ok $path (ARM64)"
-          }
-          # The installed CLI runs natively: open, render and edit a small PDF through the engine.
-          $cli = Join-Path $dir 'pdfcraft-cli.exe'
-          & $cli tools | Out-Null
-          if ($LASTEXITCODE -ne 0) { throw "pdfcraft-cli tools exited $LASTEXITCODE" }
-          $body = 'BT /F1 24 Tf 20 150 Td (Hello ARM64) Tj ET'
-          $objs = @('<< /Type /Catalog /Pages 2 0 R >>', '<< /Type /Pages /Kids [3 0 R] /Count 1 >>',
-            '<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>',
-            "<< /Length $($body.Length) >>`nstream`n$body`nendstream", '<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>')
-          $sb = [System.Text.StringBuilder]::new("%PDF-1.7`n"); $offsets = @()
-          for ($i = 0; $i -lt $objs.Count; $i++) { $offsets += $sb.Length; [void]$sb.Append("$($i + 1) 0 obj`n$($objs[$i])`nendobj`n") }
-          $xref = $sb.Length
-          [void]$sb.Append("xref`n0 $($objs.Count + 1)`n0000000000 65535 f `n")
-          foreach ($o in $offsets) { [void]$sb.Append(('{0:D10} 00000 n `n' -f $o)) }
-          [void]$sb.Append("trailer`n<< /Size $($objs.Count + 1) /Root 1 0 R >>`nstartxref`n$xref`n%%EOF`n")
-          New-Item -ItemType Directory -Force smoke | Out-Null
-          [System.IO.File]::WriteAllText("$PWD\smoke\hello.pdf", $sb.ToString(), [System.Text.Encoding]::ASCII)
-          $steps = '[{"tool":"doc_open","args":{"path":"hello.pdf"}},{"tool":"text_paragraphs","args":{"doc":1,"page":1}},{"tool":"text_edit","args":{"doc":1,"page":1,"paragraph":1,"text":"Edited on ARM64"}},{"tool":"page_render","args":{"doc":1,"page":1,"dpi":72},"out":"page.png"},{"tool":"doc_save","args":{"doc":1,"path":"out.pdf"}}]'
-          [System.IO.File]::WriteAllText("$PWD\smoke\steps.json", $steps)
-          $out = & $cli run --script smoke\steps.json --root smoke 2>&1 | Out-String
-          if ($LASTEXITCODE -ne 0) { Write-Output $out; throw "pdfcraft-cli run exited $LASTEXITCODE" }
-          if ($out -notmatch 'Hello ARM64') { Write-Output $out; throw 'text_paragraphs did not read the page' }
-          foreach ($f in 'smoke\page.png', 'smoke\out.pdf') { if (-not (Test-Path $f) -or (Get-Item $f).Length -eq 0) { Write-Output $out; throw "$f was not written" } }
-          Write-Output 'ok pdfcraft-cli: opened, read, edited, rendered and saved a PDF on ARM64'
-          $p = Start-Process msiexec.exe -ArgumentList '/x', "`"$msi`"", '/qn' -Wait -PassThru
-          if ($p.ExitCode -ne 0) { throw "msiexec /x exited $($p.ExitCode)" }
-          if (Test-Path (Join-Path $dir 'pdfcraft.exe')) { throw 'uninstall left pdfcraft.exe behind' }
-          foreach ($shortcut in $shortcuts) {
-            if (Test-Path -LiteralPath $shortcut) { throw "uninstall left $shortcut behind" }
-          }
-          Write-Output 'ok uninstalled'
-          # Unattended installs can opt out of the desktop shortcut (#143); the Start Menu one stays.
-          $p = Start-Process msiexec.exe -ArgumentList '/i', "`"$msi`"", '/qn', 'INSTALLDESKTOPSHORTCUT=0', '/l*v', 'install-nodesktop.log' -Wait -PassThru
-          if ($p.ExitCode -ne 0) { Get-Content install-nodesktop.log -Tail 60; throw "msiexec /i INSTALLDESKTOPSHORTCUT=0 exited $($p.ExitCode)" }
-          if (-not (Test-Path -LiteralPath $shortcuts[0])) { throw "INSTALLDESKTOPSHORTCUT=0 also skipped $($shortcuts[0])" }
-          if (Test-Path -LiteralPath $shortcuts[1]) { throw "INSTALLDESKTOPSHORTCUT=0 still created $($shortcuts[1])" }
-          $p = Start-Process msiexec.exe -ArgumentList '/x', "`"$msi`"", '/qn' -Wait -PassThru
-          if ($p.ExitCode -ne 0) { throw "msiexec /x exited $($p.ExitCode)" }
-          if (Test-Path -LiteralPath $shortcuts[0]) { throw "uninstall left $($shortcuts[0]) behind" }
-          Write-Output 'ok INSTALLDESKTOPSHORTCUT=0: Start Menu shortcut only'
-
-  test:
-    name: test (native ARM64)
-    runs-on: windows-11-arm
-    timeout-minutes: 120
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: windows-arm64-test
-      - name: Test
-        run: cargo test --workspace --locked
+  windows-arm64:
+    # Intentionally tracked at @main (not SHA-pinned) so org-wide CI improvements, security fixes, and build optimizations propagate without PR churn across all craftapp repos.
+    uses: storytold/craft-common-actions/.github/workflows/windows-arm64.yml@main
+    with:
+      app-name: pdfcraft
+      app-dir: PdfCraft
diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index 28bd17c7..f4974b09 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -4,7 +4,7 @@
 
 Every asset PdfCraft includes, bundles or uses to build its published material, with its author, source and licence. The policy is in [AGENTS.md](AGENTS.md) §1. The machine-readable list, with SHA-256 hashes, is [ATTRIBUTION.toml](ATTRIBUTION.toml). Licence texts are kept beside the assets and summarised in [NOTICE](NOTICE).
 
-## In this repository (264)
+## In this repository (265)
 
 | Asset | Title | Author | Licence | Source | Used for |
 |---|---|---|---|---|---|
@@ -199,7 +199,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `assets/icons/x.svg` | Lucide icon "x" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/x.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/zoom-in.svg` | Lucide icon "zoom-in" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-in.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 | `assets/icons/zoom-out.svg` | Lucide icon "zoom-out" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/zoom-out.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
-| `assets/fonts/Inter-Regular.ttf` | Inter Regular | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels |
+| `assets/fonts/Inter-Regular.ttf` | Inter Regular | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels; slanted fallback glyphs in Fill & Sign typed signatures for characters Dancing Script lacks (Cyrillic, Greek), drawn as filled paths |
 | `assets/fonts/Inter-Medium.ttf` | Inter Medium | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels |
 | `assets/fonts/Inter-SemiBold.ttf` | Inter SemiBold | The Inter Project Authors (Rasmus Andersson) | OFL-1.1 | https://github.com/rsms/inter | UI font, embedded in the app; demo PDF labels |
 | `assets/fonts/JetBrainsMono-Regular.ttf` | JetBrains Mono Regular | The JetBrains Mono Project Authors | OFL-1.1 | https://github.com/JetBrains/JetBrainsMono | UI monospace font; demo PDF code |
@@ -272,6 +272,7 @@ Every asset PdfCraft includes, bundles or uses to build its published material,
 | `packaging/macos/dmg/background.svg` | PdfCraft macOS DMG window background | @XusBadia | MIT OR Apache-2.0 | Original work for this repository, derived from the PdfCraft app icon (assets/app-icon/pdfcraft.svg, referenced via an SVG image element, not copied) | Finder window of the macOS DMG; rendered to background.tiff by packaging/macos/dmg/generate.py |
 | `packaging/macos/dmg/background.tiff` | PdfCraft macOS DMG window background (rendered) | @XusBadia | MIT OR Apache-2.0 | Rendered from packaging/macos/dmg/background.svg by packaging/macos/dmg/generate.py | 1x + 2x HiDPI 16-colour palette TIFF copied into the macOS DMG by packaging/macos/package.sh; includes the app icon and the free LittleCMS built-in sRGB profile |
 | `crates/sign/tests/data/x509-rsa-sha1.pdf` | One-page PDF with a legacy adbe.x509.rsa_sha1 signature by the RSA test key | PdfCraft contributors | MIT OR Apache-2.0 | Contributor-original: hand-written PDF objects; signature made with `openssl dgst -sha1 -sign` over its byte ranges (see crates/sign/tests/data/README.md) | Signature validation tests (crates/sign/tests/pdf.rs): the legacy adbe.x509.rsa_sha1 format |
+| `assets/icons/monitor.svg` | Lucide icon "monitor" | Lucide Contributors (portions Cole Bemis, Feather) | ISC | https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg) | UI icon, embedded via crates/ui-egui/src/icon_data.rs |
 
 ## Compiled in through dependencies (6)
 
diff --git a/ATTRIBUTION.toml b/ATTRIBUTION.toml
index cfa2e434..2c705f00 100644
--- a/ATTRIBUTION.toml
+++ b/ATTRIBUTION.toml
@@ -19,7 +19,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Simplified Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "2c0f7bc1c225a95d2322e5f92e42ca3b07652f54976d754e9901abeddc4d0dc6"
+sha256 = "1863437c886142b2bccce3f44a538ae80d0ceea81074b84dfdfe8d9a4a4227ab"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/zh-hant.tsv"
@@ -30,7 +30,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Traditional Chinese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "b55ec8f2794966e879334121d48b15923cebf38192bd8e1667d4c4e6bf168095"
+sha256 = "6c8604d5cd71412c6a673b75001c7ef629727839eca1449147c7d6ec4bf0be99"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/cs.tsv"
@@ -41,7 +41,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Czech UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "abd8d0c409be846fcf48cbc1338def7f77f2d301bd84d863e4ad66434e5f821f"
+sha256 = "5ae2e315a9b99b4c0dfaf7be019c4d430ace17b4fbbfea5a2779b3e972846a21"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pt-br.tsv"
@@ -52,7 +52,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Brazilian Portuguese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "fe8fc8af29190950048c3e3d5108ede6cf2da2f85ed7003fb2035ddb517a600c"
+sha256 = "8b9e22fa25339e4aedb0542b8bf6f68dfd97bc3634105199e1951475e30eed53"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/es.tsv"
@@ -63,7 +63,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Spanish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "81ce4a9a18d10149129ecdf7eb0e0d3179cb4a66cf3f344a32de9a984612dafa"
+sha256 = "6d81592677f2b4eb3b97ba5810de9752da969545d91897e27033f37310696ffc"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/fr.tsv"
@@ -74,7 +74,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "French UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "6d99c6a85e69b5448609ae54847700c908919be27d904bd0c73bf2c220a2da4e"
+sha256 = "fb9c91a98c6975bc24249e8ae750fd46b9245ac5d2d7381f1e21319b9adbcaac"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/de.tsv"
@@ -85,7 +85,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "German UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "09f654d07a87878802e87fc0436f9a5426bc27bfb2156aee912463c5dc8a04ea"
+sha256 = "f36aefae1a1ba6d576a4647fbfdd65b9b5086bfb266ea260e513244adc7af05a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/te.tsv"
@@ -96,7 +96,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Telugu UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "fd2b1b33d940ff9eef4bc067452252c39bf6cf02f3fe22e84ecd782943d2cc26"
+sha256 = "656940b456a6c2401f8bd3107a71cedcae5e52cd446e86e806285b6322d8ed8e"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/it.tsv"
@@ -107,7 +107,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Italian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "8a7a2bfba1a2f9858ad62a74bd8229a1615a5bc6e51023b11b9768e7ea21d79c"
+sha256 = "14884c08a550600d310a794ceb0b2bb864987a074178ee49b657578b66625bef"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/pl.tsv"
@@ -118,7 +118,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Polish UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "95e35de200c66936333a95d89561f3c4d32b1d38f9c0a8357bec5c6b0e75fe1e"
+sha256 = "be960bdf9b6eeac2d95db91325076ee79c9b2efdcc4e459c7400e7ddb05fab3a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ru.tsv"
@@ -129,7 +129,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Russian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "dc0af15b819b9059bc23a73a1e794d1ae5291594b2ff0fae2595274fccc9c281"
+sha256 = "bada9b6f0b3775e4dab1213d9759070f7551d8a6142de10159268c88a04d3f0c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/hu.tsv"
@@ -140,7 +140,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Hungarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "16c6e6cf857b70f7ade009bc9c87fceb3831f5f3281ac7fabc0fd7bfd2c5d28e"
+sha256 = "efb75d8575df9e1dd4610602f20545b3a14a3a0814060efc27eb7cab591ccccb"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/bg.tsv"
@@ -151,7 +151,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Bulgarian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "9e8c0929c5839b2a5f5c93a2d3457bcce24b118a11fd6b37476aa3584fa5ce76"
+sha256 = "ca305b188abc8d9c261901dde10f7cd8518520983fdf88d2358374b352ad3d5a"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ja.tsv"
@@ -162,7 +162,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Japanese UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "47720091895fc1a4c1ff332a660192fe4a9666f32002e5899030b3ca3421f337"
+sha256 = "f004b06f4e7eb8f4a99e22e1abfd97c95795b2215080e4008574522e54eda74c"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/uk.tsv"
@@ -173,7 +173,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Ukrainian UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "fa2f00414a8f064f4d6e47d57702a100743c8b64b05dcbe93585330427c83f16"
+sha256 = "cd9ecaf661533cbd3b055cfd3994602f6739c83061d1e225ba43ee6f229068cf"
 
 [[asset]]
 path = "crates/ui-egui/src/i18n/ar.tsv"
@@ -184,7 +184,7 @@ licence = "MIT OR Apache-2.0"
 licence_file = "LICENSE-MIT"
 kind = "translation"
 usage = "Arabic UI strings, compiled in by crates/ui-egui/src/i18n/mod.rs"
-sha256 = "271a9b34b0d13d1734de53d88a09b49d589eb556c75fe04dd1fa5172151c5b1a"
+sha256 = "a8a66390b2d80b4708c4f854318b923eef7f0f5932439fb5ef25f2651980f24e"
 
 [[asset]]
 path = "assets/icons/accessibility.svg"
@@ -2119,7 +2119,7 @@ source = "https://github.com/rsms/inter"
 licence = "OFL-1.1"
 licence_file = "assets/fonts/OFL-Inter.txt"
 kind = "font"
-usage = "UI font, embedded in the app; demo PDF labels"
+usage = "UI font, embedded in the app; demo PDF labels; slanted fallback glyphs in Fill & Sign typed signatures for characters Dancing Script lacks (Cyrillic, Greek), drawn as filled paths"
 sha256 = "40d692fce188e4471e2b3cba937be967878f631ad3ebbbdcd587687c7ebe0c82"
 
 [[asset]]
@@ -3285,3 +3285,14 @@ licence_file = "LICENSE-MIT"
 kind = "document"
 usage = "Signature validation tests (crates/sign/tests/pdf.rs): the legacy adbe.x509.rsa_sha1 format"
 sha256 = "b77bfb21166f4bd043597e45a1ea28b9d9f4ba6df0142b3a0fc8b7f8e0fc111b"
+
+[[asset]]
+path = "assets/icons/monitor.svg"
+title = "Lucide icon \"monitor\""
+author = "Lucide Contributors (portions Cole Bemis, Feather)"
+source = "https://github.com/lucide-icons/lucide (npm lucide-static 1.49.0, icons/monitor.svg)"
+licence = "ISC"
+licence_file = "assets/icons/LICENSE-lucide.txt"
+kind = "icon"
+usage = "UI icon, embedded via crates/ui-egui/src/icon_data.rs"
+sha256 = "d1a443233345724859de8e4fb48968ba91e885e12ddbd710701548bd91b39428"
diff --git a/Cargo.lock b/Cargo.lock
index f22b7be5..42f98e59 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1093,7 +1093,7 @@ dependencies = [
 [[package]]
 name = "craft-print"
 version = "0.1.0"
-source = "git+https://github.com/storytold/craft-libs?rev=da752825c70574a2423ee55427f8f7aa5b5f8ec8#da752825c70574a2423ee55427f8f7aa5b5f8ec8"
+source = "git+https://github.com/storytold/craft-libs?rev=32bcac12db98113d18d8f56bc47fb6ddabe4d54f#32bcac12db98113d18d8f56bc47fb6ddabe4d54f"
 dependencies = [
  "tempfile",
 ]
@@ -1749,7 +1749,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3572,6 +3572,8 @@ dependencies = [
  "serde_json",
  "uds_windows",
  "ureq",
+ "wayland-client",
+ "wayland-protocols",
  "winresource",
  "winsafe",
 ]
@@ -3598,6 +3600,17 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "pdfcraft-audit"
+version = "0.6.0"
+dependencies = [
+ "pdfcraft-content",
+ "pdfcraft-cos",
+ "pdfcraft-edit",
+ "pdfcraft-model",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "pdfcraft-automation"
 version = "0.6.0"
@@ -3620,6 +3633,7 @@ name = "pdfcraft-cli"
 version = "0.6.0"
 dependencies = [
  "base64 0.22.1",
+ "pdfcraft-audit",
  "pdfcraft-automation",
  "pdfcraft-cos",
  "pdfcraft-engine",
@@ -3703,6 +3717,7 @@ dependencies = [
  "image",
  "pdfcraft-a11y",
  "pdfcraft-annot",
+ "pdfcraft-audit",
  "pdfcraft-compare",
  "pdfcraft-cos",
  "pdfcraft-create",
@@ -3710,6 +3725,7 @@ dependencies = [
  "pdfcraft-export",
  "pdfcraft-fonts",
  "pdfcraft-forms",
+ "pdfcraft-geom",
  "pdfcraft-js",
  "pdfcraft-measure",
  "pdfcraft-model",
@@ -3833,6 +3849,8 @@ dependencies = [
 name = "pdfcraft-platform"
 version = "0.6.0"
 dependencies = [
+ "async-channel",
+ "futures-lite",
  "zbus",
 ]
 
@@ -4889,7 +4907,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5512,10 +5530,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.5",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5783,7 +5801,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
  "memoffset",
  "tempfile",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -6475,7 +6493,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index ed72d232..bad4eda2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,7 +15,7 @@ repository = "https://github.com/storytold/pdfcraft"
 # Shared frontend components; engines remain independent of egui.
 craft-ui = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "5c874d51eeb3de70e735c8ce87a59a7dedd47675", features = ["serde"] }
 # Shared system spooler; document composition remains in pdfcraft-print.
-craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "da752825c70574a2423ee55427f8f7aa5b5f8ec8" }
+craft-print = { git = "https://github.com/storytold/craft-libs", version = "0.1.0", rev = "32bcac12db98113d18d8f56bc47fb6ddabe4d54f" }
 # internal
 pdfcraft-geom = { path = "crates/geom", version = "0.6.0" }
 pdfcraft-filters = { path = "crates/filters", version = "0.6.0" }
@@ -24,6 +24,7 @@ pdfcraft-crypt = { path = "crates/crypt", version = "0.6.0" }
 pdfcraft-organize = { path = "crates/organize", version = "0.6.0" }
 pdfcraft-measure = { path = "crates/measure", version = "0.6.0" }
 pdfcraft-annot = { path = "crates/annot", version = "0.6.0" }
+pdfcraft-audit = { path = "crates/audit", version = "0.6.0" }
 pdfcraft-fonts = { path = "crates/fonts", version = "0.6.0" }
 pdfcraft-model = { path = "crates/model", version = "0.6.0" }
 pdfcraft-content = { path = "crates/content", version = "0.6.0" }
@@ -91,6 +92,11 @@ debug = "line-tables-only"
 [profile.dev]
 opt-level = 1
 
+[profile.low-disk]
+inherits = "dev"
+debug = "line-tables-only"
+incremental = false
+
 [profile.release]
 lto = "thin"
 codegen-units = 1
diff --git a/README.md b/README.md
index 1b6cd0a0..e2be10ef 100644
--- a/README.md
+++ b/README.md
@@ -372,6 +372,7 @@ PdfCraft is a clean-room implementation. Its behaviour comes from the ISO 32000
 ```sh
 git clone https://github.com/storytold/pdfcraft
 cd pdfcraft
+cargo xtask models                                # fetch the OCR models Scan & OCR needs (release builds include them)
 cargo run --release -p pdfcraft -- some.pdf     # desktop app
 cargo xtask demo-pdf                              # build the showcase PDF used in these screenshots
 cargo xtask screenshots                           # regenerate every screenshot in this README
@@ -412,14 +413,14 @@ Logs, environment variables and other development notes are in [docs/development
 
 PdfCraft is young and moving fast. The aim is a workbench where you can view, organize, annotate, fill, sign and edit PDFs, at parity with Acrobat Pro.
 
-**Where it stands (October 2026), honestly:** PdfCraft is **alpha**. Most of Acrobat Pro's offline features exist in some form (57% of all tracked features, 94% of the must-haves). For everyday work (viewing, commenting, filling and signing forms, organizing pages) it is about 55% of the way to replacing Acrobat; against all of Acrobat Pro, about 49%; for someone who only needs the essentials, about 66%. Every everyday workflow can be completed, but converting and sharing is weak: password-protected files Acrobat can't open, no Office-to-PDF, and Word export that loses layout.
+**Where it stands (October 2026), honestly:** PdfCraft is **alpha**. Most of Acrobat Pro's offline features exist in some form (57% of all tracked features, 94% of the must-haves). For everyday work (viewing, commenting, filling and signing forms, organizing pages) it is about 55% of the way to replacing Acrobat; against all of Acrobat Pro, about 49%; for someone who only needs the essentials, about 66%. Every everyday workflow can be completed, but converting and sharing is weak: no Office-to-PDF, and Word export that loses layout.
 
 - **Good today:** viewing and search; organizing, combining and splitting; most kinds of comment; filling and authoring forms (with sandboxed JavaScript); passwords, redaction and sanitizing; basic digital signatures; printing; the Accessibility Checker; agent control through the CLI and MCP.
 - **Still borrowed:** pages are drawn by the `hayro` crate while our own renderer is built.
-- **Thin or missing:** reliable editing of existing text (especially CJK and right-to-left), OCR beyond Latin script, Office import/export, signature tokens and online long-term validation, Preflight and PDF/X/UA, physical printer fidelity, and full XFA forms.
+- **Thin or missing:** reliable editing of existing text (especially CJK and right-to-left), OCR beyond Latin script, Office import/export, signature tokens and online long-term validation, Preflight and PDF/X/UA, printing from the web build, physical printer fidelity, and full XFA forms.
 - **Hardening:** fuzzing still turns up crashes and hangs on hostile files; each one is fixed with a regression test. Quality has not yet been compared with Acrobat side by side.
 
-**Next, in order:** encrypted files that Acrobat opens, the reported bugs and physical printer validation, a fidelity harness against Acrobat and the renderer, editing existing content, then the Pro workflows (OCR, Office, Preflight, signatures, accessibility tagging) and 1.0 polish.
+**Next, in order:** Office-to-PDF and a Word export that keeps layout, the reported bugs, web printing and the Chinese interface font, a fidelity harness against Acrobat and the renderer, editing existing content, then the Pro workflows (OCR, Office, Preflight, signatures, accessibility tagging) and 1.0 polish.
 
 The summary is in **[ROADMAP.md](ROADMAP.md)**; the full assessment by dimension and area is in [docs/target-app-parity.md](docs/target-app-parity.md), the ranked gaps in [docs/gaps.md](docs/gaps.md), and the milestones in [docs/roadmap.md](docs/roadmap.md).
 
diff --git a/ROADMAP.md b/ROADMAP.md
index e38d307c..9ebf37f2 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -2,7 +2,9 @@
 
 **Stage: alpha** · next: beta, ~26% (ready for real work 49% → 75%) and ~400–700 h away
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (shared print spooler; Windows CI enabled) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (shared craft-print spooler with passing Windows CI; architectural paper controls from #599; localized shortcut labels, #496; readiness table with hours per audience; full number as weighted sum 49%; earlier: second look: ready 40% → 47%, mainstream 55% added; core-workflow gate applied → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** M14 #307 Plan 3 uses one marker traversal on open and full refresh, and the combined scanner borrows metadata instead of cloning scan-only containers; includes a behavior-preserving `organize` binding for the workspace Clippy gate · earlier: minor (localized shortcut labels, #496; readiness table with hours per audience; full number as weighted sum 49%; second look: ready 40% → 47%, mainstream 55% added; core-workflow gate applied → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (closed issues synced: #774, #756 and the #799–#821 batch; earlier: localized shortcut labels, #496; readiness table with hours per audience; full number as weighted sum 49%; earlier: second look: ready 40% → 47%, mainstream 55% added; core-workflow gate applied → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 PdfCraft's one-page summary: how close it is to Adobe Acrobat Pro's offline feature set, and what
 comes next. Adobe's cloud services (Document Cloud, Acrobat Sign requests, shared review, the AI
@@ -40,17 +42,17 @@ and add a line to the [progress log](#progress-log); when a gap closes, remove i
 **Why alpha:** all six of Acrobat Pro's everyday workflows can be completed end to end on macOS
 (the [alpha gate](docs/roadmap.md#alpha-gate)), and users praise them (7.6k stars, ≈ 217k downloads
 of 0.4–0.5, switching reports such as #179). Two are only partial: editing (no CJK/RTL) and convert
-and share (password-protected files we write don't open in Acrobat or Reader, #774; no in-app
-Office→PDF; Word export loses layout, #773). Those, unmeasured quality against Acrobat, the borrowed
-`hayro` renderer, unvalidated physical printer output (#756) and 245 open issues keep it far from beta.
+and share (no in-app Office→PDF; Word export loses layout, #773; password-protected files open in
+Acrobat since #836, #774). Those, unmeasured quality against Acrobat, the borrowed `hayro` renderer,
+no printing on the web and 245 open issues keep it far from beta.
 
 ### Readiness by audience
 
 | Audience | Ready | Opus 5.5 agent-hours to ≈ 95% | Work that dominates |
 |---|---|---|---|
 | Full Acrobat Pro (ready for real work) | ≈ 49% | ≈ 780–1,400 h (≈ 300–550 h wall clock with 3–5 agents; 60–70% parallelizes) | Own renderer and fidelity harness, editing existing content, OCR and Office conversion, Preflight and PDF/A/X/UA, accessibility tagging, signatures for institutions |
-| Mainstream practitioner | ≈ 55% | ≈ 500–900 h (≈ 200–400 h wall clock; ≈ 60% parallelizes) | Rendering fidelity, editing existing text (CJK, RTL, subsets), conversion (Word layout, Excel, PowerPoint, Office→PDF), OCR languages, Windows print fidelity, the bug backlog |
-| Essentials user | ≈ 66% | ≈ 180–330 h (≈ 90–180 h wall clock; ≈ 50% parallelizes) | Rendering fidelity on everyday files, Windows print fidelity, launch and GPU stability, encrypted output Acrobat opens (#774), simple text fixes, Word export layout, Chinese UI glyphs |
+| Mainstream practitioner | ≈ 55% | ≈ 500–900 h (≈ 200–400 h wall clock; ≈ 60% parallelizes) | Rendering fidelity, editing existing text (CJK, RTL, subsets), conversion (Word layout, Excel, PowerPoint, Office→PDF), OCR languages, the bug backlog |
+| Essentials user | ≈ 66% | ≈ 180–330 h (≈ 90–180 h wall clock; ≈ 50% parallelizes) | Rendering fidelity on everyday files, launch and GPU stability, simple text fixes, Word export layout, Chinese UI glyphs |
 
 Hours are calibrated as in [Effort and calibration](docs/target-app-parity.md#effort-and-calibration) (≈ 1k kept lines per agent-hour for new features, 3–10× slower for hardening and fidelity). The audiences are nested subsets, so essentials ≤ mainstream ≤ full.
 
@@ -121,8 +123,8 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 | Rank | Milestone | Estimate (h) |
 |---|---|---|
-| 0 | Convert and share: encrypted output opens in Acrobat (#774), Create PDF from Office, Word export that keeps layout (#773) | 40–70 |
-| 1 | Backlog and platform: crash and wrong-result reports, physical printer validation (#756), Chinese UI face (#826) | 65–120 |
+| 0 | Convert and share: Create PDF from Office, Word export that keeps layout (#773) | 32–55 |
+| 1 | Backlog and platform: crash and wrong-result reports, web printing, Chinese UI face (#826) | 65–120 |
 | 2 | Fidelity harness against Acrobat and the renderer decision (M2; owner decision on #841) | 110–190 |
 | 3 | Editing existing content (M7) | 100–180 |
 | 4 | OCR languages and Office export/import (M10) | 95–175 |
@@ -133,9 +135,32 @@ Ranked; detail and the full milestone table in [docs/roadmap.md](docs/roadmap.md
 
 ## Progress log
 
+- **2026-10-11 (M10.5, focused follow-up to #599):** Carry the architectural/ANSI/large ISO paper presets, current-page matching at 100%, and previewed PDF scale into the current print dialog and `doc_print`. Retains the #847/#1007 spooler and background discovery. Driver substitution, physical calibration, vector Windows printing and managed-endpoint restrictions remain separate gaps. Overall estimates unchanged.
+
 Newest first: the date, what moved, and the new overall estimate.
 
-- **2026-10-11 (M10.5):** Extracted printer discovery, options and PDF submission into craft-libs/craft-print, shared with DesignCraft. Windows preserves composed sheet size and orientation without fitting into default margins; duplex binding edges are corrected. PdfCraft retains permission checks and imposition. Shared transport and local composition, engine, automation and UI coverage validate the boundary; native Windows regression execution is pending; physical printer fidelity remains a hardware check. Rust 1.95 is required by the shared crate. No readiness percentage change.
+- **2026-10-11 (M10.5):** Extracted printer discovery, options and PDF submission into craft-libs/craft-print, shared with DesignCraft. Windows preserves composed sheet size and orientation without fitting into default margins; duplex binding edges are corrected. PdfCraft retains permission checks and imposition. Shared transport and local composition, engine, automation and UI coverage validate the boundary; native Windows CI passes, including paused-queue submission and cleanup; physical printer fidelity remains a hardware check. Rust 1.95 is required by the shared crate. No readiness percentage change.
+- **2026-10-11 (#995, #1077, permissions password after opening):** A PDF with only a permissions password opens without asking, restricted, and nothing let the user enter that password afterwards: the notice and the hint pointed at reopening with it. Now the security notice and Properties ▸ Security offer Unlock…, and Change settings / Remove security on a restricted document ask for the permissions password first and then carry on (as Acrobat does). The open password is refused there. `Session::unlock` upgrades the open document in place (owner and user passwords unlock the same file key, so nothing is re-read), unlocks the undo and redo states and reopens saves as owner; it is not an edit and doesn't mark the document unsaved. New command `protect.unlock`; the new strings are in all 15 full catalogs. Tests cover crypt, cos, engine (undo, redo, save, separate open password) and the UI. Still missing: an automation tool for it. Estimates unchanged.
+- **2026-10-11 (M14, #307 Plan 3):** Engine open and full refresh use one page/content traversal to populate marks and added content. The independent public scans remain available; the combined scanner borrows direct objects and holds referenced objects through `Arc<Object>` instead of cloning scan-only `/Contents` arrays or `/PCAdded` dictionaries. Differential tests cover an indirect `/PCAdded` dictionary as well as ordering, malformed/direct/indirect/repeated entries and `/UserUnit`. Exact `bbbe600`→final release CLI measurements used 10 alternating pairs: wall-time medians were 183.645→174.440 ms on 10,000 marker-free pages (10/10 wins), 33.587→32.752 ms on 1,500 mixed pages (8/10), and 24.331→20.133 ms on the 100,000-entry array stress fixture (10/10). The stress fixture's maximum-RSS median fell 28,655,616→19,038,208 B; peak-footprint medians were 14,747,136→14,673,408 B. From P0, the follow-up stress run was 20.886→20.201 ms (10/10), with RSS 23,953,408→19,087,360 B and peak footprint 14,706,144→14,697,952 B. `doc_open` stdout hashes matched every pair. The ancillary `organize` binding preserves the prior `prune_legacy` update condition. Estimates unchanged.
+- **2026-10-11 (M4, Organize overview):** Opening Organize pages from All tools, Home, the tool palette or `ui.set tool=organize` opens the thumbnail grid directly. Checkboxes toggle individual pages without modifier keys; page controls rotate either way or delete one page, while the toolbar acts on the selection. Portrait and landscape previews retain their aspect ratio. UI and control regressions cover entry, selection, single-page versus batch actions, undo, permissions and retaining the last page. Milestone and effort estimates unchanged.
+
+- **2026-10-10 (M9, signature graphics):** A visible digital signature can show a graphic where the signer's name is large, as Acrobat's Configure Signature Appearance does: the saved Fill & Sign signature (drawn strokes smoothed as ink, typed outlines in the script font, or an image) or an imported PNG/JPEG. Sign as previews it and remembers the choice for the next signing; `sign_document` takes `graphic` (`image`, `text` or `strokes`). Graphics are checked and capped before drawing (non-finite or unbounded points, mismatched pixel buffers, oversized images are refused with an error the caller can act on); images keep their alpha as a soft mask. `sign.signature-appearance` stays partial (no named saved appearances or PDF-page graphics). Overall estimates unchanged.
+- **2026-10-11 (M14, absolute interface sizes):** A chosen Interface size is now absolute, as PhotoCraft's UI Scale is: "100%" is one screen pixel per point whatever scale the display reports, so on a 1080p screen whose system reports 200 % it draws at a true 100 % (#456, reported after the first change). Auto still keeps the display's scale and adds GNOME's text scaling, and its menu entry shows the size it draws at. The menu offers PhotoCraft's sizes (75–300 %).
+- **2026-10-11 (automation, #971):** `text_find` reads pages in growing batches (8, doubling to 128) and stops once `limit` is reached, so a bounded search on a long document no longer extracts and caches every page first. Results say `complete`, and a capped one gives `next` (`start_page`, `skip`) to continue. Still open from #971: a byte budget for the automation text cache and per-page warnings for pages whose text can't be extracted.
+- **2026-10-11 (docs, closed issues):** The progress docs caught up with issues closed on 2026-10-10: encrypted output opens in Acrobat (#774, #836; gap 1 closed, rank 0 is 32–55 h), Windows prints (#756, #847), column select (#740), 1:1 touchpad scrolling (#759), same-page multi-object move (#844), and the #799–#821 batch of wrong-result fixes including the #816 panic. Scores and readiness not re-judged; overall estimate unchanged.
+- **2026-10-11 (M7, watermark placement):** A watermark can be moved from the page centre by a horizontal and a vertical offset in points: Add/Update Watermark has an "Offset from centre" row (the preview follows it, for text and for pictures) and `doc_watermark` takes `offset_x` and `offset_y`. A non-finite offset is refused instead of written into the page. `edit.watermark-appearance` stays partial: no offset from the page edge or in page units, no print/screen-only variants, no repeat. Image and PDF watermarks, already shipped, no longer appear as missing. The overall estimate is unchanged.
+- **2026-10-11 (M12, XFA script time limits):** An XFA script's time limit (1 s for scripts that run unasked, on open and on every change) counted the engine's start-up too: the script's thread, a new context and, for the first script in a process, the engine's own set-up (≈ 60–170 ms when idle). On a busy machine a trivial initialize script could pass the limit, be abandoned and turn the form's scripts off; that made `xfa_buttons_run_their_scripts_in_the_app` and `messages_from_scripts_run_on_open_show_right_away` flaky (under full CPU load 25 of 40 runs of the test binary failed, with "ran longer than 1.0 s and was abandoned" in the console). The limit now runs from when the engine is ready; start-up has its own 10 s cap, so nothing waits forever, and a trivial warm-up script takes the first-in-process set-up. Under the same load none of 40 runs fails, and runaway scripts are abandoned as before. The two UI tests print the script console when they fail. Overall unchanged.
+- **2026-10-11 (M4, #569):** Combine files takes images and text files as well as PDFs. PNG, JPEG, TIFF, GIF, BMP, JPEG 2000 and .txt files become PDFs as they are added (Add files…, drops, folder scans), so each is an ordinary row with its pages, thumbnails and page range; a file that can't be read (a damaged image or PDF, a type that can't be converted) stays in the list with why in its Warnings, and Combine asks before leaving such files out (Cancel changes nothing); password-protected files still have to be unlocked first. `doc_combine` accepts the same types, and a converted file's bookmark drops its extension. A PNG whose header claims more than 2 GiB of pixels is now refused before its buffer is allocated (the png crate's limits don't cover it), as TIFF already was. Office documents and HTML are still not converted. Overall estimate unchanged.
+- **2026-10-11 (M3, Windows renderer startup):** Renderer-creation GPU errors return through the existing scoped handler so Auto startup can use the existing OpenGL fallback. A real-device invalid/valid pipeline regression covers error propagation and device reuse; the independent Windows hostile-argument fixture reports unavailable symbolic-link privileges. The underlying x86 DX12 compiler error remains unresolved; see `docs/windows-renderer-startup.md`. Milestone and effort estimates unchanged.
+
+- **2026-10-11 (M6):** Existing simple field-font encodings and Differences are respected when generating appearances; an unencodable value uses a separate Helvetica appearance font without changing the source font. Synthetic reopen regressions cover punctuation, subset fallback and multiline text. Exact font metrics/layout and broader Unicode fallback remain incomplete. Estimates unchanged.
+
+- **2026-10-11 (M6):** Tab and Shift-Tab wrapping to the same field or another widget of that field refresh the newly opened editor from the accepted value before Save. Synthetic UI regressions cover both directions, same-frame Save, validation refusal and undo/redo. Estimates unchanged.
+
+- **2026-10-11 (M13):** CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. Estimates unchanged.
+
+- **2026-10-11 (M14, #307, Plan 2):** Forms now return terminal fields and the page-widget adoption count from one enumeration, and engine open reuses that result while retaining XFA script-button marking. The 12,000-page/no-form PDF (1,442,052 bytes) and 2,500-orphan-widget PDF (673,432 bytes) produce byte-identical `doc_open`/`doc_info` outputs against upstream `33c14e07cfd742a82bf03baa6b103c01008fa68c`, including the orphan repair note. After one warm-up per binary and three interleaved base/candidate rounds, median open times were 0.16/0.15 s and 0.08/0.07 s, with median peak RSS 62.69/59.98 MiB and 33.28/32.20 MiB. Workspace tests, Clippy, formatting, focused forms/engine/organize tests, and the WASM check pass. A behavior-preserving local binding in `organize` also lets the workspace Clippy gate pass. No estimate change.
+- **2026-10-11 (M14, Traditional Chinese semantics):** Corrected accessibility pass/fail labels, the inverted script-accessibility rule, Taiwan row/column terminology and form choice/read-only labels; added the missing table-row explanation. Catalog regressions cover the rule metadata and preserve field names. Milestone and effort estimates unchanged.
 
 - **2026-10-10 (M14, interface size):** Preferences ▸ Interface size scales the whole interface (50–250 %, setting `ui_scale`, control option `ui-scale`); 50 % brings an interface the system draws at 200 % back to 100 % (#456). Auto, the default, follows the desktop's text scaling: on Linux and the BSDs the desktop app reads GNOME's `text-scaling-factor` once at launch, so with Large Text (1.25) on a 1× display the interface no longer draws 13 px labels that show their pixels next to the system's text. The size is egui's zoom factor, so `pixels_per_point` grows with it and page rasters stay one texel per screen pixel; egui's own ⌘+/⌘− interface zoom is turned off so those keys stay page zoom. Still missing: KDE's font DPI and Windows' "Make text bigger" aren't read (both scale only text there), and egui's text is still greyscale-antialiased without the system's gamma, so small text looks rougher than GTK's at 100 %.
 - **2026-10-10 (M14, #496):** Shortcut displays share a UI formatter across toolbar search, registry menus, command palette, Help and tooltips. Modifier and key names use a dedicated catalog context in every bundled translation; missing entries keep the English key name rather than a command translation. German shows Strg/Umschalt/Entf, macOS retains its symbols, and runtime language changes refresh the display. Regression coverage checks localized layout widths, English/German switching, platform conventions and unchanged command execution. Milestone and effort estimates unchanged.
@@ -145,6 +170,8 @@ Newest first: the date, what moved, and the new overall estimate.
 - **2026-10-10 (M12, XFA rows and areas):** Dynamic XFA forms lay out a repeating subform inside a top-to-bottom container in positioned content (a table in an area) with all its instances, drawn and measured, instead of one; and areas no longer appear in data paths (`pdfcraft_xfa::data_path`), since they are not data scopes. Before, a form whose fields sit in an area read none of the values Adobe's viewers saved, wrote what was filled here under a new element named after the area, which Adobe's viewers would most likely not read, and a FormCalc total looping over the table's rows failed on the rows that were missing. Layout, the script tree, reading and writing the data and the engine's value and row operations share the one path rule. Synthetic tests cover the layout, the path rule and the whole round trip (rows, Adobe-written values, a FormCalc total over all rows, the written data, reopening). Still open for such forms: XFA script objects (`<variables><script>`), which aren't supported. Overall estimate unchanged (about 30–35%).
 
 - **2026-10-11 (M10, Windows printing follow-up to #847):** Windows print jobs print each sheet at 100% on the driver's paper closest to the sheet's size, landscape for wide sheets; they had been shrunk into .NET's default 1-inch margins (about 76% on Letter) and not rotated. Sheets are capped at about 64 megapixels so a poster-sized sheet can't exhaust memory. PowerShell runs without a console window, and the Print dialog lists printers and spools jobs off the UI thread (the desktop app's `printer_source`), so neither Ctrl+P nor a long job freezes the app. Kittest regression for the background printer list; the Windows rendering path is still checked only by the Windows CI job. Estimates unchanged.
+- **2026-10-10 (M3, System appearance completion, #446/#881):** The Linux portal introduced by #881 now uses the standard numeric appearance setting and event-driven updates, with idle-window wakeups for initial and changed results. When that setting states no preference it falls back to the GNOME schema's `color-scheme`, which XFCE's portal answers instead. Native windows retain inherited appearance and both egui style branches use the selected palette. Manual choices and the Light default remain; unknown System appearance resolves to Light. Controlled protocol and UI checks cover the remaining gaps; the supplied EndeavourOS/GNOME report has not been reproduced on that desktop. Estimates unchanged.
+
 - **2026-10-10 (M9, #179 follow-up):** A Windows store certificate that can't sign is no longer left out of the Sign dialog silently: `windows::list` names it with the reason and Windows error code (no private key, a P-521/Brainpool/Ed25519 key, a key CNG can't open), the picker shows it greyed and unselectable, and `sign_windows_ids` returns it under `unusable`. A key that needs a permission prompt to open is listed instead of skipped. Reported by a user whose CA-issued identity showed in Acrobat but not here; a plain .p12 import into the CNG and legacy Microsoft providers was verified to list, so the next report will carry the reason. Store test adds a key-less certificate; overall estimate unchanged (about 30–35%).
 - **2026-10-10 (M10.2, JPEG scanning follow-up to #729):** Skip marker fill bytes and keep reading JFIF, APP14 and ICC metadata after the frame header, stopping before scan data or at EOI. Invalid segment lengths return errors; damaged or mismatched ICC profiles retain #729's device-space fallback. Synthetic regression cases added but not run at the contributor's request. Estimates unchanged.
 - **2026-10-10 (M13, desktop action outputs):** Desktop Action Wizard keeps every result when input basenames repeat, or when the destination already has a result from an earlier run. It preserves the original filename and extension for a free name and adds numbered suffixes for occupied names; the bounded search returns an error rather than reusing an occupied path. A real-shell regression drives Start twice and reopens the three-page and one-page results, checking that the original inputs and earlier output remain intact. This covers the desktop writer separately from the CLI/MCP action_run repair in #877. Milestone and effort estimates unchanged.
@@ -319,6 +346,7 @@ Newest first: the date, what moved, and the new overall estimate.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-10 | minor | Recorded the remaining System appearance repair after #881; estimates unchanged |
 | 2026-10-10 | minor | Readiness table with hours per audience; full number restated as the additive weighted sum over dimensions (47% → 49%; method aligned with the standard, no new evidence) |
 | 2026-10-10 | minor | Essentials-user score added (≈ 66%) |
 | 2026-10-10 | minor | Gate consistency check: convert and share re-judged partial, not blocking; stage pre-alpha → alpha |
diff --git a/apps/pdfcraft-cli/Cargo.toml b/apps/pdfcraft-cli/Cargo.toml
index 77dfe2f9..abe2657f 100644
--- a/apps/pdfcraft-cli/Cargo.toml
+++ b/apps/pdfcraft-cli/Cargo.toml
@@ -16,6 +16,7 @@ workspace = true
 pdfcraft-render = { workspace = true }
 serde_json = { workspace = true }
 pdfcraft-engine = { workspace = true }
+pdfcraft-audit = { workspace = true }
 pdfcraft-cos = { workspace = true }
 pdfcraft-automation = { workspace = true }
 base64 = "0.22"
diff --git a/apps/pdfcraft-cli/src/main.rs b/apps/pdfcraft-cli/src/main.rs
index db61d46e..f8861143 100644
--- a/apps/pdfcraft-cli/src/main.rs
+++ b/apps/pdfcraft-cli/src/main.rs
@@ -55,6 +55,7 @@ pdfcraft-cli combine <a.pdf> <b.pdf> … --out combined.pdf
 pdfcraft-cli extract <in.pdf> --pages 1,3,5 --out out.pdf
 pdfcraft-cli split   <in.pdf> (--every N | --before 3,7) [--out-dir DIR]
 pdfcraft-cli check  <files or dirs…> [--timeout 20] [--dpi 36] [--json out.json]
+pdfcraft-cli audit  <file.pdf> [--password PW]            find faux redactions (fails when found)
 pdfcraft-cli tools                                       automation tools and their JSON Schemas
 pdfcraft-cli run    <tool> [key=value …] [--root DIR] [--out image.png]
 pdfcraft-cli run    --script steps.json [--root DIR]      [{\"tool\": \"doc_open\", \"args\": {…}}, …]
@@ -85,6 +86,7 @@ fn main() -> ExitCode {
         Some("split") => split(&args[1..]),
         Some("check") => check(&args[1..]),
         Some("check-one") => check_one(&args[1..]),
+        Some("audit") => audit(&args[1..]),
         Some("tools") => tools(),
         Some("run") => run(&args[1..]),
         Some("ui") => ui(&args[1..]),
@@ -146,6 +148,28 @@ fn version() -> Result<(), CliError> {
     Ok(())
 }
 
+/// Audit a document for faux redactions. Prints the findings as JSON; fails when any are
+/// found so scripts and CI can gate on it, and when the audit itself cannot run.
+fn audit(args: &[String]) -> Result<(), CliError> {
+    let path = *positional(args).first().ok_or("audit: missing file")?;
+    let bytes = read(path)?;
+    let doc = pdfcraft_cos::Document::open_with_password(bytes, flag(args, "--password")).map_err(|e| format!("{path}: {e}"))?;
+    let findings = pdfcraft_audit::audit_redactions(&doc).map_err(|e| format!("{path}: {e}"))?;
+    let items: Vec<serde_json::Value> = findings
+        .into_iter()
+        .map(|f| {
+            serde_json::json!({
+                "page": f.page + 1,
+                "kind": f.kind.id(),
+                "rect": f.rect,
+                "covered_text": f.covered_text,
+            })
+        })
+        .collect();
+    println!("{}", serde_json::json!({ "file": path, "findings": items, "count": items.len() }));
+    if items.is_empty() { Ok(()) } else { Err(format!("audit: {} faux redaction(s) found", items.len()).into()) }
+}
+
 fn flag<'a>(args: &'a [String], name: &str) -> Option<&'a str> {
     args.iter().position(|a| a == name).and_then(|i| args.get(i + 1)).map(String::as_str)
 }
@@ -156,15 +180,29 @@ struct OptionSpec {
     takes_value: bool,
 }
 
-/// Refuse a long option `command` doesn't take (a misspelling) before any file is read.
+/// Refuse unknown options and malformed confinement flags before any file is read.
 fn validate_options(command: &str, args: &[String], specs: &[OptionSpec]) -> Result<(), CliError> {
+    if specs.iter().any(|spec| spec.name == "--root") {
+        // `flag` searches every token, including another option's value. Match that lookup so
+        // a malformed confinement flag cannot be hidden there and fall back to no root.
+        let mut root_seen = false;
+        for (i, _) in args.iter().enumerate().filter(|(_, arg)| arg.as_str() == "--root") {
+            if root_seen {
+                return Err(format!("{command}: --root may only be supplied once").into());
+            }
+            root_seen = true;
+            if args.get(i + 1).is_none_or(|value| value.is_empty() || value.starts_with("--")) {
+                return Err(format!("{command}: --root needs a directory value").into());
+            }
+        }
+    }
     let mut i = 0;
     while let Some(arg) = args.get(i) {
         if let Some(name) = arg.strip_prefix("--") {
             let Some(spec) = specs.iter().find(|spec| spec.name == arg) else {
                 return Err(format!("{command}: unknown option --{name}").into());
             };
-            // A missing or malformed value is left to the command, which reports it in its own
+            // Other missing or malformed values are left to the command, which reports them in its own
             // terms (`text` and `extract` explain what a page value must be).
             i += if spec.takes_value { 2 } else { 1 };
         } else {
diff --git a/apps/pdfcraft-cli/tests/root_arguments.rs b/apps/pdfcraft-cli/tests/root_arguments.rs
new file mode 100644
index 00000000..2cf08ce2
--- /dev/null
+++ b/apps/pdfcraft-cli/tests/root_arguments.rs
@@ -0,0 +1,121 @@
+//! A malformed `--root` must never fall back to an unconfined automation session.
+
+use std::path::PathBuf;
+use std::process::Command;
+use std::sync::atomic::{AtomicU64, Ordering};
+
+const BIN: &str = env!("CARGO_BIN_EXE_pdfcraft-cli");
+const CANARY: &[u8] = b"KEEP EXISTING DESTINATION\n";
+
+struct TestDir(PathBuf);
+
+impl TestDir {
+    fn new() -> Self {
+        static NEXT: AtomicU64 = AtomicU64::new(0);
+        for _ in 0..128 {
+            let path = std::env::temp_dir().join(format!("pdfcraft-root-arguments-{}-{}", std::process::id(), NEXT.fetch_add(1, Ordering::Relaxed)));
+            match std::fs::create_dir(&path) {
+                Ok(()) => return Self(path),
+                Err(error) if error.kind() == std::io::ErrorKind::AlreadyExists => continue,
+                Err(error) => panic!("creating argument test directory: {error}"),
+            }
+        }
+        panic!("no unused argument test directory after 128 attempts");
+    }
+}
+
+impl Drop for TestDir {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+#[test]
+fn malformed_root_fails_before_a_script_can_overwrite_a_file() {
+    let dir = TestDir::new();
+    let destination = dir.0.join("existing.pdf");
+    let script = dir.0.join("steps.json");
+    let steps = serde_json::json!([
+        { "tool": "doc_create", "args": { "from": "blank", "width": 100, "height": 100 } },
+        { "tool": "doc_save", "args": { "doc": 1, "path": destination } },
+    ]);
+    std::fs::write(&script, steps.to_string()).unwrap();
+    std::fs::write(&destination, CANARY).unwrap();
+
+    for (flags, diagnostic) in [
+        (vec!["--root"], "--root needs a directory value"),
+        (vec!["--root", ""], "--root needs a directory value"),
+        (vec!["--root", "--out", "escaped.png"], "--root needs a directory value"),
+        (vec!["--out", "--root"], "--root needs a directory value"),
+        (vec!["--root", ".", "--root"], "--root may only be supplied once"),
+        (vec!["--root", ".", "--root", "."], "--root may only be supplied once"),
+        (vec!["--root", ".", "--out", "--root"], "--root may only be supplied once"),
+    ] {
+        // Both a valid script and a missing one: argument validation precedes script I/O.
+        for script_name in ["steps.json", "missing.json"] {
+            let out = Command::new(BIN).current_dir(&dir.0).args(["run", "--script", script_name]).args(&flags).output().unwrap();
+            assert_eq!(out.status.code(), Some(1), "{script_name} {flags:?} unexpectedly succeeded");
+            assert_eq!(String::from_utf8(out.stderr).unwrap().trim(), format!("pdfcraft-cli: run: {diagnostic}"));
+            assert!(out.stdout.is_empty(), "a refused command must not execute or report tool results");
+            assert_eq!(std::fs::read(&destination).unwrap(), CANARY);
+            assert!(!dir.0.join("escaped.png").exists());
+        }
+    }
+    assert_eq!(std::fs::read_dir(&dir.0).unwrap().count(), 2);
+}
+
+#[test]
+fn malformed_root_fails_before_direct_tool_argument_validation() {
+    let out = Command::new(BIN).args(["run", "doc_open", "not-key-value", "--root"]).output().unwrap();
+    assert_eq!(out.status.code(), Some(1));
+    assert_eq!(String::from_utf8(out.stderr).unwrap().trim(), "pdfcraft-cli: run: --root needs a directory value");
+    assert!(out.stdout.is_empty());
+}
+
+#[test]
+fn a_directory_name_starting_with_a_single_hyphen_remains_valid() {
+    let dir = TestDir::new();
+    std::fs::create_dir(dir.0.join("-documents")).unwrap();
+    let out = Command::new(BIN)
+        .current_dir(&dir.0)
+        .args(["run", "doc_create", "from=blank", "width=100", "height=100", "--root", "-documents"])
+        .output()
+        .unwrap();
+    assert!(out.status.success(), "{}", String::from_utf8_lossy(&out.stderr));
+    assert!(serde_json::from_slice::<serde_json::Value>(&out.stdout).is_ok());
+}
+
+#[cfg(feature = "mcp")]
+#[test]
+fn malformed_root_never_starts_or_initializes_an_mcp_server() {
+    use std::io::Write as _;
+    use std::process::Stdio;
+
+    let dir = TestDir::new();
+    // Even if a directory matches the next option's name, it is not a root operand.
+    std::fs::create_dir(dir.0.join("--compact")).unwrap();
+    for (flags, diagnostic) in [
+        (vec!["--root"], "--root needs a directory value"),
+        (vec!["--root", ""], "--root needs a directory value"),
+        (vec!["--root", "--compact"], "--root needs a directory value"),
+        (vec!["--compact", "--root"], "--root needs a directory value"),
+        (vec!["--root", ".", "--root"], "--root may only be supplied once"),
+        (vec!["--root", ".", "--root", "./--compact"], "--root may only be supplied once"),
+    ] {
+        let mut child = Command::new(BIN)
+            .current_dir(&dir.0)
+            .arg("mcp")
+            .args(&flags)
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+        // Early rejection may close stdin before this write; that is the intended behavior.
+        let _ = child.stdin.take().unwrap().write_all(b"{\"jsonrpc\":\"2.0\",\"id\":0,\"method\":\"initialize\",\"params\":{}}\n");
+        let out = child.wait_with_output().unwrap();
+        assert_eq!(out.status.code(), Some(1), "{flags:?} unexpectedly started the server");
+        assert_eq!(String::from_utf8(out.stderr).unwrap().trim(), format!("pdfcraft-cli: mcp: {diagnostic}"));
+        assert!(out.stdout.is_empty(), "a refused server must not answer initialize");
+    }
+}
diff --git a/apps/pdfcraft/Cargo.toml b/apps/pdfcraft/Cargo.toml
index 1850877a..b7028552 100644
--- a/apps/pdfcraft/Cargo.toml
+++ b/apps/pdfcraft/Cargo.toml
@@ -28,6 +28,12 @@ log = { workspace = true }
 # behind a safe API. Same version as PhotoCraft. Pinned exactly: review the diff before bumping.
 fmv-macos-events = "=0.1.0"
 
+[target.'cfg(target_os = "linux")'.dependencies]
+# Asks the Wayland compositor which GPU it draws with (linux-dmabuf feedback), so the window is
+# drawn on that one (src/compositor_gpu.rs). Both are already in the tree through winit.
+wayland-client = "0.31"
+wayland-protocols = { version = "0.32", features = ["client"] }
+
 [dev-dependencies]
 # Waits for wgpu's adapter, device and error-scope futures in tests (already in the tree through wgpu).
 pollster = "1.0"
diff --git a/apps/pdfcraft/src/compositor_gpu.rs b/apps/pdfcraft/src/compositor_gpu.rs
new file mode 100644
index 00000000..8edf23db
--- /dev/null
+++ b/apps/pdfcraft/src/compositor_gpu.rs
@@ -0,0 +1,177 @@
+//! The GPU the Wayland compositor draws with.
+//!
+//! A window drawn on another GPU reaches the compositor as that GPU's buffers, and the compositor
+//! may not show them: it can refuse them and end the window's connection (#96), or take them and
+//! show nothing, with no error on either side. The second happened on a hybrid laptop whose
+//! Hyprland runs on the NVIDIA GPU (`AQ_DRM_DEVICES`) while the built-in panel hangs off the Intel
+//! one: the panel rule picked Intel and the window stayed empty. Which GPU drives a display is a
+//! guess at the compositor's GPU; the compositor states it, as the `main_device` of its
+//! linux-dmabuf feedback (protocol version 4): the device it imports client buffers on.
+
+#[cfg(target_os = "linux")]
+use wayland_client::globals::{GlobalListContents, registry_queue_init};
+#[cfg(target_os = "linux")]
+use wayland_client::protocol::wl_registry::{self, WlRegistry};
+#[cfg(target_os = "linux")]
+use wayland_client::{Connection, Dispatch, QueueHandle};
+#[cfg(target_os = "linux")]
+use wayland_protocols::wp::linux_dmabuf::zv1::client::zwp_linux_dmabuf_feedback_v1::{self, ZwpLinuxDmabufFeedbackV1};
+#[cfg(target_os = "linux")]
+use wayland_protocols::wp::linux_dmabuf::zv1::client::zwp_linux_dmabuf_v1::{self, ZwpLinuxDmabufV1};
+
+/// PCI `(vendor, device)` ids of the GPU the Wayland compositor draws with. `None` outside a
+/// Wayland session, when the compositor doesn't say (linux-dmabuf older than version 4), when its
+/// device isn't a PCI GPU, and on other systems.
+#[cfg(target_os = "linux")]
+pub(crate) fn compositor_gpu() -> Option<(u32, u32)> {
+    let device = match main_device() {
+        Ok(device) => device,
+        Err(why) => {
+            log::debug!("the compositor's GPU is unknown: {why}");
+            return None;
+        }
+    };
+    let pci = pci_ids(std::path::Path::new("/sys/dev/char"), device);
+    match pci {
+        Some((vendor, id)) => log::info!("the compositor draws with {vendor:04x}:{id:04x}"),
+        None => log::debug!("the compositor's device {:?} has no PCI ids", major_minor(device)),
+    }
+    pci
+}
+
+#[cfg(not(target_os = "linux"))]
+pub(crate) fn compositor_gpu() -> Option<(u32, u32)> {
+    None
+}
+
+/// The `main_device` of the compositor's default linux-dmabuf feedback, asked on a connection of
+/// its own that is closed again before the window opens.
+#[cfg(target_os = "linux")]
+fn main_device() -> Result<u64, String> {
+    let conn = Connection::connect_to_env().map_err(|e| format!("no Wayland compositor: {e}"))?;
+    let (globals, mut queue) = registry_queue_init::<Feedback>(&conn).map_err(|e| e.to_string())?;
+    let qh = queue.handle();
+    // Version 4 brought the feedback; older compositors only list formats.
+    let dmabuf: ZwpLinuxDmabufV1 = globals.bind(&qh, 4..=4, ()).map_err(|e| format!("linux-dmabuf version 4: {e}"))?;
+    let _feedback = dmabuf.get_default_feedback(&qh, ());
+    let mut state = Feedback::default();
+    // The compositor sends the whole feedback, ending with `done`, in reply; the bound only keeps
+    // a compositor that never ends it from holding up the start.
+    for _ in 0..4 {
+        if state.done {
+            break;
+        }
+        queue.roundtrip(&mut state).map_err(|e| e.to_string())?;
+    }
+    // Dropping the connection releases the objects.
+    let device = state.main_device.ok_or("the compositor named no main device")?;
+    // A `dev_t`, in this machine's byte order.
+    let device: [u8; 8] = device.try_into().map_err(|d: Vec<u8>| format!("a {}-byte device number", d.len()))?;
+    Ok(u64::from_ne_bytes(device))
+}
+
+/// What [`main_device`] collects from the feedback events.
+#[cfg(target_os = "linux")]
+#[derive(Default)]
+struct Feedback {
+    main_device: Option<Vec<u8>>,
+    done: bool,
+}
+
+#[cfg(target_os = "linux")]
+impl Dispatch<WlRegistry, GlobalListContents> for Feedback {
+    fn event(_: &mut Self, _: &WlRegistry, _: wl_registry::Event, _: &GlobalListContents, _: &Connection, _: &QueueHandle<Self>) {}
+}
+
+#[cfg(target_os = "linux")]
+impl Dispatch<ZwpLinuxDmabufV1, ()> for Feedback {
+    // Version 4 sends no format or modifier events: the feedback replaces them.
+    fn event(_: &mut Self, _: &ZwpLinuxDmabufV1, _: zwp_linux_dmabuf_v1::Event, _: &(), _: &Connection, _: &QueueHandle<Self>) {}
+}
+
+#[cfg(target_os = "linux")]
+impl Dispatch<ZwpLinuxDmabufFeedbackV1, ()> for Feedback {
+    fn event(
+        state: &mut Self,
+        _: &ZwpLinuxDmabufFeedbackV1,
+        event: zwp_linux_dmabuf_feedback_v1::Event,
+        _: &(),
+        _: &Connection,
+        _: &QueueHandle<Self>,
+    ) {
+        match event {
+            zwp_linux_dmabuf_feedback_v1::Event::MainDevice { device } => state.main_device = Some(device),
+            zwp_linux_dmabuf_feedback_v1::Event::Done => state.done = true,
+            _ => {}
+        }
+    }
+}
+
+/// The major and minor numbers of a Linux `dev_t`, as glibc's and musl's `major()` and `minor()`
+/// split it.
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+fn major_minor(device: u64) -> (u64, u64) {
+    let major = ((device & 0x0000_0000_000f_ff00) >> 8) | ((device & 0xffff_f000_0000_0000) >> 32);
+    let minor = (device & 0x0000_0000_0000_00ff) | ((device & 0x0000_0fff_fff0_0000) >> 12);
+    (major, minor)
+}
+
+/// The PCI ids of the GPU behind DRM device `device` (its `cardN` or `renderDN` node), from
+/// `<sys_dev_char>/MAJOR:MINOR/device/{vendor,device}`.
+#[cfg_attr(not(target_os = "linux"), allow(dead_code))]
+fn pci_ids(sys_dev_char: &std::path::Path, device: u64) -> Option<(u32, u32)> {
+    let read_hex = |p: std::path::PathBuf| -> Option<u32> {
+        let s = std::fs::read_to_string(p).ok()?;
+        u32::from_str_radix(s.trim().trim_start_matches("0x"), 16).ok()
+    };
+    let (major, minor) = major_minor(device);
+    let gpu = sys_dev_char.join(format!("{major}:{minor}")).join("device");
+    Some((read_hex(gpu.join("vendor"))?, read_hex(gpu.join("device"))?))
+}
+
+#[cfg(test)]
+mod tests {
+    /// glibc's `makedev()`.
+    fn makedev(major: u64, minor: u64) -> u64 {
+        ((major & 0x0000_0fff) << 8) | ((major & 0xffff_f000) << 32) | (minor & 0x0000_00ff) | ((minor & 0xffff_ff00) << 12)
+    }
+
+    #[test]
+    fn device_numbers_split_into_major_and_minor() {
+        // DRM nodes: card1 is 226:1, renderD128 is 226:128.
+        assert_eq!(super::major_minor(0xe201), (226, 1));
+        assert_eq!(super::major_minor(0xe280), (226, 128));
+        for (major, minor) in [(0, 0), (226, 129), (511, 1_048_575), (0xfff, 0xff), (0x1000, 0x100), (0xffff_ffff, 0xffff_ffff)] {
+            assert_eq!(super::major_minor(makedev(major, minor)), (major, minor));
+        }
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn the_gpu_behind_a_device_number_comes_from_sysfs() -> std::io::Result<()> {
+        let dir = std::env::temp_dir().join(format!("pdfcraft-dev-char-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        // /sys/dev/char/226:128 links to the render node, whose `device` is the PCI GPU.
+        std::fs::create_dir_all(dir.join("226:128/device"))?;
+        std::fs::write(dir.join("226:128/device/vendor"), "0x10de\n")?;
+        std::fs::write(dir.join("226:128/device/device"), "0x25ac\n")?;
+        // A device that isn't a PCI GPU (a virtual one) has no ids.
+        std::fs::create_dir_all(dir.join("226:0/device"))?;
+        let render = super::pci_ids(&dir, makedev(226, 128));
+        let virtual_gpu = super::pci_ids(&dir, makedev(226, 0));
+        let missing = super::pci_ids(&dir, makedev(226, 1));
+        std::fs::remove_dir_all(&dir)?;
+        assert_eq!(render, Some((0x10de, 0x25ac)));
+        assert_eq!(virtual_gpu, None);
+        assert_eq!(missing, None);
+        Ok(())
+    }
+
+    #[test]
+    fn the_compositor_names_a_pci_gpu_or_nothing() {
+        // Whatever this session has: no compositor (CI), one that doesn't say, or a PCI GPU.
+        if let Some((vendor, _)) = super::compositor_gpu() {
+            assert_ne!(vendor, 0);
+        }
+    }
+}
diff --git a/apps/pdfcraft/src/main.rs b/apps/pdfcraft/src/main.rs
index cbcf5d70..ca44b7df 100644
--- a/apps/pdfcraft/src/main.rs
+++ b/apps/pdfcraft/src/main.rs
@@ -4,10 +4,10 @@
 //! `--create-images [images…]` stages the images in one PDF and asks for the page DPI.
 //!
 //! View options (applied after the files open; also the seed of the UI control channel):
-//! `--page N  --zoom 150  --layout continuous|two-up|single  --panel comments|bookmarks|pages|fields|layers|attachments|none
+//! `--page N  --zoom 150  --layout single|continuous|two-up|two-page  --continuous on|off  --panel comments|bookmarks|pages|fields|layers|attachments|none
 //!  --theme light|dark|system  --language auto|<code>  --mode all|read|edit|convert|sign  --tool <catalogue id>  --left open|closed
 //!  --organize on  --fields on  --dialog properties|shortcuts|about  --palette <query>  --home on
-//!  --cover on|off  --default-layout continuous|two-up|single  --default-zoom fit-width|fit-page|<percent>
+//!  --cover on|off  --default-layout single|continuous|two-up|two-page  --default-continuous on|off  --default-zoom fit-width|fit-page|<percent>
 //!  --combine-view grid|list  --combine-zoom 60..200`
 //!
 //! `--new-window` opens a window of its own. Without it, on Windows, a launch that only names files
@@ -31,7 +31,9 @@ use pdfcraft_ui_egui::PdfCraftApp;
 
 #[cfg(target_os = "macos")]
 mod apple_events;
+mod compositor_gpu;
 mod logging;
+mod reopen;
 mod single_instance;
 mod text_scale;
 mod updates;
@@ -299,6 +301,12 @@ fn app_creator<'a>(
     Box::new(move |cc| {
         started.set(true);
         let mut app = PdfCraftApp::new();
+        // First start (or settings from before Units existed): the region's unit.
+        app.units = pdfcraft_ui_egui::units::Unit::system();
+        #[cfg(target_os = "linux")]
+        app.enable_desktop_theme();
+        // The system's reopen-windows choice (macOS) starts the preference; a saved choice replaces it.
+        app.reopen_last_session = reopen::system_default();
         if let Some(json) = cc.storage.and_then(|s| s.get_string("pdfcraft").or_else(|| s.get_string(LEGACY_STORAGE_KEY))) {
             app.restore(&json);
         }
@@ -458,6 +466,10 @@ fn write_control_file(path: &str, port: u16, token: &str) -> std::io::Result<()>
 ///   desktop with a monitor on each GPU, issue #445) the discrete one wins, as the integrated one
 ///   may fail to present there. Where the system doesn't say which GPU drives a display (macOS,
 ///   containers, remote sessions) the power preference alone decides.
+/// - Under Wayland, the GPU the compositor draws with comes before all of that: the compositor
+///   says which one it is ([`compositor_gpu::compositor_gpu`]), and frames from another GPU may
+///   never reach the screen, even from the GPU behind the built-in panel when the compositor runs
+///   on the discrete one.
 /// - On Windows, use Direct3D 12, falling back to OpenGL, and never load Vulkan drivers unless
 ///   `WGPU_BACKEND` asks for them. Creating a Vulkan instance loads every installed Vulkan driver
 ///   into the process, and a faulty one (an Intel driver in issue #37) crashed PdfCraft before
@@ -477,7 +489,8 @@ fn configure_gpu(native: &mut eframe::NativeOptions) {
     if std::env::var_os("WGPU_POWER_PREF").is_none() {
         setup.power_preference = eframe::wgpu::PowerPreference::LowPower;
         let displays = display_gpus();
-        if !displays.is_empty() {
+        let compositor = compositor_gpu::compositor_gpu();
+        if !displays.is_empty() || compositor.is_some() {
             setup.native_adapter_selector = Some(std::sync::Arc::new(move |adapters, surface| {
                 let usable: Vec<&eframe::wgpu::Adapter> = adapters.iter().filter(|a| surface.is_none_or(|s| a.is_surface_supported(s))).collect();
                 let infos: Vec<(u32, u32, eframe::wgpu::DeviceType)> = usable
@@ -487,7 +500,7 @@ fn configure_gpu(native: &mut eframe::NativeOptions) {
                         (info.vendor, info.device, info.device_type)
                     })
                     .collect();
-                let picked = pick_adapter(&infos, &displays).and_then(|i| usable.get(i)).map(|a| (*a).clone());
+                let picked = pick_adapter(&infos, &displays, compositor).and_then(|i| usable.get(i)).map(|a| (*a).clone());
                 match &picked {
                     // Which GPU draws is the first question when a window stays black (#8, #378, #445).
                     Some(a) => {
@@ -620,12 +633,12 @@ fn linux_display_gpus(drm: &std::path::Path) -> Vec<DisplayGpu> {
     gpus
 }
 
-/// Index of the adapter to draw with: one that drives a display (by PCI ids) first. Among several
-/// of those, the one driving the primary display (a hybrid laptop's panel, #8; the primary display
-/// on Windows, #378), or else, with no primary display known (a Linux desktop with a monitor on
-/// each GPU, #445), the discrete one. Otherwise the most frugal kind: integrated, discrete, other,
-/// virtual, software.
-fn pick_adapter(adapters: &[(u32, u32, eframe::wgpu::DeviceType)], displays: &[DisplayGpu]) -> Option<usize> {
+/// Index of the adapter to draw with: the GPU the Wayland compositor draws with (`compositor`, by
+/// PCI ids) first, then one that drives a display. Among several of those, the one driving the
+/// primary display (a hybrid laptop's panel, #8; the primary display on Windows, #378), or else,
+/// with no primary display known (a Linux desktop with a monitor on each GPU, #445), the discrete
+/// one. Otherwise the most frugal kind: integrated, discrete, other, virtual, software.
+fn pick_adapter(adapters: &[(u32, u32, eframe::wgpu::DeviceType)], displays: &[DisplayGpu], compositor: Option<(u32, u32)>) -> Option<usize> {
     use eframe::wgpu::DeviceType;
     let display = |pci: (u32, u32)| displays.iter().find(|g| g.pci == pci);
     let multi_gpu_desktop = displays.len() > 1 && !displays.iter().any(|g| g.primary);
@@ -646,7 +659,7 @@ fn pick_adapter(adapters: &[(u32, u32, eframe::wgpu::DeviceType)], displays: &[D
                 DeviceType::VirtualGpu => 4,
                 DeviceType::Cpu => 5,
             };
-            (!drives_display, !drives_primary, rank)
+            (compositor != Some((*vendor, *device)), !drives_display, !drives_primary, rank)
         })
         .map(|(i, _)| i)
 }
@@ -928,6 +941,36 @@ mod tests {
         }
     }
 
+    #[test]
+    fn pipeline_creation_error_is_returned_and_device_remains_usable() {
+        use eframe::{egui_wgpu, wgpu};
+        let mut native = super::native_options(false, eframe::Renderer::Wgpu);
+        let egui_wgpu::WgpuSetup::CreateNew(setup) = &native.wgpu_options.wgpu_setup else { panic!("default setup creates its own instance") };
+        let instance = pollster::block_on(native.wgpu_options.wgpu_setup.new_instance());
+        let options = wgpu::RequestAdapterOptions { power_preference: setup.power_preference, ..Default::default() };
+        let Ok(adapter) = pollster::block_on(instance.request_adapter(&options)) else {
+            assert!(std::env::var_os("PDFCRAFT_TEST_REQUIRE_GPU").is_none(), "a GPU adapter is required for this run");
+            eprintln!("skipping pipeline regression: no GPU adapter");
+            return;
+        };
+        let (device, queue) = pollster::block_on(adapter.request_device(&(setup.device_descriptor)(&adapter)))
+            .expect("the selected adapter must provide a test device");
+        native.wgpu_options.wgpu_setup =
+            egui_wgpu::WgpuSetup::Existing(egui_wgpu::WgpuSetupExisting { instance: instance.clone(), adapter, device, queue });
+        // Three samples is invalid on every backend, so this reproduces a pipeline error
+        // without depending on a particular driver. The unpatched constructor panics.
+        for samples in [3, 1, 3, 1] {
+            let options = egui_wgpu::RendererOptions { msaa_samples: samples, ..Default::default() };
+            let result = pollster::block_on(egui_wgpu::RenderState::create(&native.wgpu_options, &instance, None, options));
+            if samples == 3 {
+                let error = result.err().expect("invalid pipeline must return an error");
+                assert!(error.to_string().contains("egui_pipeline"), "{error}");
+            } else {
+                assert!(result.is_ok(), "the device must remain usable: {:?}", result.err());
+            }
+        }
+    }
+
     #[test]
     fn winit_carries_the_windows_11_monitor_scale_fix() {
         // Issue #324: winit 0.30.13 as released nudges a window dragged onto a monitor with another
@@ -967,17 +1010,17 @@ mod tests {
     #[test]
     fn pick_adapter_prefers_the_gpu_driving_the_monitors() {
         // A desktop whose monitors are all on the discrete GPU: the integrated one shows black.
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA)]), Some(0));
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA)], None), Some(0));
         // Issue #378: the same on Windows, where the Ryzen integrated GPU without a monitor crashed
         // the display driver. Windows also says which display is the primary one.
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(NVIDIA)]), Some(0));
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(NVIDIA)], None), Some(0));
     }
 
     #[test]
     fn pick_adapter_prefers_the_gpu_driving_the_primary_display() {
         // A Windows desktop with a monitor on each GPU: the window opens on the primary display.
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU), panel(NVIDIA)]), Some(0));
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)]), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU), panel(NVIDIA)], None), Some(0));
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], None), Some(1));
     }
 
     #[test]
@@ -1009,10 +1052,10 @@ mod tests {
     #[test]
     fn pick_adapter_keeps_the_integrated_gpu_on_hybrid_laptops() {
         // Issue #8: the panel is on the integrated GPU, an external monitor on the discrete one.
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA), panel(AMD_IGPU)]), Some(1));
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)]), Some(1));
-        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)]), Some(1));
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU)]), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor(NVIDIA), panel(AMD_IGPU)], None), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], None), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)], None), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU)], None), Some(1));
     }
 
     #[test]
@@ -1021,17 +1064,32 @@ mod tests {
         use eframe::wgpu::DeviceType;
         let desktop =
             [(INTEL_IGPU.0, INTEL_IGPU.1, DeviceType::IntegratedGpu), (NVIDIA.0, NVIDIA.1, DeviceType::DiscreteGpu), (0, 0, DeviceType::Cpu)];
-        assert_eq!(super::pick_adapter(&desktop, &[monitor(INTEL_IGPU), monitor(NVIDIA)]), Some(1));
-        assert_eq!(super::pick_adapter(&desktop, &[monitor(NVIDIA), monitor(INTEL_IGPU)]), Some(1));
+        assert_eq!(super::pick_adapter(&desktop, &[monitor(INTEL_IGPU), monitor(NVIDIA)], None), Some(1));
+        assert_eq!(super::pick_adapter(&desktop, &[monitor(NVIDIA), monitor(INTEL_IGPU)], None), Some(1));
         // A GPU driving no display still loses to one that does.
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU), monitor(INTEL_IGPU)]), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor(AMD_IGPU), monitor(INTEL_IGPU)], None), Some(1));
+    }
+
+    #[test]
+    fn pick_adapter_prefers_the_gpu_the_compositor_draws_with() {
+        // A hybrid laptop whose Wayland compositor runs on the discrete GPU (Hyprland with
+        // `AQ_DRM_DEVICES` naming it first): the integrated GPU drives the built-in panel, yet the
+        // compositor shows nothing it draws, and reports no error either.
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)], Some(NVIDIA)), Some(0));
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], Some(NVIDIA)), Some(0));
+        // The usual hybrid laptop, with the compositor on the integrated GPU: as before (#8).
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU), monitor(NVIDIA)], Some(AMD_IGPU)), Some(1));
+        // No GPU drives a display as far as sysfs says (a container), but the compositor knows.
+        assert_eq!(super::pick_adapter(&adapters(), &[], Some(NVIDIA)), Some(0));
+        // A compositor GPU no adapter matches (a virtual one) leaves the displays in charge.
+        assert_eq!(super::pick_adapter(&adapters(), &[panel(AMD_IGPU)], Some((0x1af4, 0x1050))), Some(1));
     }
 
     #[test]
     fn pick_adapter_falls_back_to_low_power_without_a_match() {
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor((0x8086, 0x1234))]), Some(1));
-        assert_eq!(super::pick_adapter(&adapters(), &[monitor((0x8086, 0x1234)), monitor((0x8086, 0x5678))]), Some(1));
-        assert_eq!(super::pick_adapter(&[], &[monitor(NVIDIA)]), None);
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor((0x8086, 0x1234))], None), Some(1));
+        assert_eq!(super::pick_adapter(&adapters(), &[monitor((0x8086, 0x1234)), monitor((0x8086, 0x5678))], None), Some(1));
+        assert_eq!(super::pick_adapter(&[], &[monitor(NVIDIA)], None), None);
     }
 
     #[test]
@@ -1152,4 +1210,13 @@ mod tests {
         }
         let _ = std::fs::remove_dir_all(&dir);
     }
+
+    /// X11 startup notification and docks match a window to its launcher by `StartupWMClass`,
+    /// so it has to be the class the window carries: the app id, on Wayland and X11 alike.
+    #[test]
+    fn the_desktop_entry_names_the_window_class() {
+        let entry = include_str!("../../../packaging/linux/ai.storyteller.pdfcraft.desktop");
+        let class = entry.lines().find_map(|line| line.strip_prefix("StartupWMClass="));
+        assert_eq!(class, Some(super::APP_ID));
+    }
 }
diff --git a/apps/pdfcraft/src/reopen.rs b/apps/pdfcraft/src/reopen.rs
new file mode 100644
index 00000000..1280b457
--- /dev/null
+++ b/apps/pdfcraft/src/reopen.rs
@@ -0,0 +1,72 @@
+//! The system's choice for Preferences ▸ "Reopen the files that were open when PdfCraft last closed".
+//!
+//! On macOS, System Settings ▸ Desktop & Dock ▸ Windows ▸ "Close windows when quitting an
+//! application" is on by default; turning it off stores `NSQuitAlwaysKeepsWindows = 1`, and apps
+//! then reopen their windows on the next launch. A user who turned it off expects PdfCraft to
+//! bring its documents back too (#871), so that setting is the preference's starting value. It
+//! is read once at launch through `defaults`; the user's own choice in Preferences, once saved,
+//! wins over it. Other systems have no such setting, and the preference starts off there.
+
+/// How long `defaults` may take before launch goes on without it.
+#[cfg(target_os = "macos")]
+const TIMEOUT: std::time::Duration = std::time::Duration::from_millis(500);
+
+/// Whether reopening the last session starts on, before the saved preferences are applied.
+pub fn system_default() -> bool {
+    #[cfg(target_os = "macos")]
+    if let Some(output) = defaults(&["read", "-g", "NSQuitAlwaysKeepsWindows"]) {
+        return keeps_windows(&output);
+    }
+    false
+}
+
+/// `defaults read` output for a boolean (`1`, `0`, `true`, `false`): true only when it says so.
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+fn keeps_windows(output: &str) -> bool {
+    matches!(output.trim(), "1" | "true" | "yes" | "YES")
+}
+
+/// Run `defaults` and return what it printed, or `None` if it fails or hangs. Fails when the key
+/// was never set, which means the system default: close windows when quitting.
+#[cfg(target_os = "macos")]
+fn defaults(args: &[&str]) -> Option<String> {
+    use std::io::Read;
+    use std::process::{Command, Stdio};
+    // The absolute path keeps a `defaults` earlier on PATH from running.
+    let mut child = Command::new("/usr/bin/defaults").args(args).stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::null()).spawn().ok()?;
+    let start = std::time::Instant::now();
+    loop {
+        match child.try_wait() {
+            Ok(Some(status)) if status.success() => break,
+            Ok(None) if start.elapsed() < TIMEOUT => std::thread::sleep(std::time::Duration::from_millis(5)),
+            _ => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return None;
+            }
+        }
+    }
+    let mut out = String::new();
+    // A boolean fits in far less; a misbehaving `defaults` can't make launch read without end.
+    child.stdout.take()?.take(256).read_to_string(&mut out).ok()?;
+    Some(out)
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn only_a_set_flag_keeps_windows() {
+        for on in ["1\n", "1", "true", "YES"] {
+            assert!(super::keeps_windows(on), "{on:?}");
+        }
+        for off in ["0\n", "0", "false", "NO", "", "garbage"] {
+            assert!(!super::keeps_windows(off), "{off:?}");
+        }
+    }
+
+    #[test]
+    fn reading_the_system_default_never_fails() {
+        // Whatever this machine is set to, the read returns a value within the timeout.
+        let _ = super::system_default();
+    }
+}
diff --git a/assets/icons/monitor.svg b/assets/icons/monitor.svg
new file mode 100644
index 00000000..e869f2f2
--- /dev/null
+++ b/assets/icons/monitor.svg
@@ -0,0 +1,15 @@
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  width="24"
+  height="24"
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width="2"
+  stroke-linecap="round"
+  stroke-linejoin="round"
+>
+  <rect width="20" height="14" x="2" y="3" rx="2" />
+  <line x1="8" x2="16" y1="21" y2="21" />
+  <line x1="12" x2="12" y1="17" y2="21" />
+</svg>
diff --git a/contributors/people.toml b/contributors/people.toml
index c685b584..50ed2d9e 100644
--- a/contributors/people.toml
+++ b/contributors/people.toml
@@ -74,3 +74,32 @@ sync_github_name = true
 
 [people.jay-tau]
 sync_github_name = true
+
+[people.Piohrun]
+real_name = "Grzegorz Martens"
+sync_github_name = true
+
+[people.krinry]
+sync_github_name = true
+
+
+[people.arcanii]
+real_name = "Bryan Mark"
+display_name = "Arcanii"
+sync_github_name = false
+
+[people.atoslins]
+real_name = "Atos Lins"
+display_name = "Atos Lins"
+sync_github_name = false
+
+[people.mhadidi06]
+display_name = "Mustafa Hadidi"
+
+[people.LucasT-dev]
+real_name = "Lucas"
+display_name = "Lucas"
+sync_github_name = true   # use the name on your public GitHub profile as display name
+
+[people.Losminek]
+sync_github_name = true
diff --git a/crates/a11y/README.md b/crates/a11y/README.md
index f00f429b..0a653f13 100644
--- a/crates/a11y/README.md
+++ b/crates/a11y/README.md
@@ -4,7 +4,7 @@ Layer L4: accessibility (execution plan M12.3). Today: the Accessibility Checker
 
 ```rust
 let report = check(&doc, &Options::default());          // 31 of 32 rules (colour contrast off)
-let html = report_html(&report, "file.pdf", "2026-10-02");
+let html = report_html(&report, "file.pdf", "2026-10-02", "en", &in_english);  // or an interface's words
 ```
 
 - **32 rules in 7 categories**, as in Acrobat's full check: Document (permission flag,
diff --git a/crates/a11y/src/content.rs b/crates/a11y/src/content.rs
index 2c6a100e..a6910823 100644
--- a/crates/a11y/src/content.rs
+++ b/crates/a11y/src/content.rs
@@ -1,12 +1,14 @@
 //! The Document, Page Content and Forms rules: catalog settings, page content (tagged or
 //! artifact, text, images, fonts) and annotations.
+//!
+//! Every sentence a rule here can say is listed in [`crate::WORDINGS`], so interfaces can say it in
+//! their own language; a test in this crate keeps that list complete.
 
 use std::collections::{BTreeMap, BTreeSet, HashSet};
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object};
 use pdfcraft_model::Page;
 
-use crate::structure::Tree;
 use crate::{Finding, Rule};
 
 /// What the page content holds, per checked page.
@@ -145,8 +147,8 @@ fn text_of(doc: &Document, d: &Dict, key: &[u8]) -> Option<String> {
     d.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_string().map(|s| s.to_text())).map(|s| s.trim().to_owned()).filter(|s| !s.is_empty())
 }
 
-fn doc_finding(message: impl Into<String>) -> Vec<Finding> {
-    vec![Finding { page: None, message: message.into() }]
+fn doc_finding(sentence: &'static str) -> Vec<Finding> {
+    vec![Finding::plain(None, sentence)]
 }
 
 pub(crate) fn document_rule(doc: &Document, rule: Rule, pages: &[Page], scan: &Scan) -> Vec<Finding> {
@@ -168,10 +170,10 @@ pub(crate) fn document_rule(doc: &Document, rule: Rule, pages: &[Page], scan: &S
             let marked = cat.get(b"MarkInfo").map(|m| doc.resolve(m)).and_then(|m| m.as_dict().and_then(|d| d.get(b"Marked").cloned()));
             let mut out = Vec::new();
             if !cat.contains(b"StructTreeRoot") {
-                out.push(Finding { page: None, message: "The document has no tags (structure tree)".into() });
+                out.push(Finding::plain(None, "The document has no tags (structure tree)"));
             }
             if !matches!(marked, Some(Object::Bool(true))) {
-                out.push(Finding { page: None, message: "The document isn't marked as tagged (MarkInfo Marked)".into() });
+                out.push(Finding::plain(None, "The document isn't marked as tagged (MarkInfo Marked)"));
             }
             out
         }
@@ -186,7 +188,7 @@ pub(crate) fn document_rule(doc: &Document, rule: Rule, pages: &[Page], scan: &S
             let mut out = Vec::new();
             let info = doc.trailer().get(b"Info").map(|i| doc.resolve(i)).and_then(|i| i.as_dict().cloned()).unwrap_or_default();
             if text_of(doc, &info, b"Title").is_none() {
-                out.push(Finding { page: None, message: "The document has no title".into() });
+                out.push(Finding::plain(None, "The document has no title"));
             }
             let shows = cat
                 .get(b"ViewerPreferences")
@@ -194,13 +196,17 @@ pub(crate) fn document_rule(doc: &Document, rule: Rule, pages: &[Page], scan: &S
                 .and_then(|v| v.as_dict().and_then(|d| d.get(b"DisplayDocTitle").map(|x| matches!(&*doc.resolve(x), Object::Bool(true)))))
                 .unwrap_or(false);
             if !shows {
-                out.push(Finding { page: None, message: "The window shows the file name, not the title (Initial View > Show)".into() });
+                out.push(Finding::plain(None, "The window shows the file name, not the title (Initial View > Show)"));
             }
             out
         }
         Rule::Bookmarks => {
             let has = cat.get(b"Outlines").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().map(|d| d.contains(b"First"))).unwrap_or(false);
-            if pages.len() > 20 && !has { doc_finding(format!("{} pages and no bookmarks", pages.len())) } else { Vec::new() }
+            if pages.len() > 20 && !has {
+                vec![Finding::worded(None, "{n} pages and no bookmarks", vec![("{n}", pages.len().to_string())])]
+            } else {
+                Vec::new()
+            }
         }
         _ => Vec::new(),
     }
@@ -212,9 +218,8 @@ fn subtype_name(d: &Dict) -> String {
     String::from_utf8_lossy(d.name(b"Subtype").unwrap_or(b"Unknown")).into_owned()
 }
 
-pub(crate) fn page_rule(doc: &Document, rule: Rule, pages: &[Page], list: &[usize], scan: &Scan, tree: &Tree) -> Vec<Finding> {
+pub(crate) fn page_rule(doc: &Document, rule: Rule, pages: &[Page], list: &[usize], scan: &Scan, tagged: bool) -> Vec<Finding> {
     let mut out = Vec::new();
-    let tagged = tree.exists;
     let annots = |p: &Page| -> Vec<(ObjRef, Dict)> {
         let a = p.dict.get(b"Annots").map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap_or_default();
         a.iter()
@@ -228,7 +233,10 @@ pub(crate) fn page_rule(doc: &Document, rule: Rule, pages: &[Page], list: &[usiz
                 return doc_finding("The document isn't tagged, so none of its content is");
             }
             for (p, n) in &scan.untagged {
-                out.push(Finding { page: Some(*p), message: format!("Page {}: {n} untagged content item{}", p + 1, if *n == 1 { "" } else { "s" }) });
+                // One item and several items are separate wordings, so a language can agree the
+                // noun with the number its own way.
+                let pattern = if *n == 1 { "Page {p}: {n} untagged content item" } else { "Page {p}: {n} untagged content items" };
+                out.push(Finding::worded(Some(*p), pattern, vec![("{p}", (p + 1).to_string()), ("{n}", n.to_string())]));
             }
         }
         Rule::TaggedAnnotations | Rule::TaggedMultimedia | Rule::TaggedFormFields => {
@@ -242,8 +250,17 @@ pub(crate) fn page_rule(doc: &Document, rule: Rule, pages: &[Page], list: &[usiz
                         _ => st != b"Widget" && !MULTIMEDIA.contains(&st) && st != b"PrinterMark",
                     };
                     if applies && !(tagged && a.contains(b"StructParent")) {
-                        let what = if st == b"Widget" { "Form field".to_string() } else { format!("{} annotation", subtype_name(&a)) };
-                        out.push(Finding { page: Some(p), message: format!("{what} on page {} isn't tagged", p + 1) });
+                        // A whole sentence each way, rather than a noun put in front of one: a form
+                        // field and an annotation of some subtype read differently in other
+                        // languages. The subtype itself is the PDF's own name and goes in as it is.
+                        let mut values = vec![("{p}", (p + 1).to_string())];
+                        let pattern = if st == b"Widget" {
+                            "Form field on page {p} isn't tagged"
+                        } else {
+                            values.push(("{}", subtype_name(&a)));
+                            "{} annotation on page {p} isn't tagged"
+                        };
+                        out.push(Finding::worded(Some(p), pattern, values));
                     }
                 }
             }
@@ -252,7 +269,7 @@ pub(crate) fn page_rule(doc: &Document, rule: Rule, pages: &[Page], list: &[usiz
             for &p in list {
                 let Some(page) = pages.get(p) else { continue };
                 if !annots(page).is_empty() && page.dict.name(b"Tabs") != Some(b"S") {
-                    out.push(Finding { page: Some(p), message: format!("Page {} doesn't tab in structure order", p + 1) });
+                    out.push(Finding::worded(Some(p), "Page {p} doesn't tab in structure order", vec![("{p}", (p + 1).to_string())]));
                 }
             }
         }
@@ -264,8 +281,18 @@ pub(crate) fn page_rule(doc: &Document, rule: Rule, pages: &[Page], list: &[usiz
                         && let Some(f) = doc.get(*r).as_dict()
                         && !maps_to_unicode(doc, f)
                     {
-                        let name = f.name(b"BaseFont").map(|n| String::from_utf8_lossy(n).into_owned()).unwrap_or_else(|| "(unnamed)".into());
-                        out.push(Finding { page: Some(*p), message: format!("Font {name} on page {} doesn't map its characters to Unicode", p + 1) });
+                        // A font with no name gets its own whole sentence, so another language can
+                        // word that rather than translate a parenthesis. The name itself is the
+                        // document's own and goes in as it stands.
+                        let page = ("{p}", (p + 1).to_string());
+                        out.push(match f.name(b"BaseFont") {
+                            Some(n) => Finding::worded(
+                                Some(*p),
+                                "Font {} on page {p} doesn't map its characters to Unicode",
+                                vec![("{}", String::from_utf8_lossy(n).into_owned()), page],
+                            ),
+                            None => Finding::worded(Some(*p), "Font (unnamed) on page {p} doesn't map its characters to Unicode", vec![page]),
+                        });
                     }
                 }
             }
@@ -286,10 +313,11 @@ pub(crate) fn page_rule(doc: &Document, rule: Rule, pages: &[Page], list: &[usiz
                     }
                     let fd = doc.get(field).as_dict().cloned().unwrap_or_default();
                     if text_of(doc, &fd, b"TU").is_none() {
-                        out.push(Finding {
-                            page: Some(p),
-                            message: format!("Field \"{}\" on page {} has no description (tooltip)", full_name(doc, field), p + 1),
-                        });
+                        out.push(Finding::worded(
+                            Some(p),
+                            "Field \"{}\" on page {p} has no description (tooltip)",
+                            vec![("{}", full_name(doc, field)), ("{p}", (p + 1).to_string())],
+                        ));
                     }
                 }
             }
diff --git a/crates/a11y/src/lib.rs b/crates/a11y/src/lib.rs
index 203139d5..60b26102 100644
--- a/crates/a11y/src/lib.rs
+++ b/crates/a11y/src/lib.rs
@@ -20,7 +20,7 @@ mod structure;
 
 pub use alt::{AltError, Figure, figures, mark_decorative, set_alt};
 pub use headings::{Heading, headings};
-pub use report::report_html;
+pub use report::{REPORT_WORDS, report_html};
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub enum Category {
@@ -407,13 +407,154 @@ impl Status {
 }
 
 /// One problem: where it is and what is wrong.
+///
+/// The sentence comes in two forms. [`message`](Finding::message) is it, in English, ready to read.
+/// [`pattern`](Finding::pattern) is the same sentence with a named hole where each value went, and
+/// [`values`](Finding::values) is what filled them, so an interface can say it in another language
+/// instead of showing the English one: it translates the pattern and puts the same values back.
+/// `message` is always `pattern` with `values` in it, because [`Finding::worded`] builds it.
+///
+/// Every hole holds the document's own data — an element type, a font name, a count — and goes in
+/// as it stands, with one exception: a hole named `{what}` holds another wording of ours, still with
+/// its own holes in it. An interface translates that wording too and puts it in the frame first, and
+/// then fills every hole in what it has; [`Finding::nested`] builds such a finding.
 #[derive(Clone, Debug, PartialEq)]
 pub struct Finding {
     /// 0-based page, when the problem is on a page.
     pub page: Option<usize>,
     pub message: String,
+    /// The English sentence with a hole, such as `{p}` or `{what}`, where each value went.
+    pub pattern: &'static str,
+    /// What goes in each of `pattern`'s holes, by the hole's name (`"{p}"`, braces included).
+    pub values: Vec<(&'static str, String)>,
 }
 
+impl Finding {
+    /// A finding whose sentence says the same thing however the document is put together.
+    pub fn plain(page: Option<usize>, sentence: &'static str) -> Self {
+        Finding { page, message: sentence.to_owned(), pattern: sentence, values: Vec::new() }
+    }
+
+    /// A finding built from a wording and what goes in its holes. The English `message` is filled
+    /// in here, so it and `pattern` can never drift apart.
+    pub fn worded(page: Option<usize>, pattern: &'static str, values: Vec<(&'static str, String)>) -> Self {
+        Finding { page, message: say(pattern, &values), pattern, values }
+    }
+
+    /// A finding that says where the problem is and, in `{what}`, what is wrong, each worded
+    /// separately so the two read in whichever order the language reads them.
+    ///
+    /// `what` is one of our own wordings and may have holes of its own; they are filled from
+    /// `values` along with the frame's. It goes in before the values do — it is ours, not the
+    /// document's — which is what lets its holes be filled at all.
+    pub fn nested(page: Option<usize>, pattern: &'static str, what: &'static str, mut values: Vec<(&'static str, String)>) -> Self {
+        let message = say(&pattern.replace("{what}", what), &values);
+        values.push(("{what}", what.to_owned()));
+        Finding { page, message, pattern, values }
+    }
+
+    /// This finding as one sentence, said in the language `words` translates into.
+    ///
+    /// The frame is translated, the wording in `{what}` — if the frame has one — is translated and
+    /// goes in, and only then does the document's own data, in a single pass, so nothing the
+    /// document itself says can be read as a hole. With `&|s: &str| s.to_owned()` this is
+    /// [`message`](Finding::message).
+    pub fn said(&self, words: Words) -> String {
+        let mut frame = words(self.pattern);
+        if let Some((_, what)) = self.values.iter().find(|(name, _)| *name == "{what}") {
+            frame = frame.replace("{what}", &words(what));
+        }
+        say(&frame, &self.values)
+    }
+}
+
+/// How an interface says one of our wordings in its own language, holes and all: given the English
+/// in [`WORDINGS`], the same wording in that language. [`in_english`] keeps the English.
+pub type Words<'a> = &'a dyn Fn(&str) -> String;
+
+/// The [`Words`] that translate nothing: the wording as it is written here.
+pub fn in_english(wording: &str) -> String {
+    wording.to_owned()
+}
+
+/// A wording with its holes filled.
+///
+/// A hole is a name in braces, such as `{p}`; what is not in `values` is left as it is written.
+/// Values go in during a single pass over the wording, so a value that itself contains braces is
+/// never read as a hole: the document's own words reach the screen as they stand.
+///
+/// An interface says a [`Finding`] in its own language with this, after translating the pattern
+/// and, if there is one, the wording in `{what}`.
+pub fn say(pattern: &str, values: &[(&str, String)]) -> String {
+    let mut out = String::with_capacity(pattern.len() + 16);
+    let mut rest = pattern;
+    while let Some(open) = rest.find('{') {
+        let (before, from_brace) = rest.split_at(open);
+        out.push_str(before);
+        // `find` counts from the brace, and `}` is one byte, so this is a char boundary; `get`
+        // rather than slicing in case it ever isn't.
+        let Some(close) = from_brace.find('}') else {
+            // A brace with nothing closing it is just text.
+            out.push_str(from_brace);
+            return out;
+        };
+        let Some(hole) = from_brace.get(..=close) else { return out + from_brace };
+        match values.iter().find(|(name, _)| *name == hole) {
+            Some((_, value)) => out.push_str(value),
+            None => out.push_str(hole),
+        }
+        rest = from_brace.get(close + 1..).unwrap_or_default();
+    }
+    out.push_str(rest);
+    out
+}
+
+/// Every sentence the checker can say: each [`Finding::pattern`] and each wording that goes in a
+/// `{what}` hole, in English, with its holes still in it.
+///
+/// An interface that shows the report in another language translates these, which is the whole
+/// reason they are gathered here; `wordings_are_complete` fails if a rule says something that is
+/// not on the list.
+pub const WORDINGS: &[&str] = &[
+    // Document rules.
+    "The security settings don't allow screen readers to read the text",
+    "No page has text: the document appears to be images of pages",
+    "The document has no tags (structure tree)",
+    "The document isn't marked as tagged (MarkInfo Marked)",
+    "No document language is set",
+    "The document has no title",
+    "The window shows the file name, not the title (Initial View > Show)",
+    "{n} pages and no bookmarks",
+    // Page content and forms.
+    "The document isn't tagged, so none of its content is",
+    "Page {p}: {n} untagged content item",
+    "Page {p}: {n} untagged content items",
+    "Form field on page {p} isn't tagged",
+    "{} annotation on page {p} isn't tagged",
+    "Page {p} doesn't tab in structure order",
+    "Font {} on page {p} doesn't map its characters to Unicode",
+    "Font (unnamed) on page {p} doesn't map its characters to Unicode",
+    "Field \"{}\" on page {p} has no description (tooltip)",
+    // The structure rules: the two frames, then what goes in their `{what}`.
+    "{ty} element: {what}",
+    "{ty} element on page {p}: {what}",
+    "no alternate text",
+    "its alternate text is inside another element's and will never be read",
+    "alternate text on an element with no page content",
+    "alternate text hides an annotation inside it",
+    "not in a Table, THead, TBody or TFoot",
+    "not in a TR",
+    "no header cells (TH)",
+    "rows have between {min} and {max} columns",
+    "no summary",
+    "not in an L (list)",
+    "not in an LI (list item)",
+    "the first heading is an H{n}; headings should not skip levels",
+    "H{n} follows an H{d}; headings should not skip levels",
+    // The summary at the end of a long list.
+    AND_MORE,
+];
+
 #[derive(Clone, Debug, PartialEq)]
 pub struct RuleResult {
     pub rule: Rule,
@@ -458,6 +599,9 @@ impl Report {
 /// Findings beyond this many per rule are summarised ("… and n more").
 const MAX_FINDINGS: usize = 200;
 
+/// What the summary of the findings beyond [`MAX_FINDINGS`] says.
+const AND_MORE: &str = "… and {n} more";
+
 /// Run the full check.
 pub fn check(doc: &Document, options: &Options) -> Report {
     let pages = pdfcraft_model::pages(doc);
@@ -465,8 +609,9 @@ pub fn check(doc: &Document, options: &Options) -> Report {
         Some(p) => p.iter().copied().filter(|p| *p < pages.len()).collect(),
         None => (0..pages.len()).collect(),
     };
-    let tree = structure::Tree::read(doc, &pages);
+    let tagged = structure::has_struct_tree(doc);
     let scan = content::Scan::run(doc, &pages, &page_list);
+    let mut tree_rules = structure::run(doc, &pages, &options.rules);
     let mut results = Vec::with_capacity(32);
     for rule in Rule::ALL {
         if !options.rules.contains(&rule) {
@@ -477,15 +622,24 @@ pub fn check(doc: &Document, options: &Options) -> Report {
             results.push(RuleResult { rule, status: Status::Manual, findings: Vec::new() });
             continue;
         }
-        let mut findings = match rule.category() {
-            Category::Document => content::document_rule(doc, rule, &pages, &scan),
-            Category::PageContent | Category::Forms => content::page_rule(doc, rule, &pages, &page_list, &scan, &tree),
-            _ => tree.rule(rule),
+        // `total` counts every finding; `findings` holds the first MAX_FINDINGS of them.
+        let (mut findings, total) = match rule.category() {
+            Category::Document => {
+                let found = content::document_rule(doc, rule, &pages, &scan);
+                let n = found.len();
+                (found, n)
+            }
+            Category::PageContent | Category::Forms => {
+                let found = content::page_rule(doc, rule, &pages, &page_list, &scan, tagged);
+                let n = found.len();
+                (found, n)
+            }
+            _ => tree_rules.remove(&rule).unwrap_or_default(),
         };
-        if findings.len() > MAX_FINDINGS {
-            let more = findings.len() - MAX_FINDINGS;
+        if total > MAX_FINDINGS {
+            let more = total - MAX_FINDINGS;
             findings.truncate(MAX_FINDINGS);
-            findings.push(Finding { page: None, message: format!("… and {more} more") });
+            findings.push(Finding::worded(None, AND_MORE, vec![("{n}", more.to_string())]));
         }
         let status = if findings.is_empty() { Status::Passed } else { Status::Failed };
         results.push(RuleResult { rule, status, findings });
diff --git a/crates/a11y/src/report.rs b/crates/a11y/src/report.rs
index 7b042ba9..97f8a4ba 100644
--- a/crates/a11y/src/report.rs
+++ b/crates/a11y/src/report.rs
@@ -1,48 +1,76 @@
 //! The accessibility report: a self-contained HTML page with the summary and, per category,
 //! each rule's status, description and problems.
+//!
+//! The page is written in whichever language `words` translates into, down to its `lang` attribute,
+//! so it reads the way the interface that saved it reads. Only the file name, the date and what the
+//! findings say about the document itself come from elsewhere.
 
-use crate::{Category, Report, Status};
+use crate::{Category, Report, Status, Words};
 
 fn esc(s: &str) -> String {
     s.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;")
 }
 
-/// The report for `file_name`, dated `date` (as the caller formats it).
-pub fn report_html(report: &Report, file_name: &str, date: &str) -> String {
+/// The page's own words, in the order it says them: its heading, what it calls the file and the
+/// date, the two things the summary can say, and the headers of the table.
+///
+/// The rest of what the page says it gets from elsewhere — the categories, the rules and the
+/// findings name themselves — so an interface has these to translate and those to translate; a test
+/// in this crate keeps the list in step with the page.
+pub const REPORT_WORDS: &[&str] = &[
+    "Accessibility Report",
+    "Filename",
+    "Report created",
+    "Summary",
+    "The checker found problems which may prevent the document from being fully accessible.",
+    "The checker found no problems in this document.",
+    "Detailed Report",
+    "Rule Name",
+    "Status",
+    "Description",
+];
+
+/// The report for `file_name`, dated `date` (as the caller formats it), written in the language
+/// `words` translates into and marked `lang` (`"en"` and `&|s: &str| s.to_owned()` for English).
+pub fn report_html(report: &Report, file_name: &str, date: &str, lang: &str, words: Words) -> String {
+    let title = esc(&words("Accessibility Report"));
     let mut h = String::new();
-    h.push_str("<!doctype html>\n<html lang=\"en\"><head><meta charset=\"utf-8\"><title>Accessibility Report</title>\n<style>\n");
+    h.push_str(&format!("<!doctype html>\n<html lang=\"{}\"><head><meta charset=\"utf-8\"><title>{title}</title>\n<style>\n", esc(lang)));
     h.push_str(
         "body{font:14px/1.45 system-ui,sans-serif;margin:24px;color:#1d1d1f}h1{font-size:22px}h2{font-size:17px;margin-top:28px}\
          table{border-collapse:collapse;width:100%}th,td{border:1px solid #ccc;padding:6px 8px;text-align:left;vertical-align:top}\
          th{background:#f2f2f2}.Failed{color:#b3261e;font-weight:600}.Passed{color:#1e7b34}ul{margin:4px 0 0;padding-left:18px}\n",
     );
-    h.push_str("</style></head><body>\n<h1>Accessibility Report</h1>\n");
-    h.push_str(&format!("<p>Filename: <b>{}</b><br>Report created: {}</p>\n", esc(file_name), esc(date)));
-    h.push_str("<h2>Summary</h2>\n<p>");
-    h.push_str(if report.count(Status::Failed) > 0 {
-        "The checker found problems which may prevent the document from being fully accessible."
+    h.push_str(&format!("</style></head><body>\n<h1>{title}</h1>\n"));
+    h.push_str(&format!("<p>{}: <b>{}</b><br>{}: {}</p>\n", esc(&words("Filename")), esc(file_name), esc(&words("Report created")), esc(date)));
+    h.push_str(&format!("<h2>{}</h2>\n<p>", esc(&words("Summary"))));
+    // Each outcome is a whole sentence, and each is handed over on its own, so the list in
+    // `REPORT_WORDS` can be read off this file.
+    h.push_str(&if report.count(Status::Failed) > 0 {
+        esc(&words("The checker found problems which may prevent the document from being fully accessible."))
     } else {
-        "The checker found no problems in this document."
+        esc(&words("The checker found no problems in this document."))
     });
     h.push_str("</p>\n<ul>\n");
     for s in [Status::Manual, Status::Skipped, Status::Passed, Status::Failed] {
-        h.push_str(&format!("<li>{}: {}</li>\n", s.label(), report.count(s)));
+        h.push_str(&format!("<li>{}: {}</li>\n", esc(&words(s.label())), report.count(s)));
     }
-    h.push_str("</ul>\n<h2>Detailed Report</h2>\n");
+    h.push_str(&format!("</ul>\n<h2>{}</h2>\n", esc(&words("Detailed Report"))));
+    let (name, status, description) = (esc(&words("Rule Name")), esc(&words("Status")), esc(&words("Description")));
     for c in Category::ALL {
-        h.push_str(&format!("<h3>{}</h3>\n<table><tr><th>Rule Name</th><th>Status</th><th>Description</th></tr>\n", c.label()));
+        h.push_str(&format!("<h3>{}</h3>\n<table><tr><th>{name}</th><th>{status}</th><th>{description}</th></tr>\n", esc(&words(c.label()))));
         for r in report.in_category(c) {
             h.push_str(&format!(
                 "<tr><td>{}</td><td class=\"{:?}\">{}</td><td>{}",
-                esc(r.rule.name()),
+                esc(&words(r.rule.name())),
                 r.status,
-                r.status.label(),
-                esc(r.rule.description())
+                esc(&words(r.status.label())),
+                esc(&words(r.rule.description()))
             ));
             if !r.findings.is_empty() {
                 h.push_str("<ul>");
                 for f in &r.findings {
-                    h.push_str(&format!("<li>{}</li>", esc(&f.message)));
+                    h.push_str(&format!("<li>{}</li>", esc(&f.said(words))));
                 }
                 h.push_str("</ul>");
             }
diff --git a/crates/a11y/src/structure.rs b/crates/a11y/src/structure.rs
index 9f978361..2a481148 100644
--- a/crates/a11y/src/structure.rs
+++ b/crates/a11y/src/structure.rs
@@ -1,12 +1,25 @@
 //! The structure tree (tags) as the checker needs it, and the rules that read it: alternate
 //! text, tables, lists and headings (ISO 32000-2 §14.7–14.8).
+//!
+//! The tree is never built as a whole. [`walk`] reads it depth first with an explicit stack and
+//! tells a [`Visitor`] about each element as it opens and as it closes. What the rules keep is
+//! bounded by the elements still open, plus, for a table, the row spans that reach into later
+//! rows. Findings are kept in document order, up to the report's limit.
+//!
+//! Every sentence a rule here can say is listed in [`crate::WORDINGS`], so interfaces can say it in
+//! their own language; a test in this crate keeps that list complete.
 
-use std::collections::{HashMap, HashSet};
+use std::cmp::Ordering;
+use std::collections::{BTreeMap, BTreeSet, BinaryHeap, HashMap, HashSet};
+use std::sync::Arc;
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object};
 use pdfcraft_model::Page;
 
-use crate::{Finding, Rule};
+use crate::{Finding, MAX_FINDINGS, Rule};
+
+/// Why a table's rows are irregular; `{min}` and `{max}` are the narrowest and widest row.
+const IRREGULAR: &str = "rows have between {min} and {max} columns";
 
 /// Standard structure types (PDF 1.7 and 2.0); anything else goes through the role map.
 const STANDARD: &[&[u8]] = &[
@@ -73,285 +86,328 @@ pub(crate) fn is_standard(t: &[u8]) -> bool {
     STANDARD.contains(&t)
 }
 
-/// Elements beyond this are not read (a guard against absurd trees).
-const MAX_ELEMENTS: usize = 2_000_000;
+/// Structure nested deeper than this is not read (a guard against absurd trees).
+const MAX_DEPTH: usize = 256;
 
-#[derive(Clone, Debug, Default)]
-pub(crate) struct Elem {
-    /// The standard type after the role map (or the type as written if it maps to nothing).
-    pub ty: Vec<u8>,
-    pub parent: Option<usize>,
-    pub children: Vec<usize>,
-    /// Has /Alt (or /ActualText, which also replaces the content).
-    pub alt: bool,
-    /// Marked content or an object reference directly under it.
-    pub content: bool,
-    /// Annotations it references (OBJR).
-    pub annots: Vec<ObjRef>,
-    pub page: Option<usize>,
-    pub attrs: Vec<Dict>,
+/// A span (ColSpan or RowSpan) counts as at most this many columns or rows.
+const MAX_SPAN: usize = 10_000;
+
+/// The rules this module evaluates.
+const RULES: [Rule; 13] = [
+    Rule::FiguresAltText,
+    Rule::NestedAltText,
+    Rule::AltTextAssociated,
+    Rule::AltTextHidesAnnotation,
+    Rule::OtherElementsAltText,
+    Rule::TableRows,
+    Rule::TableCells,
+    Rule::TableHeaders,
+    Rule::TableRegularity,
+    Rule::TableSummary,
+    Rule::ListItems,
+    Rule::LblLBody,
+    Rule::HeadingNesting,
+];
+
+/// The standard types the rules tell apart. Any other type is `Other`.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Kind {
+    Figure,
+    Formula,
+    Table,
+    /// THead, TBody or TFoot.
+    Section,
+    Tr,
+    Th,
+    Td,
+    L,
+    Li,
+    Lbl,
+    LBody,
+    /// TOCI, BibEntry, Note or FENote: places where a label may sit outside a list item.
+    NoteOrToc,
+    /// H1 to H6.
+    Heading(u8),
+    Other,
 }
 
-#[derive(Debug, Default)]
-pub(crate) struct Tree {
-    /// A /StructTreeRoot exists.
-    pub exists: bool,
-    pub elems: Vec<Elem>,
-    /// Top-level elements in order.
-    pub roots: Vec<usize>,
+fn kind_of(ty: &[u8]) -> Kind {
+    match ty {
+        b"Figure" => Kind::Figure,
+        b"Formula" => Kind::Formula,
+        b"Table" => Kind::Table,
+        b"THead" | b"TBody" | b"TFoot" => Kind::Section,
+        b"TR" => Kind::Tr,
+        b"TH" => Kind::Th,
+        b"TD" => Kind::Td,
+        b"L" => Kind::L,
+        b"LI" => Kind::Li,
+        b"Lbl" => Kind::Lbl,
+        b"LBody" => Kind::LBody,
+        b"TOCI" | b"BibEntry" | b"Note" | b"FENote" => Kind::NoteOrToc,
+        [b'H', d @ b'1'..=b'6'] => Kind::Heading(d - b'0'),
+        _ => Kind::Other,
+    }
 }
 
-impl Tree {
-    pub fn read(doc: &Document, pages: &[Page]) -> Tree {
-        let mut t = Tree::default();
-        let Some(cat) = doc.root().and_then(|r| doc.get(r).as_dict().cloned()) else { return t };
-        let Some(root) = cat.get(b"StructTreeRoot").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()) else { return t };
-        t.exists = true;
-        let role_map = root.get(b"RoleMap").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default();
-        let page_index: HashMap<ObjRef, usize> = pages.iter().enumerate().map(|(i, p)| (p.obj, i)).collect();
-        let mut seen = HashSet::new();
-        let mut reader = Reader { doc, role_map: &role_map, page_index: &page_index, seen: &mut seen };
-        if let Some(k) = root.get(b"K") {
-            let mut roots = Vec::new();
-            reader.kids(&mut t, k, None, None, &mut roots, 0);
-            t.roots = roots;
+/// An element while it is open. What only becomes known later (its content, what lies below it)
+/// is filled in as the walk goes on.
+#[derive(Debug)]
+pub(crate) struct Frame {
+    /// The standard type after the role map, or the type as written when it maps to nothing.
+    ty: Vec<u8>,
+    kind: Kind,
+    /// Its position in document order: the number it has in the tree read in full.
+    index: usize,
+    /// Its page: its own /Pg, else its parent's.
+    page: Option<usize>,
+    /// Has /Alt or /ActualText.
+    alt: bool,
+    /// An element above it has alternate text.
+    alt_above: bool,
+    /// Has a /Summary attribute.
+    summary: bool,
+    /// ColSpan and RowSpan, each read as 1 to `MAX_SPAN`.
+    col_span: usize,
+    row_span: usize,
+    /// Marked content, or an object reference, directly under it.
+    content: bool,
+    /// An annotation (OBJR) directly under it.
+    annot: bool,
+    /// Content, or an annotation, under it: set as its children close.
+    sub_content: bool,
+    sub_annot: bool,
+}
+
+impl Frame {
+    /// Content in this element or anywhere below it. Complete once the element has closed.
+    fn subtree_content(&self) -> bool {
+        self.content || self.sub_content
+    }
+
+    /// An annotation in this element or anywhere below it. Complete once the element has closed.
+    fn subtree_annot(&self) -> bool {
+        self.annot || self.sub_annot
+    }
+}
+
+/// Told about each element as it opens and as it closes.
+pub(crate) trait Visitor {
+    /// `e` opens. `ancestors` are the elements around it, outermost first.
+    fn enter(&mut self, ancestors: &[Frame], e: &Frame);
+
+    /// `e` closes, and everything below it has closed already. `ancestors` are the elements
+    /// still open.
+    fn exit(&mut self, ancestors: &[Frame], e: &Frame);
+}
+
+/// The dictionary (or stream) that `/StructTreeRoot` names in the catalog, when there is one.
+fn struct_root(doc: &Document) -> Option<Arc<Object>> {
+    let catalog = doc.get(doc.root()?);
+    let root = doc.resolve(catalog.as_dict()?.get(b"StructTreeRoot")?);
+    root.as_dict().is_some().then_some(root)
+}
+
+/// Whether the document has a structure tree.
+pub(crate) fn has_struct_tree(doc: &Document) -> bool {
+    struct_root(doc).is_some()
+}
+
+/// Walks the structure tree in document order, telling `v` about each element.
+fn walk<V: Visitor>(doc: &Document, pages: &[Page], v: &mut V) {
+    let Some(root) = struct_root(doc) else { return };
+    let role_map = root.as_dict().and_then(|d| d.get(b"RoleMap")).map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default();
+    let page_index: HashMap<ObjRef, usize> = pages.iter().enumerate().map(|(i, p)| (p.obj, i)).collect();
+    let mut w = Walker { doc, role_map, page_index, seen: HashSet::new(), frames: Vec::new(), tasks: Vec::new(), opened: 0 };
+    if root.as_dict().is_some_and(|d| d.contains(b"K")) {
+        w.tasks.push(Task::Node { loc: Loc { owner: root, path: vec![Step::K] }, depth: 0, page: None });
+    }
+    while let Some(task) = w.tasks.pop() {
+        w.step(task, v);
+    }
+}
+
+/// Where a value sits: the object `owner`, reached through `path`. A location holds its owner
+/// (rather than a borrow), so the walk can keep positions on its stack without copying the tree.
+#[derive(Clone)]
+struct Loc {
+    owner: Arc<Object>,
+    path: Vec<Step>,
+}
+
+#[derive(Clone, Copy)]
+enum Step {
+    /// Item `n` of an array.
+    Index(usize),
+    /// The /K entry of a dictionary.
+    K,
+}
+
+impl Loc {
+    fn value(&self) -> Option<&Object> {
+        self.path.iter().try_fold(&*self.owner, |cur, step| match step {
+            Step::Index(n) => match cur {
+                Object::Array(items) => items.get(*n),
+                _ => None,
+            },
+            Step::K => cur.as_dict()?.get(b"K"),
+        })
+    }
+
+    fn with(&self, step: Step) -> Loc {
+        let mut path = self.path.clone();
+        path.push(step);
+        Loc { owner: self.owner.clone(), path }
+    }
+}
+
+/// Work still to do. The walk is depth first: the last task pushed runs first.
+enum Task {
+    /// Read the value at `loc`, a kid at nesting `depth`, on page `page` if known.
+    Node { loc: Loc, depth: usize, page: Option<usize> },
+    /// Items `next..len` of the array at `loc`, each at nesting `depth`.
+    Items { loc: Loc, next: usize, len: usize, depth: usize, page: Option<usize> },
+    /// The innermost open element has no more kids.
+    Close,
+}
+
+/// The state of a walk: what is open, what is still to read and what has been read.
+struct Walker<'a> {
+    doc: &'a Document,
+    role_map: Dict,
+    page_index: HashMap<ObjRef, usize>,
+    /// Indirect kids already read. A kid reached again (a shared kid, or a cycle) is skipped, so a
+    /// kid counts once, where it first appears.
+    seen: HashSet<ObjRef>,
+    /// The open elements, outermost first.
+    frames: Vec<Frame>,
+    tasks: Vec<Task>,
+    /// Elements opened so far: the next element's position in document order.
+    opened: usize,
+}
+
+impl Walker<'_> {
+    fn step<V: Visitor>(&mut self, task: Task, v: &mut V) {
+        match task {
+            Task::Node { loc, depth, page } => self.node(&loc, depth, page, v),
+            Task::Items { loc, next, len, depth, page } => {
+                // The rest of the array waits below the item that is read now.
+                if next + 1 < len {
+                    self.tasks.push(Task::Items { loc: loc.clone(), next: next + 1, len, depth, page });
+                }
+                self.tasks.push(Task::Node { loc: loc.with(Step::Index(next)), depth, page });
+            }
+            Task::Close => self.close(v),
         }
-        t
     }
 
-    /// Elements in document (pre-)order.
-    fn preorder(&self) -> Vec<usize> {
-        let mut out = Vec::with_capacity(self.elems.len());
-        let mut stack: Vec<usize> = self.roots.iter().rev().copied().collect();
-        while let Some(i) = stack.pop() {
-            out.push(i);
-            stack.extend(self.elems[i].children.iter().rev().copied());
+    /// A kid: arrays hand their items on one level deeper, a reference is read once, and only a
+    /// dictionary can open an element.
+    fn node<V: Visitor>(&mut self, loc: &Loc, depth: usize, page: Option<usize>, v: &mut V) {
+        if depth > MAX_DEPTH {
+            return;
         }
-        out
-    }
-
-    fn ancestors(&self, i: usize) -> impl Iterator<Item = usize> + '_ {
-        std::iter::successors(self.elems[i].parent, move |p| self.elems[*p].parent)
-    }
-
-    /// `i` and everything under it.
-    fn subtree(&self, i: usize) -> Vec<usize> {
-        let mut out = Vec::new();
-        let mut stack = vec![i];
-        while let Some(j) = stack.pop() {
-            out.push(j);
-            stack.extend(self.elems[j].children.iter().copied());
+        let Some(value) = loc.value() else { return };
+        match value {
+            Object::Array(items) if !items.is_empty() => {
+                self.tasks.push(Task::Items { loc: loc.clone(), next: 0, len: items.len(), depth: depth + 1, page });
+            }
+            Object::Int(_) => self.mark_content(),
+            Object::Ref(r) => self.reference(*r, depth, page, v),
+            Object::Dict(_) => self.dict(loc, depth, page, v),
+            _ => {}
         }
-        out
     }
 
-    fn is(&self, i: usize, ty: &[u8]) -> bool {
-        self.elems[i].ty == ty
+    /// An indirect kid, read unless it has been read before.
+    fn reference<V: Visitor>(&mut self, r: ObjRef, depth: usize, page: Option<usize>, v: &mut V) {
+        if !self.seen.insert(r) {
+            return;
+        }
+        let target = self.doc.get(r);
+        if target.as_dict().is_some() {
+            self.dict(&Loc { owner: target, path: Vec::new() }, depth, page, v);
+        }
     }
 
-    fn parent_is(&self, i: usize, types: &[&[u8]]) -> bool {
-        self.elems[i].parent.is_some_and(|p| types.contains(&self.elems[p].ty.as_slice()))
-    }
-
-    fn finding(&self, i: usize, what: &str) -> Finding {
-        let e = &self.elems[i];
-        let ty = String::from_utf8_lossy(&e.ty);
-        let at = e.page.map(|p| format!(" on page {}", p + 1)).unwrap_or_default();
-        Finding { page: e.page, message: format!("{ty} element{at}: {what}") }
-    }
-
-    pub fn rule(&self, rule: Rule) -> Vec<Finding> {
-        let order = self.preorder();
-        let mut out = Vec::new();
-        match rule {
-            Rule::FiguresAltText => {
-                for &i in &order {
-                    if self.is(i, b"Figure") && !self.elems[i].alt && !self.ancestors(i).any(|a| self.elems[a].alt) {
-                        out.push(self.finding(i, "no alternate text"));
-                    }
-                }
-            }
-            Rule::OtherElementsAltText => {
-                for &i in &order {
-                    if self.is(i, b"Formula") && !self.elems[i].alt && !self.ancestors(i).any(|a| self.elems[a].alt) {
-                        out.push(self.finding(i, "no alternate text"));
-                    }
-                }
-            }
-            Rule::NestedAltText => {
-                for &i in &order {
-                    if self.elems[i].alt && self.ancestors(i).any(|a| self.elems[a].alt) {
-                        out.push(self.finding(i, "its alternate text is inside another element's and will never be read"));
-                    }
-                }
-            }
-            Rule::AltTextAssociated => {
-                for &i in &order {
-                    if self.elems[i].alt && !self.subtree(i).iter().any(|j| self.elems[*j].content) {
-                        out.push(self.finding(i, "alternate text on an element with no page content"));
-                    }
-                }
-            }
-            Rule::AltTextHidesAnnotation => {
-                for &i in &order {
-                    if self.elems[i].alt && self.subtree(i).iter().any(|j| !self.elems[*j].annots.is_empty()) {
-                        out.push(self.finding(i, "alternate text hides an annotation inside it"));
-                    }
-                }
-            }
-            Rule::TableRows => {
-                for &i in &order {
-                    if self.is(i, b"TR") && !self.parent_is(i, &[b"Table", b"THead", b"TBody", b"TFoot"]) {
-                        out.push(self.finding(i, "not in a Table, THead, TBody or TFoot"));
-                    }
-                }
-            }
-            Rule::TableCells => {
-                for &i in &order {
-                    if (self.is(i, b"TH") || self.is(i, b"TD")) && !self.parent_is(i, &[b"TR"]) {
-                        out.push(self.finding(i, "not in a TR"));
-                    }
-                }
-            }
-            Rule::TableHeaders => {
-                for &i in &order {
-                    if self.is(i, b"Table") && !self.table_cells(i).iter().any(|(_, c)| self.is(*c, b"TH")) {
-                        out.push(self.finding(i, "no header cells (TH)"));
-                    }
-                }
-            }
-            Rule::TableRegularity => {
-                for &i in &order {
-                    if self.is(i, b"Table")
-                        && let Some(why) = self.irregular(i)
-                    {
-                        out.push(self.finding(i, &why));
-                    }
-                }
-            }
-            Rule::TableSummary => {
-                for &i in &order {
-                    if self.is(i, b"Table") && self.attr(i, b"Summary").is_none() {
-                        out.push(self.finding(i, "no summary"));
-                    }
-                }
-            }
-            Rule::ListItems => {
-                for &i in &order {
-                    if self.is(i, b"LI") && !self.parent_is(i, &[b"L"]) {
-                        out.push(self.finding(i, "not in an L (list)"));
-                    }
-                }
-            }
-            Rule::LblLBody => {
-                for &i in &order {
-                    if (self.is(i, b"Lbl") || self.is(i, b"LBody")) && !self.parent_is(i, &[b"LI"]) && !self.inside_toc_or_note(i) {
-                        out.push(self.finding(i, "not in an LI (list item)"));
-                    }
-                }
-            }
-            Rule::HeadingNesting => {
-                let mut prev = 0u8;
-                for &i in &order {
-                    let level = match self.elems[i].ty.as_slice() {
-                        [b'H', d @ b'1'..=b'6'] => d - b'0',
-                        _ => continue,
-                    };
-                    if level > prev + 1 {
-                        let what = if prev == 0 { format!("the first heading is an H{level}") } else { format!("H{level} follows an H{prev}") };
-                        out.push(self.finding(i, &format!("{what}; headings should not skip levels")));
-                    }
-                    prev = level;
+    /// A dictionary. Marked content and object references only mark the open element; a
+    /// dictionary with /S is an element, and its /K kids are read inside it.
+    fn dict<V: Visitor>(&mut self, loc: &Loc, depth: usize, page: Option<usize>, v: &mut V) {
+        let Some(d) = loc.value().and_then(|o| o.as_dict()) else { return };
+        match d.name(b"Type") {
+            Some(b"MCR") => return self.mark_content(),
+            Some(b"OBJR") => {
+                self.mark_content();
+                let annotation = d
+                    .get(b"Obj")
+                    .and_then(Object::as_ref)
+                    .is_some_and(|o| self.doc.get(o).as_dict().is_some_and(|a| a.contains(b"Subtype") && a.contains(b"Rect")));
+                if annotation && let Some(parent) = self.frames.last_mut() {
+                    parent.annot = true;
                 }
+                return;
             }
             _ => {}
         }
-        out
-    }
-
-    /// Lbl is also allowed in TOCI and Note-like contexts (PDF 2.0); only list misuse is flagged.
-    fn inside_toc_or_note(&self, i: usize) -> bool {
-        self.parent_is(i, &[b"TOCI", b"BibEntry", b"Note", b"FENote"])
-    }
-
-    /// An attribute from the element's attribute objects (/A), any owner.
-    fn attr(&self, i: usize, key: &[u8]) -> Option<&Object> {
-        self.elems[i].attrs.iter().find_map(|d| d.get(key))
-    }
-
-    fn span(&self, i: usize, key: &[u8]) -> usize {
-        self.attr(i, key).and_then(Object::as_int).filter(|n| *n >= 1).map_or(1, |n| n.min(10_000) as usize)
-    }
-
-    /// The rows of a table (through THead/TBody/TFoot, not into nested tables) and their cells.
-    fn table_cells(&self, table: usize) -> Vec<(usize, usize)> {
-        let mut out = Vec::new();
-        for (r, row) in self.table_rows(table).into_iter().enumerate() {
-            for &c in &self.elems[row].children {
-                if self.is(c, b"TH") || self.is(c, b"TD") {
-                    out.push((r, c));
-                }
-            }
+        let Some(s) = d.name(b"S") else { return };
+        let page = self.page_of(d).or(page);
+        let alt = self.has_text(d, b"Alt") || self.has_text(d, b"ActualText");
+        let ty = self.standard(s);
+        let kind = kind_of(&ty);
+        let attrs = if matches!(kind, Kind::Table | Kind::Td | Kind::Th) { self.attr_dicts(d) } else { Vec::new() };
+        let frame = Frame {
+            ty,
+            kind,
+            index: self.opened,
+            page,
+            alt,
+            alt_above: self.frames.last().is_some_and(|p| p.alt || p.alt_above),
+            summary: attr_int(&attrs, b"Summary").is_some(),
+            col_span: span(&attrs, b"ColSpan"),
+            row_span: span(&attrs, b"RowSpan"),
+            content: false,
+            annot: false,
+            sub_content: false,
+            sub_annot: false,
+        };
+        self.opened = self.opened.saturating_add(1);
+        self.frames.push(frame);
+        if let Some((e, ancestors)) = self.frames.split_last() {
+            v.enter(ancestors, e);
+        }
+        self.tasks.push(Task::Close);
+        if d.contains(b"K") {
+            self.tasks.push(Task::Node { loc: loc.with(Step::K), depth: depth + 1, page });
         }
-        out
     }
 
-    fn table_rows(&self, table: usize) -> Vec<usize> {
-        let mut rows = Vec::new();
-        for &k in &self.elems[table].children {
-            match self.elems[k].ty.as_slice() {
-                b"TR" => rows.push(k),
-                b"THead" | b"TBody" | b"TFoot" => rows.extend(self.elems[k].children.iter().copied().filter(|r| self.is(*r, b"TR"))),
-                _ => {}
-            }
+    /// The innermost element has no more kids: report it, and pass its content up to its parent.
+    fn close<V: Visitor>(&mut self, v: &mut V) {
+        let Some(frame) = self.frames.pop() else { return };
+        if let Some(parent) = self.frames.last_mut() {
+            parent.sub_content |= frame.subtree_content();
+            parent.sub_annot |= frame.subtree_annot();
         }
-        rows
+        v.exit(&self.frames, &frame);
     }
 
-    /// Why the table's rows don't all have the same width, counting row and column spans.
-    fn irregular(&self, table: usize) -> Option<String> {
-        let rows = self.table_rows(table);
-        if rows.len() < 2 {
-            return None;
+    /// Marked content, or an object reference, directly under the open element.
+    fn mark_content(&mut self) {
+        if let Some(parent) = self.frames.last_mut() {
+            parent.content = true;
         }
-        // carry[c] = rows still covered at column c by a cell above.
-        let mut carry: Vec<usize> = Vec::new();
-        let mut widths = Vec::with_capacity(rows.len());
-        for &row in &rows {
-            let mut col = 0;
-            let mut next = carry.iter().map(|n| n.saturating_sub(1)).collect::<Vec<_>>();
-            for &c in self.elems[row].children.iter().filter(|c| self.is(**c, b"TH") || self.is(**c, b"TD")) {
-                while col < carry.len() && carry[col] > 0 {
-                    col += 1;
-                }
-                let (cs, rs) = (self.span(c, b"ColSpan"), self.span(c, b"RowSpan"));
-                if next.len() < col + cs {
-                    next.resize(col + cs, 0);
-                }
-                for n in next.iter_mut().skip(col).take(cs) {
-                    *n = (*n).max(rs - 1);
-                }
-                col += cs;
-            }
-            while col < carry.len() && carry[col] > 0 {
-                col += 1;
-            }
-            widths.push(col);
-            carry = next;
-        }
-        let (min, max) = (widths.iter().min()?, widths.iter().max()?);
-        (min != max).then(|| format!("rows have between {min} and {max} columns"))
     }
-}
 
-struct Reader<'a> {
-    doc: &'a Document,
-    role_map: &'a Dict,
-    page_index: &'a HashMap<ObjRef, usize>,
-    seen: &'a mut HashSet<ObjRef>,
-}
+    fn page_of(&self, d: &Dict) -> Option<usize> {
+        d.get(b"Pg").and_then(Object::as_ref).and_then(|r| self.page_index.get(&r).copied())
+    }
 
-impl Reader<'_> {
+    /// Whether `key` holds a string with some text in it.
+    fn has_text(&self, d: &Dict, key: &[u8]) -> bool {
+        d.get(key).map(|o| self.doc.resolve(o)).and_then(|o| o.as_string().map(|s| !s.to_text().trim().is_empty())).unwrap_or(false)
+    }
+
+    /// The standard type of `ty`, following the role map (a bounded number of steps).
     fn standard(&self, ty: &[u8]) -> Vec<u8> {
         let mut t = ty.to_vec();
         for _ in 0..12 {
@@ -366,86 +422,419 @@ impl Reader<'_> {
         t
     }
 
-    fn page_of(&self, d: &Dict) -> Option<usize> {
-        d.get(b"Pg").and_then(Object::as_ref).and_then(|r| self.page_index.get(&r).copied())
+    /// The attribute dictionaries of an element: the dictionaries its /A entry holds, one or an array.
+    fn attr_dicts(&self, d: &Dict) -> Vec<Arc<Object>> {
+        let Some(a) = d.get(b"A").map(|o| self.doc.resolve(o)) else { return Vec::new() };
+        let held: Vec<Arc<Object>> = match &*a {
+            Object::Array(items) => items.iter().map(|x| self.doc.resolve(x)).collect(),
+            other => vec![self.doc.resolve(other)],
+        };
+        held.into_iter().filter(|x| x.as_dict().is_some()).collect()
+    }
+}
+
+/// The integer value of `key` in the first attribute dictionary that has the key. `None` when no
+/// attribute dictionary has it; `Some(None)` when its value is not an integer.
+fn attr_int(attrs: &[Arc<Object>], key: &[u8]) -> Option<Option<i64>> {
+    attrs.iter().find_map(|a| a.as_dict()?.get(key)).map(Object::as_int)
+}
+
+/// A span attribute: at least 1, at most `MAX_SPAN`; 1 when absent or not an integer.
+fn span(attrs: &[Arc<Object>], key: &[u8]) -> usize {
+    attr_int(attrs, key).flatten().filter(|n| *n >= 1).map_or(1, |n| n.min(MAX_SPAN as i64) as usize)
+}
+
+/// The depth of the table a row belongs to, given the row's ancestors: the table itself, or the
+/// table around its THead, TBody or TFoot. `None` for any other row.
+fn row_owner(path: &[Frame]) -> Option<usize> {
+    let (parent, rest) = path.split_last()?;
+    match parent.kind {
+        Kind::Table => Some(rest.len()),
+        Kind::Section => rest.last().filter(|grand| grand.kind == Kind::Table).map(|_| rest.len() - 1),
+        _ => None,
+    }
+}
+
+/// A finding about element `e`: which element it is, and in `{what}` what is wrong with it.
+///
+/// `what` is a wording, not a finished sentence, and `extra` fills any holes it has of its own.
+/// With and without a page are separate wordings so each reads the way the language reads it;
+/// `{ty}` is the structure tag's own name and goes in as it stands.
+fn worded(e: &Frame, what: &'static str, extra: Vec<(&'static str, String)>) -> Finding {
+    let mut values = extra;
+    values.push(("{ty}", String::from_utf8_lossy(&e.ty).into_owned()));
+    match e.page {
+        Some(p) => {
+            values.push(("{p}", p.saturating_add(1).to_string()));
+            Finding::nested(e.page, "{ty} element on page {p}: {what}", what, values)
+        }
+        None => Finding::nested(None, "{ty} element: {what}", what, values),
+    }
+}
+
+/// A finding whose `{what}` wording has no holes of its own.
+fn finding(e: &Frame, what: &'static str) -> Finding {
+    worded(e, what, Vec::new())
+}
+
+/// Columns `start..end` that a row span covers, with the rows still to come after this one.
+#[derive(Clone, Copy, Debug)]
+struct Run {
+    start: usize,
+    end: usize,
+    rows: usize,
+}
+
+/// The end of the run that covers `col`, if one does. `cursor` is the first run that can still
+/// cover a column from `col` on, so callers must ask for columns in non-decreasing order.
+fn covered_end(carry: &[Run], cursor: &mut usize, col: usize) -> Option<usize> {
+    while carry.get(*cursor).is_some_and(|r| r.end <= col) {
+        *cursor += 1;
+    }
+    carry.get(*cursor).filter(|r| r.start <= col).map(|r| r.end)
+}
+
+/// The runs that reach into the next row: `carry` one row shorter, merged with this row's `row`
+/// runs. A column takes the longer of the two. Both inputs are sorted and disjoint.
+fn carry_into_next_row(carry: &[Run], row: &[Run]) -> Vec<Run> {
+    let mut points: Vec<usize> = carry.iter().chain(row).flat_map(|r| [r.start, r.end]).collect();
+    points.sort_unstable();
+    points.dedup();
+    let mut out: Vec<Run> = Vec::new();
+    let (mut a, mut b) = (0, 0);
+    for pair in points.windows(2) {
+        let &[from, to] = pair else { continue };
+        while carry.get(a).is_some_and(|r| r.end <= from) {
+            a += 1;
+        }
+        while row.get(b).is_some_and(|r| r.end <= from) {
+            b += 1;
+        }
+        let before = carry.get(a).filter(|r| r.start <= from).map_or(0, |r| r.rows.saturating_sub(1));
+        let here = row.get(b).filter(|r| r.start <= from).map_or(0, |r| r.rows);
+        let rows = before.max(here);
+        if rows == 0 {
+            continue;
+        }
+        match out.last_mut() {
+            Some(last) if last.end == from && last.rows == rows => last.end = to,
+            _ => out.push(Run { start: from, end: to, rows }),
+        }
+    }
+    out
+}
+
+/// A table that is open: the widths of its rows, and the spans that reach into later rows.
+struct Table {
+    /// Its position among the open elements: the number of elements around it.
+    depth: usize,
+    /// A header cell (TH) is in one of its rows.
+    has_th: bool,
+    /// The narrowest and the widest row so far, in columns.
+    range: Option<(usize, usize)>,
+    /// Columns that spans from earlier rows still cover. Sorted and disjoint.
+    carry: Vec<Run>,
+    /// The current row: the column its next cell may start in, the cursor into `carry`, and the
+    /// spans its cells start (these carry into the next row).
+    col: usize,
+    cursor: usize,
+    starts: Vec<Run>,
+}
+
+impl Table {
+    fn new(depth: usize) -> Table {
+        Table { depth, has_th: false, range: None, carry: Vec::new(), col: 0, cursor: 0, starts: Vec::new() }
     }
 
-    /// Read the kids `k` of `parent` (or of the root), appending element indexes to `out`.
-    fn kids(&mut self, t: &mut Tree, k: &Object, parent: Option<usize>, page: Option<usize>, out: &mut Vec<usize>, depth: usize) {
-        if depth > 256 || t.elems.len() >= MAX_ELEMENTS {
-            return;
+    fn start_row(&mut self) {
+        self.col = 0;
+        self.cursor = 0;
+        self.starts.clear();
+    }
+
+    /// Places a cell in the current row, at the first column that no earlier row covers.
+    fn place(&mut self, col_span: usize, row_span: usize) {
+        let mut start = self.col;
+        while let Some(end) = covered_end(&self.carry, &mut self.cursor, start) {
+            start = end;
         }
-        match k {
-            Object::Array(a) => {
-                for x in a {
-                    self.kids(t, x, parent, page, out, depth + 1);
+        let end = start.saturating_add(col_span);
+        if row_span > 1 {
+            self.starts.push(Run { start, end, rows: row_span.saturating_sub(1) });
+        }
+        self.col = end;
+    }
+
+    /// Ends the current row. Its width is where its cells end, plus any span from earlier rows
+    /// that runs on past them.
+    fn end_row(&mut self) {
+        let mut width = self.col;
+        while let Some(end) = covered_end(&self.carry, &mut self.cursor, width) {
+            width = end;
+        }
+        self.range = Some(match self.range {
+            None => (width, width),
+            Some((narrow, wide)) => (narrow.min(width), wide.max(width)),
+        });
+        self.carry = carry_into_next_row(&self.carry, &self.starts);
+        self.starts.clear();
+    }
+}
+
+/// One rule's findings during the walk: how many there are, and the first `MAX_FINDINGS` of them
+/// in document order. The text of the others is never built.
+#[derive(Default)]
+struct Found {
+    total: usize,
+    kept: BinaryHeap<Kept>,
+}
+
+/// A finding that is kept. The heap orders them by document position, so its top is the last one
+/// to keep.
+struct Kept {
+    index: usize,
+    finding: Finding,
+}
+
+impl PartialEq for Kept {
+    fn eq(&self, other: &Self) -> bool {
+        self.index == other.index
+    }
+}
+
+impl Eq for Kept {}
+
+impl PartialOrd for Kept {
+    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for Kept {
+    fn cmp(&self, other: &Self) -> Ordering {
+        self.index.cmp(&other.index)
+    }
+}
+
+impl Found {
+    /// Counts a finding at document position `index`. Its text is built only if it is kept.
+    fn add(&mut self, index: usize, make: impl FnOnce() -> Finding) {
+        self.total = self.total.saturating_add(1);
+        let keep = self.kept.len() < MAX_FINDINGS || self.kept.peek().is_some_and(|last| index < last.index);
+        if keep {
+            if self.kept.len() >= MAX_FINDINGS {
+                self.kept.pop();
+            }
+            self.kept.push(Kept { index, finding: make() });
+        }
+    }
+
+    fn into_result(self) -> (Vec<Finding>, usize) {
+        let findings = self.kept.into_sorted_vec().into_iter().map(|k| k.finding).collect();
+        (findings, self.total)
+    }
+}
+
+/// The structure rules during a walk.
+struct Checks {
+    found: BTreeMap<Rule, Found>,
+    /// The level of the last heading read (0 before the first).
+    heading: u8,
+    /// The open tables, outermost first.
+    tables: Vec<Table>,
+}
+
+impl Checks {
+    fn add(&mut self, rule: Rule, index: usize, make: impl FnOnce() -> Finding) {
+        if let Some(found) = self.found.get_mut(&rule) {
+            found.add(index, make);
+        }
+    }
+
+    /// The open table at `depth`, if it is the innermost open table.
+    fn table_at(&mut self, depth: usize) -> Option<&mut Table> {
+        self.tables.last_mut().filter(|t| t.depth == depth)
+    }
+}
+
+impl Visitor for Checks {
+    fn enter(&mut self, ancestors: &[Frame], e: &Frame) {
+        let parent = ancestors.last().map(|p| p.kind);
+        if e.alt && e.alt_above {
+            self.add(Rule::NestedAltText, e.index, || finding(e, "its alternate text is inside another element's and will never be read"));
+        }
+        match e.kind {
+            Kind::Figure if !e.alt && !e.alt_above => {
+                self.add(Rule::FiguresAltText, e.index, || finding(e, "no alternate text"));
+            }
+            Kind::Formula if !e.alt && !e.alt_above => {
+                self.add(Rule::OtherElementsAltText, e.index, || finding(e, "no alternate text"));
+            }
+            Kind::Table => {
+                self.tables.push(Table::new(ancestors.len()));
+                if !e.summary {
+                    self.add(Rule::TableSummary, e.index, || finding(e, "no summary"));
                 }
             }
-            Object::Int(_) => {
-                if let Some(p) = parent {
-                    t.elems[p].content = true;
+            Kind::Tr => {
+                if !matches!(parent, Some(Kind::Table | Kind::Section)) {
+                    self.add(Rule::TableRows, e.index, || finding(e, "not in a Table, THead, TBody or TFoot"));
+                }
+                if let Some(table) = row_owner(ancestors).and_then(|depth| self.table_at(depth)) {
+                    table.start_row();
                 }
             }
-            Object::Ref(r) => {
-                if !self.seen.insert(*r) {
-                    return;
+            Kind::Th | Kind::Td => {
+                let in_row = parent == Some(Kind::Tr);
+                if !in_row {
+                    self.add(Rule::TableCells, e.index, || finding(e, "not in a TR"));
                 }
-                let obj = self.doc.get(*r);
-                if let Some(d) = obj.as_dict() {
-                    self.dict(t, d, parent, page, out, depth);
+                if in_row
+                    && let Some((_, row_path)) = ancestors.split_last()
+                    && let Some(table) = row_owner(row_path).and_then(|depth| self.table_at(depth))
+                {
+                    table.place(e.col_span, e.row_span);
+                    table.has_th |= e.kind == Kind::Th;
                 }
             }
-            Object::Dict(d) => self.dict(t, d, parent, page, out, depth),
+            Kind::Li if parent != Some(Kind::L) => {
+                self.add(Rule::ListItems, e.index, || finding(e, "not in an L (list)"));
+            }
+            Kind::Lbl | Kind::LBody if !matches!(parent, Some(Kind::Li | Kind::NoteOrToc)) => {
+                self.add(Rule::LblLBody, e.index, || finding(e, "not in an LI (list item)"));
+            }
+            Kind::Heading(level) => {
+                let prev = self.heading;
+                if level > prev + 1 {
+                    self.add(Rule::HeadingNesting, e.index, || {
+                        // A whole sentence each way: what is wrong with the first heading and what is
+                        // wrong with a later one are not the same remark with a word swapped.
+                        let mut values = vec![("{n}", level.to_string())];
+                        let what = if prev == 0 {
+                            "the first heading is an H{n}; headings should not skip levels"
+                        } else {
+                            values.push(("{d}", prev.to_string()));
+                            "H{n} follows an H{d}; headings should not skip levels"
+                        };
+                        worded(e, what, values)
+                    });
+                }
+                self.heading = level;
+            }
             _ => {}
         }
     }
 
-    fn dict(&mut self, t: &mut Tree, d: &Dict, parent: Option<usize>, page: Option<usize>, out: &mut Vec<usize>, depth: usize) {
-        match d.name(b"Type") {
-            Some(b"MCR") => {
-                if let Some(p) = parent {
-                    t.elems[p].content = true;
-                }
-                return;
-            }
-            Some(b"OBJR") => {
-                if let Some(p) = parent {
-                    t.elems[p].content = true;
-                    if let Some(o) = d.get(b"Obj").and_then(Object::as_ref)
-                        && self.doc.get(o).as_dict().is_some_and(|a| a.contains(b"Subtype") && a.contains(b"Rect"))
-                    {
-                        t.elems[p].annots.push(o);
+    fn exit(&mut self, ancestors: &[Frame], e: &Frame) {
+        match e.kind {
+            Kind::Table => {
+                let is_ours = self.tables.last().is_some_and(|t| t.depth == ancestors.len());
+                let table = if is_ours { self.tables.pop() } else { None };
+                if let Some(table) = table {
+                    if !table.has_th {
+                        self.add(Rule::TableHeaders, e.index, || finding(e, "no header cells (TH)"));
+                    }
+                    if let Some((narrow, wide)) = table.range.filter(|(lo, hi)| lo != hi) {
+                        self.add(Rule::TableRegularity, e.index, || {
+                            worded(e, IRREGULAR, vec![("{min}", narrow.to_string()), ("{max}", wide.to_string())])
+                        });
                     }
                 }
-                return;
+            }
+            Kind::Tr => {
+                if let Some(table) = row_owner(ancestors).and_then(|depth| self.table_at(depth)) {
+                    table.end_row();
+                }
             }
             _ => {}
         }
-        let Some(s) = d.name(b"S") else { return };
-        let page = self.page_of(d).or(page);
-        let text =
-            |k: &[u8]| d.get(k).map(|o| self.doc.resolve(o)).and_then(|o| o.as_string().map(|s| !s.to_text().trim().is_empty())).unwrap_or(false);
-        let mut attrs = Vec::new();
-        if let Some(a) = d.get(b"A").map(|o| self.doc.resolve(o)) {
-            let list = match &*a {
-                Object::Array(v) => v.clone(),
-                other => vec![other.clone()],
-            };
-            for x in list {
-                if let Some(ad) = self.doc.resolve(&x).as_dict() {
-                    attrs.push(ad.clone());
-                }
+        if e.alt {
+            if !e.subtree_content() {
+                self.add(Rule::AltTextAssociated, e.index, || finding(e, "alternate text on an element with no page content"));
+            }
+            if e.subtree_annot() {
+                self.add(Rule::AltTextHidesAnnotation, e.index, || finding(e, "alternate text hides an annotation inside it"));
             }
-        }
-        let i = t.elems.len();
-        t.elems.push(Elem { ty: self.standard(s), parent, alt: text(b"Alt") || text(b"ActualText"), page, attrs, ..Elem::default() });
-        if let Some(p) = parent {
-            t.elems[p].children.push(i);
-        }
-        out.push(i);
-        if let Some(k) = d.get(b"K") {
-            let mut ignored = Vec::new();
-            self.kids(t, k, Some(i), page, &mut ignored, depth + 1);
+        }
+    }
+}
+
+/// Evaluates the structure rules in `selected` in one walk of the tree. Each rule's result is its
+/// first `MAX_FINDINGS` findings in document order, and the total number of findings.
+pub(crate) fn run(doc: &Document, pages: &[Page], selected: &BTreeSet<Rule>) -> BTreeMap<Rule, (Vec<Finding>, usize)> {
+    let found: BTreeMap<Rule, Found> = RULES.into_iter().filter(|r| selected.contains(r)).map(|r| (r, Found::default())).collect();
+    if found.is_empty() {
+        return BTreeMap::new();
+    }
+    let mut checks = Checks { found, heading: 0, tables: Vec::new() };
+    walk(doc, pages, &mut checks);
+    checks.found.into_iter().map(|(rule, found)| (rule, found.into_result())).collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The column-by-column computation that the check used before it streamed: each row's width,
+    /// as the (narrowest, widest) range over the rows. Rows are lists of (ColSpan, RowSpan).
+    fn dense_range(rows: &[Vec<(usize, usize)>]) -> Option<(usize, usize)> {
+        let mut carry: Vec<usize> = Vec::new();
+        let mut widths = Vec::new();
+        for row in rows {
+            let mut col = 0;
+            let mut next: Vec<usize> = carry.iter().map(|n| n.saturating_sub(1)).collect();
+            for &(cs, rs) in row {
+                while col < carry.len() && carry[col] > 0 {
+                    col += 1;
+                }
+                if next.len() < col + cs {
+                    next.resize(col + cs, 0);
+                }
+                for n in next.iter_mut().skip(col).take(cs) {
+                    *n = (*n).max(rs - 1);
+                }
+                col += cs;
+            }
+            while col < carry.len() && carry[col] > 0 {
+                col += 1;
+            }
+            widths.push(col);
+            carry = next;
+        }
+        Some((*widths.iter().min()?, *widths.iter().max()?))
+    }
+
+    /// A small deterministic generator, so the random tables are the same on every run.
+    struct Lcg(u64);
+
+    impl Lcg {
+        fn below(&mut self, n: usize) -> usize {
+            self.0 = self.0.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1_442_695_040_888_963_407);
+            ((self.0 >> 33) as usize) % n
+        }
+    }
+
+    #[test]
+    fn spans_carry_into_later_rows_like_the_dense_computation() {
+        let mut rng = Lcg(7);
+        for _ in 0..4_000 {
+            let mut rows = Vec::new();
+            for _ in 0..1 + rng.below(6) {
+                let mut row = Vec::new();
+                for _ in 0..rng.below(6) {
+                    row.push((1 + rng.below(12), 1 + rng.below(5)));
+                }
+                rows.push(row);
+            }
+            let mut table = Table::new(0);
+            for row in &rows {
+                table.start_row();
+                for &(cs, rs) in row {
+                    table.place(cs, rs);
+                }
+                table.end_row();
+            }
+            assert_eq!(table.range, dense_range(&rows), "{rows:?}");
         }
     }
 }
diff --git a/crates/a11y/src/tests.rs b/crates/a11y/src/tests.rs
index 990ad453..9aa3f57c 100644
--- a/crates/a11y/src/tests.rs
+++ b/crates/a11y/src/tests.rs
@@ -157,6 +157,135 @@ fn row_and_column_spans_keep_a_table_regular() {
     assert_eq!(status(&r, Rule::TableRegularity), Status::Passed, "{:?}", r.result(Rule::TableRegularity));
 }
 
+/// A tagged document whose structure tree is the Document element `document` (object 3).
+fn structure_doc(objects: &[String]) -> Document {
+    let mut objs = vec!["<< /Type /Catalog /StructTreeRoot 2 0 R >>".to_string(), "<< /Type /StructTreeRoot /K 3 0 R >>".to_string()];
+    objs.extend_from_slice(objects);
+    pdf(&objs, "")
+}
+
+fn checked(doc: &Document, rules: &[Rule]) -> Report {
+    check(doc, &Options { rules: rules.iter().copied().collect(), pages: None })
+}
+
+#[test]
+fn figures_and_tables_past_the_old_element_cut_off_are_checked() {
+    // Five thousand paragraphs, then a figure without alternate text and a table whose second row
+    // is narrower than its first.
+    let mut kids = vec!["<< /S /P >>".to_string(); 5_000];
+    kids.push("<< /S /Figure >>".into());
+    kids.push(
+        "<< /S /Table /A << /O /Table /Summary (s) >> /K [ << /S /TR /K [ << /S /TD >> << /S /TD >> ] >> << /S /TR /K [ << /S /TD >> ] >> ] >>"
+            .into(),
+    );
+    let doc = structure_doc(&[format!("<< /S /Document /K [{}] >>", kids.join(" "))]);
+    let r = checked(&doc, &[Rule::FiguresAltText, Rule::TableRegularity]);
+    assert_eq!(r.result(Rule::FiguresAltText).unwrap().findings.len(), 1);
+    assert!(r.result(Rule::TableRegularity).unwrap().findings[0].message.contains("between 1 and 2"));
+}
+
+#[test]
+fn findings_are_listed_in_document_order_not_in_the_order_they_close() {
+    // Each element has alternate text but no content. The outer ones close last.
+    let doc = structure_doc(&["<< /S /Document /K [ << /S /Sect /Alt (a) /K [ << /S /P /Alt (b) /K [ << /S /Div /Alt (c) >> ] >> ] >> ] >>".into()]);
+    let r = checked(&doc, &[Rule::AltTextAssociated]);
+    let kinds: Vec<&str> = r.result(Rule::AltTextAssociated).unwrap().findings.iter().map(|f| f.message.split(' ').next().unwrap_or("")).collect();
+    assert_eq!(kinds, ["Sect", "P", "Div"]);
+}
+
+#[test]
+fn a_rule_lists_its_first_findings_and_counts_the_rest() {
+    let figures = vec!["<< /S /Figure >>".to_string(); 300].join(" ");
+    let doc = structure_doc(&[format!("<< /S /Document /K [{figures}] >>")]);
+    let r = checked(&doc, &[Rule::FiguresAltText]);
+    let found = &r.result(Rule::FiguresAltText).unwrap().findings;
+    assert_eq!(found.len(), 201);
+    assert_eq!(found[200].message, "… and 100 more");
+    assert!(found[..200].iter().all(|f| f.message == "Figure element: no alternate text"));
+}
+
+#[test]
+fn cycles_shared_kids_and_missing_kids_are_read_once() {
+    // Object 4 holds itself, a figure twice, and a missing object is listed too.
+    let doc = structure_doc(&[
+        "<< /S /Document /K [4 0 R 4 0 R 99 0 R] >>".into(),
+        "<< /S /Sect /K [4 0 R 5 0 R 5 0 R] >>".into(),
+        "<< /S /Figure >>".into(),
+    ]);
+    let r = checked(&doc, &[Rule::FiguresAltText]);
+    assert_eq!(r.result(Rule::FiguresAltText).unwrap().findings.len(), 1);
+}
+
+#[test]
+fn nesting_is_read_to_the_depth_limit_and_no_further() {
+    // Sections, each the kid of the one before, ending in a figure without alternate text. The
+    // figure is at depth `sections`; the walk reads depths up to 256.
+    let figure_within = |sections: usize| {
+        let mut objs: Vec<String> = (0..sections).map(|i| format!("<< /S /Sect /K {} 0 R >>", 4 + i)).collect();
+        objs.push("<< /S /Figure >>".into());
+        let r = checked(&structure_doc(&objs), &[Rule::FiguresAltText]);
+        r.result(Rule::FiguresAltText).unwrap().findings.len()
+    };
+    assert_eq!(figure_within(250), 1, "within the depth limit");
+    assert_eq!(figure_within(300), 0, "past the depth limit");
+}
+
+#[test]
+fn arrays_nested_deeper_than_the_limit_are_not_read() {
+    let nested = |n: usize| format!("<< /S /Document /K {}<< /S /Figure >>{} >>", "[".repeat(n), "]".repeat(n));
+    let shallow = checked(&structure_doc(&[nested(100)]), &[Rule::FiguresAltText]);
+    assert_eq!(shallow.result(Rule::FiguresAltText).unwrap().findings.len(), 1);
+    let deep = checked(&structure_doc(&[nested(300)]), &[Rule::FiguresAltText]);
+    assert_eq!(deep.result(Rule::FiguresAltText).unwrap().findings.len(), 0);
+}
+
+#[test]
+fn a_long_list_of_marked_content_counts_as_content() {
+    // The first paragraph holds 20,000 marked-content items, so its alternate text has content.
+    let items = (0..20_000).map(|i| i.to_string()).collect::<Vec<_>>().join(" ");
+    let doc = structure_doc(&[format!("<< /S /Document /K [ << /S /P /Alt (a) /K [{items}] >> << /S /P /Alt (b) >> ] >>")]);
+    let r = checked(&doc, &[Rule::AltTextAssociated]);
+    assert_eq!(r.result(Rule::AltTextAssociated).unwrap().findings.len(), 1);
+}
+
+#[test]
+fn huge_spans_do_not_size_the_table() {
+    // A row of 2,000 cells, each spanning 10,000 columns, then a row of one cell.
+    let wide = vec!["<< /S /TD /A << /O /Table /ColSpan 10000 >> >>".to_string(); 2_000].join(" ");
+    let doc = structure_doc(&[format!(
+        "<< /S /Document /K [ << /S /Table /A << /O /Table /Summary (s) >> /K [ << /S /TR /K [{wide}] >> << /S /TR /K [ << /S /TD >> ] >> ] >> ] >>"
+    )]);
+    let r = checked(&doc, &[Rule::TableRegularity]);
+    let found = &r.result(Rule::TableRegularity).unwrap().findings;
+    assert_eq!(found[0].message, "Table element: rows have between 1 and 20000000 columns");
+}
+
+#[test]
+fn row_spans_carry_past_their_row() {
+    // Row 1: 3,000 cells, each spanning 10,000 rows. Row 2: 3,000 cells, which start after them.
+    let row1 = vec!["<< /S /TD /A << /O /Table /RowSpan 10000 >> >>".to_string(); 3_000].join(" ");
+    let row2 = vec!["<< /S /TD >>".to_string(); 3_000].join(" ");
+    let doc = structure_doc(&[format!(
+        "<< /S /Document /K [ << /S /Table /A << /O /Table /Summary (s) >> /K [ << /S /TR /K [{row1}] >> << /S /TR /K [{row2}] >> ] >> ] >>"
+    )]);
+    let r = checked(&doc, &[Rule::TableRegularity]);
+    let found = &r.result(Rule::TableRegularity).unwrap().findings;
+    assert_eq!(found[0].message, "Table element: rows have between 3000 and 6000 columns");
+}
+
+#[test]
+fn spans_that_are_not_positive_integers_read_as_one() {
+    // ColSpan -3 and 0 read as 1, and 2.0 reads as 2; the first row is 4 columns wide, the second 5.
+    let doc = structure_doc(&[
+        "<< /S /Document /K [ << /S /Table /A << /O /Table /Summary (s) >> /K [ \
+         << /S /TR /K [ << /S /TD /A << /O /Table /ColSpan -3 >> >> << /S /TD /A << /O /Table /ColSpan 0 >> >> << /S /TD /A << /O /Table /ColSpan 2.0 >> >> ] >> \
+         << /S /TR /K [ << /S /TD >> << /S /TD >> << /S /TD >> << /S /TD >> << /S /TD >> ] >> ] >> ] >>"
+            .into(),
+    ]);
+    let r = checked(&doc, &[Rule::TableRegularity]);
+    assert_eq!(r.result(Rule::TableRegularity).unwrap().findings[0].message, "Table element: rows have between 4 and 5 columns");
+}
+
 #[test]
 fn page_content_and_annotation_problems_are_found() {
     let mut objs = good();
@@ -218,9 +347,15 @@ fn rules_have_ids_and_the_report_lists_them() {
     let per: Vec<usize> = Category::ALL.iter().map(|c| Rule::ALL.iter().filter(|r| r.category() == *c).count()).collect();
     assert_eq!(per, [8, 9, 2, 5, 5, 2, 1]);
     let doc = pdf(&good(), "/Info 8 0 R");
-    let html = report_html(&check(&doc, &Options::default()), "a<b>.pdf", "2026-10-02");
+    let report = check(&doc, &Options::default());
+    let html = report_html(&report, "a<b>.pdf", "2026-10-02", "en", &in_english);
     assert!(html.contains("a&lt;b&gt;.pdf") && html.contains("Accessibility permission flag") && html.contains("Needs manual check: 5"));
     assert!(html.contains("<h3>Headings</h3>"));
+    // In another language every word of ours is said in it, down to the `lang`; the file name is the
+    // file's own and stays as it is.
+    let other = report_html(&report, "a<b>.pdf", "2026-10-02", "es", &|w| format!("«{w}»"));
+    assert!(other.contains("<html lang=\"es\">") && other.contains("<h3>«Headings»</h3>") && other.contains("a&lt;b&gt;.pdf"));
+    assert!(!other.contains(">Headings<"), "an English heading is left in the report: {other}");
 }
 
 fn figures_doc() -> Document {
@@ -335,3 +470,93 @@ fn an_untagged_document_has_no_headings() {
     objs[0] = "<< /Type /Catalog /Pages 2 0 R >>".into();
     assert!(headings(&pdf(&objs, "")).is_empty());
 }
+
+/// The text of every `"…"` literal with a space in it, outside comments and byte strings.
+fn sentences(source: &str) -> Vec<String> {
+    let b = source.as_bytes();
+    let (mut out, mut i) = (Vec::new(), 0);
+    while i < b.len() {
+        if b[i] == b'/' && b.get(i + 1) == Some(&b'/') {
+            while i < b.len() && b[i] != b'\n' {
+                i += 1;
+            }
+        } else if b[i] == b'"' {
+            let byte_string = i > 0 && b[i - 1] == b'b';
+            let start = i + 1;
+            i = start;
+            while i < b.len() && b[i] != b'"' {
+                i += if b[i] == b'\\' { 2 } else { 1 };
+            }
+            // Quotes and backslashes are ASCII, so this never cuts a character in two.
+            let text = source.get(start..i.min(b.len())).unwrap_or_default();
+            if !byte_string && text.contains(' ') {
+                out.push(text.replace("\\\"", "\""));
+            }
+            i += 1;
+        } else {
+            i += 1;
+        }
+    }
+    out
+}
+
+/// Every sentence the rules can say is listed in `WORDINGS`, so an interface showing the report in
+/// another language has something to translate. The two rule files hold no prose of their own, so a
+/// literal with a space in it is a sentence a person reads.
+#[test]
+fn wordings_are_complete() {
+    let mut missing = Vec::new();
+    for source in [include_str!("content.rs"), include_str!("structure.rs")] {
+        for sentence in sentences(source) {
+            if !WORDINGS.contains(&sentence.as_str()) {
+                missing.push(sentence);
+            }
+        }
+    }
+    assert!(missing.is_empty(), "add these to WORDINGS, and a translation of each to every interface: {missing:#?}");
+}
+
+/// Every word the report page says of its own is listed in `REPORT_WORDS`, and every word on that
+/// list is one the page says: the page hands each over to `words` as a literal, so the two can be
+/// read off one another.
+#[test]
+fn report_words_are_complete() {
+    let source = include_str!("report.rs");
+    let mut said = Vec::new();
+    let mut rest = source;
+    while let Some(at) = rest.find("words(\"") {
+        rest = &rest[at + 7..];
+        let Some(end) = rest.find('"') else { break };
+        said.push(&rest[..end]);
+        rest = &rest[end..];
+    }
+    let missing: Vec<&&str> = said.iter().filter(|word| !REPORT_WORDS.contains(word)).collect();
+    assert!(missing.is_empty(), "add these to REPORT_WORDS, and a translation of each to every interface: {missing:#?}");
+    let unsaid: Vec<&&str> = REPORT_WORDS.iter().filter(|word| !said.contains(word)).collect();
+    assert!(unsaid.is_empty(), "REPORT_WORDS lists words the page no longer says: {unsaid:#?}");
+}
+
+/// `say` puts the values in, and what it puts in is never read as a hole of its own: a document that
+/// names a font `{p}` cannot make a finding say which page it is on.
+#[test]
+fn say_fills_holes_once() {
+    let values = [("{p}", "7".to_string()), ("{}", "{p} {n}".to_string())];
+    assert_eq!(
+        say("Font {} on page {p} doesn't map its characters to Unicode", &values),
+        "Font {p} {n} on page 7 doesn't map its characters to Unicode"
+    );
+    // A hole with nothing for it, and a brace with nothing closing it, are left as they stand.
+    assert_eq!(say("{a} {p} {", &values), "{a} 7 {");
+}
+
+/// A finding whose frame holds another wording says the whole thing in English, holes and all
+/// filled, and still hands the interface the two wordings to translate.
+#[test]
+fn a_nested_finding_says_itself() {
+    let values = vec![("{min}", "1".to_string()), ("{max}", "2".to_string()), ("{ty}", "Table".to_string()), ("{p}", "3".to_string())];
+    let f = Finding::nested(Some(2), "{ty} element on page {p}: {what}", "rows have between {min} and {max} columns", values);
+    assert_eq!(f.message, "Table element on page 3: rows have between 1 and 2 columns");
+    assert_eq!(f.said(&in_english), f.message, "saying it in English is the message");
+    // Both wordings are translated, each on its own, and the document's words are left alone.
+    assert_eq!(f.said(&|w: &str| format!("«{w}»")), "«Table element on page 3: «rows have between 1 and 2 columns»»");
+}
diff --git a/crates/annot/src/appearance.rs b/crates/annot/src/appearance.rs
index 6a82fbc1..fbd77b3e 100644
--- a/crates/annot/src/appearance.rs
+++ b/crates/annot/src/appearance.rs
@@ -104,7 +104,7 @@ fn line_end(c: &mut String, kind: &[u8], tip: (f64, f64), from: (f64, f64), w: f
 /// point parallel to the chord between its neighbours (an end uses itself as the missing
 /// neighbour). Ink is drawn so, as Acrobat draws it, rather than as straight segments. The curve
 /// stays within its points and these control points.
-pub(crate) fn smooth_segments(pts: &[(f64, f64)]) -> Vec<[(f64, f64); 3]> {
+pub fn smooth_segments(pts: &[(f64, f64)]) -> Vec<[(f64, f64); 3]> {
     let Some(&last) = pts.last() else { return Vec::new() };
     let at = |i: usize| pts.get(i).copied().unwrap_or(last);
     (0..pts.len().saturating_sub(1))
diff --git a/crates/annot/src/lib.rs b/crates/annot/src/lib.rs
index dce287ad..b59f7271 100644
--- a/crates/annot/src/lib.rs
+++ b/crates/annot/src/lib.rs
@@ -1931,7 +1931,9 @@ pub fn summaries(doc: &Document) -> Vec<Summary> {
                 index,
                 subtype,
                 author: text_value(doc, d, b"T"),
-                contents: text_value(doc, d, b"Contents"),
+                // Acrobat ends lines with CR, which the interface would draw as nothing (keep in
+                // step with `pdfcraft_render::inspect`).
+                contents: text_value(doc, d, b"Contents").map(|s| s.replace("\r\n", "\n").replace('\r', "\n")),
                 modified: text_value(doc, d, b"M"),
                 name: text_value(doc, d, b"NM"),
                 in_reply_to,
diff --git a/crates/annot/src/links.rs b/crates/annot/src/links.rs
index f5ba6fb1..2e45b4e4 100644
--- a/crates/annot/src/links.rs
+++ b/crates/annot/src/links.rs
@@ -202,13 +202,24 @@ fn write_action(doc: &Document, d: &mut Dict, a: &LinkAction) -> Result<(), Anno
     Ok(())
 }
 
+/// Check link geometry before writing PDF objects: a user or automation call can supply
+/// non-finite coordinates or a finite pair whose difference overflows to infinity.
+fn checked_rect(rect: [f64; 4]) -> Result<[f64; 4], AnnotError> {
+    if !rect.iter().all(|v| v.is_finite()) {
+        return Err(AnnotError::Invalid("the link area must have finite coordinates".into()));
+    }
+    let r = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
+    let (width, height) = (r[2] - r[0], r[3] - r[1]);
+    if !width.is_finite() || !height.is_finite() || width < 2.0 || height < 2.0 {
+        return Err(AnnotError::Invalid("the link area is too small or too large".into()));
+    }
+    Ok(r)
+}
+
 /// Add a link over `rect` (user space). Returns its index in the page's `/Annots`.
 pub fn add(doc: &mut Document, page: usize, rect: [f64; 4], action: &LinkAction, style: &LinkStyle) -> Result<usize, AnnotError> {
     let p = page_ref(doc, page)?;
-    let r = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
-    if !r.iter().all(|v| v.is_finite()) || r[2] - r[0] < 2.0 || r[3] - r[1] < 2.0 {
-        return Err(AnnotError::Invalid("the link area is too small".into()));
-    }
+    let r = checked_rect(rect)?;
     if matches!(action, LinkAction::Other(_)) {
         return Err(AnnotError::Invalid("choose a page or a web address".into()));
     }
@@ -250,10 +261,7 @@ pub fn set(
     let (_, r) = link_at(doc, page, index)?;
     let mut d = doc.get(r).as_dict().cloned().unwrap_or_default();
     if let Some(rect) = rect {
-        let rr = [rect[0].min(rect[2]), rect[1].min(rect[3]), rect[0].max(rect[2]), rect[1].max(rect[3])];
-        if rr[2] - rr[0] < 2.0 || rr[3] - rr[1] < 2.0 {
-            return Err(AnnotError::Invalid("the link area is too small".into()));
-        }
+        let rr = checked_rect(rect)?;
         d.set(b"Rect".to_vec(), Object::Array(rr.iter().map(|v| Object::Real(*v)).collect()));
     }
     if let Some(s) = style {
@@ -296,6 +304,59 @@ pub fn remove_all(doc: &mut Document, pages: Option<&[usize]>) -> Result<usize,
     Ok(n)
 }
 
+/// Recognise common ASCII mailbox addresses without mistaking domains, partial words or
+/// invalid labels for e-mail links. The returned end is in source-character indices.
+fn email_at(chars: &[char], start: usize) -> Option<(usize, String)> {
+    let local_char = |c: char| c.is_ascii_alphanumeric() || "._+%-".contains(c);
+    let domain_char = |c: char| c.is_ascii_alphanumeric() || c == '-' || c == '.';
+    // Don't create a link starting in the middle of an address.
+    if start > 0 && chars.get(start - 1).is_some_and(|c| local_char(*c) || *c == '@') {
+        return None;
+    }
+    let mut at = start;
+    while chars.get(at).is_some_and(|c| local_char(*c)) {
+        at += 1;
+        if at - start > 64 {
+            return None;
+        }
+    }
+    let local = chars.get(start..at)?;
+    if local.is_empty() || local.first() == Some(&'.') || local.last() == Some(&'.') || local.windows(2).any(|w| w == ['.', '.']) {
+        return None;
+    }
+    if chars.get(at) != Some(&'@') {
+        return None;
+    }
+    let mut end = at + 1;
+    while chars.get(end).is_some_and(|c| domain_char(*c)) {
+        end += 1;
+        if end - at - 1 > 253 {
+            return None;
+        }
+    }
+    while end > at + 1 && chars.get(end - 1) == Some(&'.') {
+        end -= 1;
+    }
+    if chars.get(end).is_some_and(|c| c.is_ascii_alphanumeric() || *c == '@' || *c == '_') {
+        return None;
+    }
+    let domain = chars.get(at + 1..end)?;
+    let mut labels = 0;
+    let mut tld_length = 0;
+    for label in domain.split(|c| *c == '.') {
+        if label.is_empty() || label.len() > 63 || !label.first()?.is_ascii_alphanumeric() || !label.last()?.is_ascii_alphanumeric() {
+            return None;
+        }
+        labels += 1;
+        tld_length = label.len();
+    }
+    if labels < 2 || tld_length < 2 {
+        return None;
+    }
+    let address: String = chars.get(start..end)?.iter().collect();
+    Some((end, format!("mailto:{address}")))
+}
+
 /// Find web addresses in text: `http(s)://…`, `www.…` and bare e-mail addresses become
 /// `mailto:`. Returns character ranges and the URI for each.
 pub fn find_urls(chars: &[char]) -> Vec<(std::ops::Range<usize>, String)> {
@@ -327,6 +388,11 @@ pub fn find_urls(chars: &[char]) -> Vec<(std::ops::Range<usize>, String)> {
                 continue;
             }
         }
+        if boundary && let Some((end, uri)) = email_at(chars, i) {
+            out.push((i..end, uri));
+            i = end;
+            continue;
+        }
         i += 1;
     }
     out
diff --git a/crates/annot/src/tests.rs b/crates/annot/src/tests.rs
index 7f47b592..d0e29e06 100644
--- a/crates/annot/src/tests.rs
+++ b/crates/annot/src/tests.rs
@@ -432,6 +432,19 @@ fn real_annotation_flags_do_not_lock_comments() {
     assert!(set_info(&mut doc, 0, 0, Some("Ada"), None, None, &meta("")).is_ok());
 }
 
+#[test]
+fn carriage_returns_in_comment_text_become_line_breaks() {
+    let mut doc = fixture();
+    let page = page_refs(&doc).unwrap()[0];
+    let mut entries = annots(&doc, page);
+    let Object::Dict(annotation) = &mut entries[0] else { panic!("fixture annotation is inline") };
+    // Acrobat ends lines in /Contents with CR; the interface only breaks lines at LF.
+    annotation.set(b"Contents".to_vec(), PdfString::text("one\r\rtwo\r\nthree"));
+    set_annots(&mut doc, page, entries).unwrap();
+
+    assert_eq!(summaries(&doc)[0].contents.as_deref(), Some("one\n\ntwo\nthree"));
+}
+
 #[test]
 fn a_locked_text_box_still_refits_its_text() {
     let mut doc = fixture();
@@ -574,6 +587,31 @@ fn links_are_added_edited_listed_and_removed() {
     assert!(links::add(&mut doc, 0, [0.0, 0.0, 1.0, 1.0], &LinkAction::Page(0), &LinkStyle::default()).is_err(), "too small");
 }
 
+#[test]
+fn link_edit_rejects_non_finite_and_overflowed_rectangles_without_mutating_the_pdf() {
+    use crate::links::{self, LinkAction, LinkStyle};
+    let mut doc = fixture();
+    let original_rect = [10.0, 20.0, 110.0, 70.0];
+    let index = links::add(&mut doc, 0, original_rect, &LinkAction::Uri("https://example.org".into()), &LinkStyle::default()).unwrap();
+    let before = links::list(&doc);
+    let changed_action = LinkAction::Uri("https://other.example".into());
+    for rect in [
+        [f64::NAN, 0.0, 100.0, 30.0],
+        [0.0, 0.0, f64::INFINITY, 30.0],
+        [f64::NEG_INFINITY, 0.0, 100.0, 30.0],
+        [-1e308, 0.0, 1e308, 30.0],
+        [0.0, 0.0, 1.5, 30.0],
+    ] {
+        assert!(links::set(&mut doc, 0, index, Some(rect), Some(&changed_action), None).is_err(), "edit accepted {rect:?}");
+        assert_eq!(links::list(&doc), before, "invalid edit changed an existing link");
+        assert!(links::add(&mut doc, 0, rect, &changed_action, &LinkStyle::default()).is_err(), "add accepted {rect:?}");
+    }
+    // A reversed but otherwise valid rectangle is normalized on edit.
+    links::set(&mut doc, 0, index, Some([110.0, 70.0, 10.0, 20.0]), None, None).unwrap();
+    let edited = links::list(&doc).into_iter().find(|l| l.page == 0 && l.index == index).map(|l| l.rect);
+    assert_eq!(edited, Some(original_rect));
+}
+
 #[test]
 fn urls_are_found_in_text() {
     let t: Vec<char> = "See https://example.org/a?b=1, or www.rust-lang.org. Not a.b or http:/x.".chars().collect();
@@ -581,6 +619,30 @@ fn urls_are_found_in_text() {
     assert_eq!(found, ["https://example.org/a?b=1", "http://www.rust-lang.org"]);
 }
 
+#[test]
+fn common_email_addresses_become_mailto_links_with_source_character_ranges() {
+    let source = "İ Contact ada.lovelace+forms@example.co.uk, browse HTTPS://EXAMPLE.ORG; or ask admin@example.org.";
+    let chars: Vec<char> = source.chars().collect();
+    let links = crate::links::find_urls(&chars);
+    let found: Vec<(String, String)> = links.into_iter().map(|(range, url)| (chars.get(range).unwrap().iter().collect(), url)).collect();
+    assert_eq!(
+        found,
+        [
+            ("ada.lovelace+forms@example.co.uk".into(), "mailto:ada.lovelace+forms@example.co.uk".into()),
+            ("HTTPS://EXAMPLE.ORG".into(), "HTTPS://EXAMPLE.ORG".into()),
+            ("admin@example.org".into(), "mailto:admin@example.org".into()),
+        ]
+    );
+}
+
+#[test]
+fn malformed_email_addresses_are_not_autolinked() {
+    for invalid in ["a@b", "broken@localhost", "a..b@example.org", "foo@.example.org", "foo@example..org", "foo@example.com@x"] {
+        let input: Vec<char> = invalid.chars().collect();
+        assert!(crate::links::find_urls(&input).is_empty(), "{invalid:?} produced a link");
+    }
+}
+
 #[test]
 fn urls_are_found_after_length_changing_lowercase() {
     // U+0130 (İ) lowercases to "i" plus a combining dot above, so a case-folded copy is longer
diff --git a/crates/audit/Cargo.toml b/crates/audit/Cargo.toml
new file mode 100644
index 00000000..5c558142
--- /dev/null
+++ b/crates/audit/Cargo.toml
@@ -0,0 +1,20 @@
+[package]
+name = "pdfcraft-audit"
+description = "Verification tooling: audit documents for faux redactions (opaque covers over extractable text)"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+repository.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+pdfcraft-cos = { workspace = true }
+pdfcraft-content = { workspace = true }
+pdfcraft-edit = { workspace = true }
+pdfcraft-model = { workspace = true }
+thiserror = { workspace = true }
+
+[dev-dependencies]
diff --git a/crates/audit/README.md b/crates/audit/README.md
new file mode 100644
index 00000000..e13bb30b
--- /dev/null
+++ b/crates/audit/README.md
@@ -0,0 +1,30 @@
+# pdfcraft-audit
+
+Layer L4 (may use `edit`): verification tooling, the faux-redaction audit.
+
+```rust
+let findings: Vec<Finding> = audit_redactions(&doc)?;  // page, kind, rect, covered_text
+```
+
+It reports two kinds of finding:
+
+- **faux redaction**: an opaque filled rectangle painted *after* text it overlaps, dark enough
+  against the text's colour (WCAG contrast below 3) to hide it, while the text is still
+  extractable underneath;
+- **unapplied mark**: a Redact annotation that was marked but never applied.
+
+A properly applied redaction removes the text, so it never flags. Page backgrounds, table
+shading and highlights don't either: they're painted before the text, or light against it.
+
+Limits, by design and documented rather than hidden:
+
+- only `re` rectangles closed by a fill count as covers (not arbitrary paths, shadings or
+  patterns), and a translucent one (`/ca` below 1) is not flagged;
+- covers inside form XObjects are found, but only text drawn directly in the page content is
+  checked under them;
+- annotation rectangles are compared in unrotated user space, so `/Rotate` pages may misalign.
+
+It fails closed: an undecodable content stream, malformed `/Annots`, form XObjects nested deeper
+than 32 or in a cycle, or a walk past the operator bound is an error, never "no findings".
+
+Surfaces: the `redact_audit` automation tool and `pdfcraft-cli`.
diff --git a/crates/audit/src/cover.rs b/crates/audit/src/cover.rs
new file mode 100644
index 00000000..9da3fc7b
--- /dev/null
+++ b/crates/audit/src/cover.rs
@@ -0,0 +1,242 @@
+//! Walk page content streams and collect the opaque filled rectangles they draw.
+//!
+//! This is the geometric half of the faux-redaction audit: a rectangle filled with an opaque
+//! color (`re` + `f`) is the classic way a "redaction" is faked. Graphics state tracked here is
+//! deliberately small: the CTM stack (`q`/`Q`/`cm`), the non-stroking color (`g`/`rg`/`k`) and
+//! the non-stroking alpha from ExtGState (`gs` reading `/ca`). Form XObjects are followed
+//! read-only with a depth cap. Anything fancier (arbitrary filled paths, shadings, patterns) is
+//! out of scope and documented as such.
+//!
+//! Paint order: a page's content streams are one stream in pieces (ISO 32000-2 §7.8.2), so they
+//! are parsed joined and walked once with a single graphics state — state set in an earlier
+//! stream (a `cm`, a fill color) is still in force in the later ones. Each rectangle records the
+//! position of the fill operator that painted it, as `(content-stream index, operator index in
+//! the joined stream)`; rectangles inside a form XObject carry the `Do` operator's position.
+//! Positions compare lexicographically in paint order.
+
+use pdfcraft_content::{Matrix, Op, Pieces, parse};
+use pdfcraft_cos::{Dict, Document, Object};
+
+use crate::AuditError;
+
+/// Maximum form-XObject nesting followed. Deeper nesting (including a cycle) fails the audit: a
+/// cover drawn below the cut could otherwise go unseen and the page be reported clean.
+const MAX_DEPTH: usize = 32;
+/// Bound on total operators walked per page, so a hostile stream cannot spin forever.
+/// Hitting it fails the audit: a truncated walk must never report "clean".
+const MAX_OPS: usize = 2_000_000;
+
+/// One opaque filled rectangle, in page user space.
+#[derive(Clone, Debug, PartialEq)]
+pub struct FilledRect {
+    /// `[x0, y0, x1, y1]`, normalized so `x0 <= x1` and `y0 <= y1`.
+    pub rect: [f64; 4],
+    /// The fill color as sRGB-ish `[r, g, b]` (CMYK is converted approximately).
+    pub rgb: [f64; 3],
+    /// Paint position: `(content-stream index, operator index in the joined stream)`.
+    /// Rectangles inside a form XObject carry the `Do` operator's position.
+    pub pos: (usize, usize),
+}
+
+#[derive(Clone)]
+struct Gs {
+    ctm: Matrix,
+    fill: [f64; 3],
+    alpha: f64,
+}
+
+impl Default for Gs {
+    fn default() -> Self {
+        Gs { ctm: Matrix::IDENTITY, fill: [0.0, 0.0, 0.0], alpha: 1.0 }
+    }
+}
+
+struct Walker<'a> {
+    doc: &'a Document,
+    pieces: &'a Pieces,
+    out: Vec<FilledRect>,
+    ops_seen: usize,
+}
+
+impl<'a> Walker<'a> {
+    fn bump(&mut self) -> Result<(), AuditError> {
+        self.ops_seen += 1;
+        if self.ops_seen > MAX_OPS {
+            return Err(AuditError::TooManyOps);
+        }
+        Ok(())
+    }
+
+    /// Walk one operator slice with the given graphics state. `at_do` is the `Do` position to
+    /// stamp on rectangles found inside a form XObject, or `None` at page level (where each
+    /// fill operator's own position is used).
+    fn walk_ops(
+        &mut self,
+        ops: &[Op],
+        gs: &mut Gs,
+        stack: &mut Vec<Gs>,
+        resources: &Dict,
+        depth: usize,
+        at_do: Option<(usize, usize)>,
+    ) -> Result<(), AuditError> {
+        // A pending `re` rectangle, in the user space active when it was built.
+        let mut pending: Option<[f64; 4]> = None;
+        for (i, op) in ops.iter().enumerate() {
+            self.bump()?;
+            // Paint position of this operator: its own `(piece, joined index)` at page level,
+            // the enclosing `Do`'s position inside a form XObject.
+            let pos = match at_do {
+                Some(p) => p,
+                None => (self.pieces.pieces_of(op).0, i),
+            };
+            match op.op.as_slice() {
+                b"q" => stack.push(gs.clone()),
+                b"Q" => {
+                    if let Some(g) = stack.pop() {
+                        *gs = g;
+                    }
+                    pending = None;
+                }
+                b"cm" => {
+                    if let Some(m) = Matrix::from_operands(&op.operands)
+                        && m.0.iter().all(|v| v.is_finite())
+                    {
+                        gs.ctm = m.then(&gs.ctm);
+                    }
+                    pending = None;
+                }
+                b"g" => {
+                    if let Some(v) = op.num(0).filter(|v| v.is_finite()) {
+                        let v = v.clamp(0.0, 1.0);
+                        gs.fill = [v, v, v];
+                    }
+                }
+                b"rg" => {
+                    if let Some([r, g, b]) = op.nums::<3>()
+                        && [r, g, b].iter().all(|v| v.is_finite())
+                    {
+                        gs.fill = [r.clamp(0.0, 1.0), g.clamp(0.0, 1.0), b.clamp(0.0, 1.0)];
+                    }
+                }
+                b"k" => {
+                    if let Some([c, m, y, k]) = op.nums::<4>()
+                        && [c, m, y, k].iter().all(|v| v.is_finite())
+                    {
+                        // Naive CMYK -> RGB; good enough to tell black from white.
+                        let (c, m, y, k) = (c.clamp(0.0, 1.0), m.clamp(0.0, 1.0), y.clamp(0.0, 1.0), k.clamp(0.0, 1.0));
+                        gs.fill = [(1.0 - c) * (1.0 - k), (1.0 - m) * (1.0 - k), (1.0 - y) * (1.0 - k)];
+                    }
+                }
+                b"gs" => {
+                    if let Some(name) = op.name(0) {
+                        gs.alpha = ext_alpha(self.doc, resources, name);
+                    }
+                }
+                b"re" => {
+                    pending = op.nums::<4>().and_then(|[x, y, w, h]| {
+                        if [x, y, w, h].iter().all(|v| v.is_finite()) && w != 0.0 && h != 0.0 {
+                            let r = gs.ctm.bbox([x.min(x + w), y.min(y + h), x.max(x + w), y.max(y + h)]);
+                            (r[2] > r[0] && r[3] > r[1]).then_some(r)
+                        } else {
+                            None
+                        }
+                    });
+                }
+                b"f" | b"F" | b"f*" | b"B" | b"B*" => {
+                    if let Some(r) = pending.take()
+                        && gs.alpha >= 1.0
+                    {
+                        self.out.push(FilledRect { rect: r, rgb: gs.fill, pos });
+                    }
+                    // Any other path construction clears the pending rectangle.
+                }
+                b"m" | b"l" | b"c" | b"v" | b"y" | b"h" | b"S" | b"s" | b"n" | b"W" | b"W*" => {
+                    pending = None;
+                }
+                b"Do" => {
+                    if let Some(name) = op.name(0) {
+                        if depth >= MAX_DEPTH {
+                            return Err(AuditError::TooDeep);
+                        }
+                        self.walk_xobject(name, gs, resources, depth, pos)?;
+                    }
+                    pending = None;
+                }
+                _ => {}
+            }
+        }
+        Ok(())
+    }
+
+    /// Follow a form XObject read-only, composing its matrix onto the current CTM. State
+    /// changes inside never leak out; every rectangle found is stamped with the `Do`
+    /// position `pos`.
+    fn walk_xobject(&mut self, name: &[u8], gs: &Gs, resources: &Dict, depth: usize, pos: (usize, usize)) -> Result<(), AuditError> {
+        let xobjects = resources.get(b"XObject").map(|o| self.doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default();
+        let Some(entry) = xobjects.get(name) else { return Ok(()) };
+        let resolved = self.doc.resolve(entry);
+        let Object::Stream(stream) = &*resolved else { return Ok(()) };
+        let dict = &stream.dict;
+        if dict.name(b"Subtype") != Some(b"Form") {
+            return Ok(());
+        }
+        let matrix = dict
+            .get(b"Matrix")
+            .map(|o| self.doc.resolve(o))
+            .and_then(|o| o.as_array().map(|a| a.to_vec()))
+            .and_then(|a| {
+                let v: Vec<f64> = a.iter().filter_map(|o| self.doc.resolve(o).as_f64()).collect();
+                (v.len() == 6 && v.iter().all(|x| x.is_finite())).then(|| Matrix([v[0], v[1], v[2], v[3], v[4], v[5]]))
+            })
+            .unwrap_or(Matrix::IDENTITY);
+        let sub_resources = dict.get(b"Resources").map(|o| self.doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default();
+        // A form stream that cannot be decoded fails the audit: it might hide a cover.
+        let data = stream.decoded_strict()?;
+        let ops = parse(&data).ops;
+        // The XObject matrix maps form space into the user space active at `Do`.
+        let mut sub_gs = gs.clone();
+        sub_gs.ctm = matrix.then(&gs.ctm);
+        let mut sub_stack = Vec::new();
+        self.walk_ops(&ops, &mut sub_gs, &mut sub_stack, &sub_resources, depth + 1, Some(pos))
+    }
+}
+
+/// The non-stroking alpha (`/ca`) of a named ExtGState, defaulting to opaque.
+fn ext_alpha(doc: &Document, resources: &Dict, name: &[u8]) -> f64 {
+    let alpha = resources
+        .get(b"ExtGState")
+        .map(|o| doc.resolve(o))
+        .and_then(|o| o.as_dict().cloned())
+        .and_then(|d| d.get(name).map(|o| doc.resolve(o)))
+        .and_then(|o| o.as_dict().cloned())
+        .and_then(|d| d.get(b"ca").map(|o| doc.resolve(o)).and_then(|o| o.as_f64()));
+    alpha.filter(|a| a.is_finite()).map(|a| a.clamp(0.0, 1.0)).unwrap_or(1.0)
+}
+
+/// Every opaque filled rectangle drawn by a page's content (and its form XObjects), with paint
+/// positions. A page's content streams are walked once, joined, with one graphics state, so
+/// state set in an earlier stream is still in force in the later ones. Any content stream that
+/// cannot be decoded is an audit failure, never an empty result.
+pub fn filled_rects(doc: &Document, page: &Dict) -> Result<Vec<FilledRect>, AuditError> {
+    let resources = page.get(b"Resources").map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default();
+    let contents: Vec<Object> = match page.get(b"Contents") {
+        None => Vec::new(),
+        Some(c) => match &*doc.resolve(c) {
+            Object::Array(a) => a.clone(),
+            _ => vec![c.clone()],
+        },
+    };
+    let mut streams = Vec::with_capacity(contents.len());
+    for c in &contents {
+        if let Object::Stream(s) = &*doc.resolve(c) {
+            streams.push(s.decoded_strict()?);
+        }
+    }
+    let pieces = Pieces::join(&streams);
+    let parsed = pieces.parse();
+    let mut w = Walker { doc, pieces: &pieces, out: Vec::new(), ops_seen: 0 };
+    let mut gs = Gs::default();
+    let mut stack = Vec::new();
+    w.walk_ops(&parsed.ops, &mut gs, &mut stack, &resources, 0, None)?;
+    Ok(w.out)
+}
diff --git a/crates/audit/src/lib.rs b/crates/audit/src/lib.rs
new file mode 100644
index 00000000..ad26c255
--- /dev/null
+++ b/crates/audit/src/lib.rs
@@ -0,0 +1,192 @@
+//! Verification tooling: audit a document for faux redactions.
+//!
+//! [`audit_redactions`] finds *faux redactions* — opaque filled rectangles drawn over text
+//! that is still extractable underneath — and redaction annotations that were marked but
+//! never applied. A properly applied redaction removes the text, so it never flags.
+//!
+//! A rectangle counts as a cover only when it was painted strictly *after* the text it
+//! overlaps, and only when it is dark enough against the text's color to make the text
+//! unreadable (WCAG contrast below 3.0). Page backgrounds, table shading and highlight
+//! marks are therefore not flagged.
+//!
+//! Detection limits (documented, not hidden): only `re` rectangles closed by a fill operator
+//! are considered — arbitrary filled paths, shadings and patterns are not; a rectangle drawn
+//! with a translucent ExtGState (`/ca < 1`) is not flagged; annotation rectangles are compared
+//! in unrotated user space, so pages with `/Rotate` may misalign; covers inside form XObjects
+//! are found, but only text drawn directly in the page content is checked under them, so text
+//! inside a form XObject is not audited.
+//!
+//! The audit fails closed: any content that cannot be read (an undecodable content stream,
+//! malformed annotations, form XObjects nested deeper than 32 or in a cycle) is an error, never
+//! an empty finding list.
+
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
+use pdfcraft_cos::{Dict, Document};
+use pdfcraft_edit::TextLine;
+
+mod cover;
+
+#[cfg(test)]
+mod tests;
+
+/// What the audit found.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum FindingKind {
+    /// An opaque filled rectangle covers text that is still extractable.
+    CoveredText,
+    /// A `/Redact` annotation was placed but never applied: the text is untouched.
+    UnappliedMark,
+}
+
+impl FindingKind {
+    pub fn id(self) -> &'static str {
+        match self {
+            FindingKind::CoveredText => "covered-text",
+            FindingKind::UnappliedMark => "unapplied-mark",
+        }
+    }
+}
+
+/// One audit finding.
+#[derive(Clone, Debug, PartialEq)]
+pub struct AuditFinding {
+    /// 0-based page index.
+    pub page: usize,
+    pub kind: FindingKind,
+    /// The covering rectangle (or the mark's rectangle), in page user space.
+    pub rect: [f64; 4],
+    /// The extractable text the cover hides (possibly empty when nothing decodable remains).
+    pub covered_text: String,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum AuditError {
+    #[error("page {0}: {1}")]
+    Text(usize, String),
+    #[error("content walk exceeded the operator bound")]
+    TooManyOps,
+    #[error("form XObjects nest deeper than the audit follows")]
+    TooDeep,
+    #[error("page has a malformed /Annots entry")]
+    BadAnnots,
+    #[error(transparent)]
+    Cos(#[from] pdfcraft_cos::CosError),
+    #[error(transparent)]
+    Edit(#[from] pdfcraft_edit::EditError),
+}
+
+/// Fraction of a text line's area that must lie under a cover to count as hidden.
+const COVER_FRACTION: f64 = 0.4;
+/// WCAG contrast ratio below which the text is unreadable against the cover.
+const COVER_CONTRAST: f64 = 3.0;
+
+/// Audit every page for faux redactions and unapplied redaction marks. Fails closed: any
+/// content that cannot be decoded is returned as an error, never as an empty finding list.
+pub fn audit_redactions(doc: &Document) -> Result<Vec<AuditFinding>, AuditError> {
+    let mut out = Vec::new();
+    for (n, page) in pdfcraft_model::pages(doc).iter().enumerate() {
+        let lines = pdfcraft_edit::text_lines(doc, n).map_err(|e| AuditError::Text(n, e.to_string()))?;
+        // 1. Opaque filled rectangles over extractable text.
+        for r in cover::filled_rects(doc, &page.dict)? {
+            let mut covered = String::new();
+            for line in &lines {
+                if is_cover(&r, line) {
+                    if !covered.is_empty() {
+                        covered.push(' ');
+                    }
+                    covered.push_str(line.text.trim());
+                }
+            }
+            if !covered.trim().is_empty() {
+                out.push(AuditFinding { page: n, kind: FindingKind::CoveredText, rect: r.rect, covered_text: covered });
+            }
+        }
+        // 2. Redact annotations that were never applied.
+        for annot in annots(doc, &page.dict)? {
+            let mut covered = String::new();
+            for line in &lines {
+                if covers(&annot, &line.rect) {
+                    if !covered.is_empty() {
+                        covered.push(' ');
+                    }
+                    covered.push_str(line.text.trim());
+                }
+            }
+            if !covered.trim().is_empty() {
+                out.push(AuditFinding { page: n, kind: FindingKind::UnappliedMark, rect: annot, covered_text: covered });
+            }
+        }
+    }
+    Ok(out)
+}
+
+/// A filled rectangle is a faux-redaction cover for a text line iff it was painted strictly
+/// after the line, overlaps it substantially, and is dark enough against the line's color to
+/// make the text unreadable. Light covers (table shading, highlights) over dark text fail the
+/// contrast check and are not flagged.
+fn is_cover(rect: &cover::FilledRect, line: &TextLine) -> bool {
+    rect.pos > line.paint_pos() && covers(&rect.rect, &line.rect) && contrast(line.color, rect.rgb) < COVER_CONTRAST
+}
+
+/// Does `cover` hide a substantial part of `line`?
+fn covers(cover: &[f64; 4], line: &[f64; 4]) -> bool {
+    let ix0 = cover[0].max(line[0]);
+    let iy0 = cover[1].max(line[1]);
+    let ix1 = cover[2].min(line[2]);
+    let iy1 = cover[3].min(line[3]);
+    if ix1 <= ix0 || iy1 <= iy0 {
+        return false;
+    }
+    let line_area = (line[2] - line[0]).max(0.0) * (line[3] - line[1]).max(0.0);
+    if line_area <= 0.0 {
+        return false;
+    }
+    (ix1 - ix0) * (iy1 - iy0) / line_area >= COVER_FRACTION
+}
+
+/// WCAG 2.x relative luminance of an sRGB triple.
+fn luminance(rgb: [f64; 3]) -> f64 {
+    let lin = rgb.map(|c| {
+        let c = c.clamp(0.0, 1.0);
+        if c <= 0.03928 { c / 12.92 } else { ((c + 0.055) / 1.055).powf(2.4) }
+    });
+    0.2126 * lin[0] + 0.7152 * lin[1] + 0.0722 * lin[2]
+}
+
+/// WCAG contrast ratio between two sRGB colors: 1.0 (identical) to 21.0 (black on white).
+fn contrast(a: [f64; 3], b: [f64; 3]) -> f64 {
+    let (l1, l2) = (luminance(a), luminance(b));
+    let (hi, lo) = if l1 > l2 { (l1, l2) } else { (l2, l1) };
+    (hi + 0.05) / (lo + 0.05)
+}
+
+/// Rectangles of `/Redact` annotations on a page (unrotated user space). A missing `/Annots`
+/// means no marks; a malformed one fails the audit rather than silently passing.
+fn annots(doc: &Document, page: &Dict) -> Result<Vec<[f64; 4]>, AuditError> {
+    let Some(a) = page.get(b"Annots") else { return Ok(Vec::new()) };
+    let resolved = doc.resolve(a);
+    let items: Vec<pdfcraft_cos::Object> = match &*resolved {
+        pdfcraft_cos::Object::Array(items) => items.clone(),
+        // A missing /Annots means no marks; a malformed one fails the audit.
+        _ => return Err(AuditError::BadAnnots),
+    };
+    let mut out = Vec::new();
+    for a in &items {
+        let dict = match &*doc.resolve(a) {
+            pdfcraft_cos::Object::Dict(d) => d.clone(),
+            _ => continue,
+        };
+        if dict.name(b"Subtype") != Some(b"Redact") {
+            continue;
+        }
+        let v: Vec<f64> = match dict.get(b"Rect") {
+            None => continue,
+            Some(r) => doc.resolve(r).as_array().map(|arr| arr.iter().filter_map(|o| doc.resolve(o).as_f64()).collect()).unwrap_or_default(),
+        };
+        if v.len() == 4 && v.iter().all(|x| x.is_finite()) {
+            out.push([v[0].min(v[2]), v[1].min(v[3]), v[0].max(v[2]), v[1].max(v[3])]);
+        }
+    }
+    Ok(out)
+}
diff --git a/crates/audit/src/tests.rs b/crates/audit/src/tests.rs
new file mode 100644
index 00000000..edeb2f95
--- /dev/null
+++ b/crates/audit/src/tests.rs
@@ -0,0 +1,215 @@
+//! Tests build their own tiny PDFs in code (contributor-original fixtures): no binary files,
+//! no Adobe material, exact xref offsets computed by the builder below.
+
+use std::sync::Arc;
+
+use pdfcraft_cos::Document;
+
+use crate::{FindingKind, audit_redactions};
+
+/// Minimal PDF assembler: objects are numbered 1..=n in order.
+struct Builder {
+    objects: Vec<Vec<u8>>,
+}
+
+impl Builder {
+    fn new() -> Self {
+        Builder { objects: Vec::new() }
+    }
+
+    fn add(&mut self, body: &str) -> usize {
+        self.objects.push(body.as_bytes().to_vec());
+        self.objects.len()
+    }
+
+    fn add_stream(&mut self, data: &[u8]) -> usize {
+        self.add_stream_with(data, "")
+    }
+
+    fn add_stream_with(&mut self, data: &[u8], dict_extra: &str) -> usize {
+        let mut body = format!("<< /Length {} {dict_extra} >>\nstream\n", data.len()).into_bytes();
+        body.extend_from_slice(data);
+        body.extend_from_slice(b"\nendstream");
+        self.objects.push(body);
+        self.objects.len()
+    }
+
+    fn build(self) -> Vec<u8> {
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, obj) in self.objects.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+            out.extend_from_slice(obj);
+            out.extend_from_slice(b"\nendobj\n");
+        }
+        let xref_at = out.len();
+        let n = self.objects.len() + 1;
+        out.extend_from_slice(format!("xref\n0 {n}\n").as_bytes());
+        out.extend_from_slice(b"0000000000 65535 f \n");
+        for off in offsets {
+            out.extend_from_slice(format!("{off:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(b"trailer\n<< ");
+        out.extend_from_slice(format!("/Size {n} /Root 1 0 R").as_bytes());
+        out.extend_from_slice(b" >>\nstartxref\n");
+        out.extend_from_slice(format!("{xref_at}\n").as_bytes());
+        out.extend_from_slice(b"%%EOF\n");
+        out
+    }
+}
+
+const FONT: &str = "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>";
+
+/// One page with `content` as its stream; `page_extra` is appended inside the page dict.
+fn one_page(content: &[u8], page_extra: &str) -> Vec<u8> {
+    let mut b = Builder::new();
+    b.add("<< /Type /Catalog /Pages 2 0 R >>");
+    b.add("<< /Type /Pages /Kids [3 0 R] /Count 1 >>");
+    let stream_num = 4;
+    b.add(&format!(
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents {stream_num} 0 R /Resources << /Font << /F1 5 0 R >> >> {page_extra} >>"
+    ));
+    b.add_stream(content);
+    b.add(FONT);
+    b.build()
+}
+
+/// One page with two content streams (`/Contents [4 0 R 5 0 R]`).
+fn two_streams(s1: &[u8], s2: &[u8]) -> Vec<u8> {
+    let mut b = Builder::new();
+    b.add("<< /Type /Catalog /Pages 2 0 R >>");
+    b.add("<< /Type /Pages /Kids [3 0 R] /Count 1 >>");
+    b.add("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents [4 0 R 5 0 R] /Resources << /Font << /F1 6 0 R >> >> >>");
+    b.add_stream(s1);
+    b.add_stream(s2);
+    b.add(FONT);
+    b.build()
+}
+
+/// One page whose content stream claims `/FlateDecode` but holds garbage: decoding must fail.
+fn bad_filter_page() -> Vec<u8> {
+    let mut b = Builder::new();
+    b.add("<< /Type /Catalog /Pages 2 0 R >>");
+    b.add("<< /Type /Pages /Kids [3 0 R] /Count 1 >>");
+    b.add("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >>");
+    b.add_stream_with(b"this is not deflated data", "/Filter /FlateDecode");
+    b.add(FONT);
+    b.build()
+}
+
+fn open(bytes: Vec<u8>) -> Document {
+    Document::open(Arc::new(bytes)).expect("test pdf must open")
+}
+
+#[test]
+fn faux_redaction_is_found() {
+    let content = b"BT /F1 24 Tf 100 700 Td (SECRET DATA 123) Tj ET\n0 g\n100 688 220 32 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert_eq!(findings.len(), 1, "{findings:?}");
+    let f = &findings[0];
+    assert_eq!(f.page, 0);
+    assert_eq!(f.kind, FindingKind::CoveredText);
+    assert!(f.covered_text.contains("SECRET"), "covered_text was {:?}", f.covered_text);
+}
+
+#[test]
+fn clean_document_has_no_findings() {
+    let content = b"BT /F1 24 Tf 100 700 Td (nothing hidden here) Tj ET\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert!(findings.is_empty(), "{findings:?}");
+}
+
+#[test]
+fn black_box_without_text_is_not_a_finding() {
+    // A filled rectangle with no text under it is decoration, not a faux redaction.
+    let content = b"BT /F1 24 Tf 100 100 Td (far away) Tj ET\n0 g\n400 600 100 40 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert!(findings.is_empty(), "{findings:?}");
+}
+
+#[test]
+fn translucent_cover_is_not_flagged() {
+    // A rectangle drawn with a translucent ExtGState does not hide the text.
+    let content = b"/GS1 gs\nBT /F1 24 Tf 100 700 Td (SECRET DATA 123) Tj ET\n0 g\n100 688 220 32 re f\n";
+    let page_extra = "/Resources << /Font << /F1 5 0 R >> /ExtGState << /GS1 6 0 R >> >>";
+    let mut b = Builder::new();
+    b.add("<< /Type /Catalog /Pages 2 0 R >>");
+    b.add("<< /Type /Pages /Kids [3 0 R] /Count 1 >>");
+    b.add(&format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R {page_extra} >>"));
+    b.add_stream(content);
+    b.add(FONT);
+    b.add("<< /Type /ExtGState /ca 0.5 >>");
+    let findings = audit_redactions(&open(b.build())).expect("audit must run");
+    assert!(findings.is_empty(), "{findings:?}");
+}
+
+#[test]
+fn unapplied_redact_mark_is_found() {
+    let content = b"BT /F1 24 Tf 100 700 Td (DO NOT SHARE) Tj ET\n";
+    let page_extra = "/Annots [6 0 R]";
+    let mut b = Builder::new();
+    b.add("<< /Type /Catalog /Pages 2 0 R >>");
+    b.add("<< /Type /Pages /Kids [3 0 R] /Count 1 >>");
+    b.add(&format!("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> {page_extra} >>"));
+    b.add_stream(content);
+    b.add(FONT);
+    b.add("<< /Type /Annot /Subtype /Redact /Rect [95 685 305 725] /C [1 0 0] >>");
+    let findings = audit_redactions(&open(b.build())).expect("audit must run");
+    assert_eq!(findings.len(), 1, "{findings:?}");
+    assert_eq!(findings[0].kind, FindingKind::UnappliedMark);
+    assert!(findings[0].covered_text.contains("DO NOT SHARE"));
+}
+
+#[test]
+fn background_before_text_is_not_flagged() {
+    // An opaque dark rectangle painted *before* the text is a background, not a cover.
+    let content = b"0 g\n100 688 220 32 re f\nBT /F1 24 Tf 100 700 Td (SECRET DATA 123) Tj ET\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert!(findings.is_empty(), "{findings:?}");
+}
+
+#[test]
+fn light_shading_after_text_is_not_flagged() {
+    // Light table-style shading painted after the text leaves it readable: not a cover.
+    let content = b"BT /F1 24 Tf 100 700 Td (SECRET DATA 123) Tj ET\n0.9 g\n100 688 220 32 re f\n";
+    let findings = audit_redactions(&open(one_page(content, ""))).expect("audit must run");
+    assert!(findings.is_empty(), "{findings:?}");
+}
+
+#[test]
+fn graphics_state_carries_across_streams() {
+    // The first stream sets a white fill after the text; the second stream's rectangle over
+    // the text is therefore white, not the default black: no finding. Without the carry fix
+    // the rectangle would default to black and flag.
+    let s1 = b"BT /F1 24 Tf 100 700 Td (SECRET DATA 123) Tj ET\n1 g\n";
+    let s2 = b"100 688 220 32 re f\n";
+    let findings = audit_redactions(&open(two_streams(s1, s2))).expect("audit must run");
+    assert!(findings.is_empty(), "{findings:?}");
+}
+
+#[test]
+fn audit_fails_closed_on_undecodable_stream() {
+    // A content stream that cannot be decoded is an audit error, never an empty finding list.
+    let err = audit_redactions(&open(bad_filter_page())).expect_err("audit must fail closed");
+    let msg = err.to_string();
+    assert!(msg.contains("decoded"), "unexpected error: {msg}");
+}
+
+/// A form XObject that draws itself nests without end. The walk can't follow it to the bottom, so
+/// the audit fails rather than report the page clean with a possible cover left unseen.
+#[test]
+fn self_drawing_form_fails_the_audit() {
+    let mut b = Builder::new();
+    b.add("<< /Type /Catalog /Pages 2 0 R >>");
+    b.add("<< /Type /Pages /Kids [3 0 R] /Count 1 >>");
+    b.add("<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R /Resources << /Font << /F1 6 0 R >> /XObject << /X 5 0 R >> >> >>");
+    b.add_stream(b"BT /F1 24 Tf 100 700 Td (SECRET) Tj ET\n/X Do\n");
+    b.add_stream_with(
+        b"0 g\n100 688 220 32 re f\n/X Do\n",
+        "/Type /XObject /Subtype /Form /BBox [0 0 612 792] /Resources << /XObject << /X 5 0 R >> >>",
+    );
+    b.add(FONT);
+    let result = audit_redactions(&open(b.build()));
+    assert!(matches!(result, Err(crate::AuditError::TooDeep)), "{result:?}");
+}
diff --git a/crates/automation/README.md b/crates/automation/README.md
index 02c08114..1c0b121f 100644
--- a/crates/automation/README.md
+++ b/crates/automation/README.md
@@ -52,6 +52,23 @@ or fill colour. Names, rectangles and rotations require the single-field form. R
 
 Implemented: `initialize` (protocol 2025-06-18, 2025-03-26, 2024-11-05), `ping`, `tools/list` (with `readOnlyHint`/`destructiveHint` annotations), `tools/call` (JSON results also returned as `structuredContent`; images as `image/png`), and `resources/list`, `resources/templates/list` and `resources/read`. The resources expose the open documents read-only: `pdfcraft://doc/{doc}/info` (JSON), `…/text`, `…/page/{page}/text` and `…/page/{page}/image{?dpi}` (PNG, 1–600 dpi). Tool failures come back as `isError: true` results, so the agent can read and recover from them.
 
+### From an installed release
+
+The release packages ship `pdfcraft-cli` alongside the desktop app, so no build is needed:
+
+| Install | CLI |
+|---|---|
+| Windows (MSI) | `C:\Program Files\PdfCraft\pdfcraft-cli.exe` by default (wherever you installed it otherwise), not on `PATH` |
+| Linux (deb, rpm) | `/usr/bin/pdfcraft-cli` |
+| macOS | the separate `pdfcraft-cli-<version>-macos-<arch>.zip` release asset (the `.app` holds only the desktop app) |
+
+```sh
+# Windows, default install folder
+claude mcp add pdfcraft -- "C:\Program Files\PdfCraft\pdfcraft-cli.exe" mcp --root <dir>
+# Linux, or macOS with the CLI unzipped onto PATH
+claude mcp add pdfcraft -- pdfcraft-cli mcp --root <dir>
+```
+
 ## Adding a tool
 
 1. Add the engine capability first, with its tests (the tool is a thin adapter).
diff --git a/crates/automation/src/a11y.rs b/crates/automation/src/a11y.rs
index 81f79d14..f23ee24f 100644
--- a/crates/automation/src/a11y.rs
+++ b/crates/automation/src/a11y.rs
@@ -84,7 +84,9 @@ impl Automation {
         let r = doc.accessibility_check(&o).ok_or_else(|| failed("the document can't be read for checking"))?;
         let path = self.resolve(a.str("path")?, true)?;
         let (y, m, d) = self.session.today();
-        let html = pdfcraft_engine::a11y::report_html(&r, &doc.name, &format!("{y}-{m:02}-{d:02}"));
+        // A script's report is in English, like the rest of what the tools say and answer with.
+        let words = pdfcraft_engine::a11y::in_english;
+        let html = pdfcraft_engine::a11y::report_html(&r, &doc.name, &format!("{y}-{m:02}-{d:02}"), "en", &words);
         write_atomic(&path, html.as_bytes())?;
         let mut out = report_json(&r);
         out["path"] = json!(path.to_string_lossy());
@@ -271,7 +273,7 @@ impl Automation {
         let ext = path.extension().map(|e| e.to_string_lossy().into_owned()).unwrap_or_default();
         let format = pdfcraft_engine::compare::OfficeFormat::from_extension(&ext)
             .ok_or_else(|| ToolError::InvalidArgs(format!("unsupported extension {ext:?} (docx, html or rtf)")))?;
-        let bytes = self.doc(a)?.export_office(format);
+        let bytes = self.doc_to_copy(a)?.export_office(format);
         write_atomic(&path, &bytes)?;
         Ok(json!({ "path": path.to_string_lossy(), "bytes": bytes.len(), "format": format.extension() }))
     }
diff --git a/crates/automation/src/lib.rs b/crates/automation/src/lib.rs
index eec1f436..c2e43a3a 100644
--- a/crates/automation/src/lib.rs
+++ b/crates/automation/src/lib.rs
@@ -73,14 +73,27 @@ fn failed(e: impl std::fmt::Display) -> ToolError {
     ToolError::Failed(e.to_string())
 }
 
+impl From<pdfcraft_engine::EditError> for ToolError {
+    fn from(e: pdfcraft_engine::EditError) -> Self {
+        failed(e)
+    }
+}
+
 /// Default and maximum resolution for `page_render`.
 const DEFAULT_DPI: f64 = 96.0;
 const MAX_DPI: f64 = 600.0;
+/// How far a watermark may be moved from the page centre, in points (a page is at most 14,400).
+const WATERMARK_MAX_OFFSET: f64 = 20_000.0;
 
 /// Bookmarks in one page of the bookmark list, by default and at most.
 const BOOKMARK_PAGE: usize = 100;
 const MAX_BOOKMARK_PAGE: usize = 1000;
 
+/// `text_find` extracts this many pages first, doubling each batch up to [`FIND_MAX_BATCH`], so a
+/// match near the start returns without touching the rest of a long document (#971).
+const FIND_FIRST_BATCH: usize = 8;
+const FIND_MAX_BATCH: usize = 128;
+
 /// Page texts of one document version: (the working bytes, one slot per page).
 type TextCache = (Arc<Vec<u8>>, Vec<Option<Arc<PageText>>>);
 
@@ -194,6 +207,38 @@ impl Automation {
                 out["rotated"] = json!(n);
                 out
             }
+            "page_enhance_camera" => {
+                let page = self.page(&a)?;
+                let given = a.nums::<8>("corners")?;
+                let doc = self.doc(&a)?;
+                let (id, info) = (doc.id, doc.info.pages.get(page).cloned().ok_or_else(|| failed("no such page"))?);
+                let corners = match given {
+                    Some(c) => [0, 1, 2, 3].map(|i| {
+                        let [x, y] = info.view_to_user(c[2 * i] as f32, c[2 * i + 1] as f32);
+                        [x as f64, y as f64]
+                    }),
+                    None => self.session.detect_camera_corners(id, page).ok_or_else(|| {
+                        failed("the document's edges could not be found on this page: pass `corners` [x1, y1, x2, y2, x3, y3, x4, y4]")
+                    })?,
+                };
+                let level = match a.opt_int("level")? {
+                    None => 0,
+                    Some(l @ 0..=100) => l as u8,
+                    Some(l) => return Err(ToolError::InvalidArgs(format!("level must be between 0 and 100, not {l}"))),
+                };
+                let look = match a.opt_str("mode")? {
+                    None => pdfcraft_engine::camera_clean::Look::Colour,
+                    Some(m) => pdfcraft_engine::camera_clean::Look::from_name(m)
+                        .ok_or_else(|| ToolError::InvalidArgs(format!("unknown mode {m:?} (original, colour, greyscale, bw)")))?,
+                };
+                self.session.enhance_camera_page_at(id, page, corners, look, level).map_err(failed)?;
+                let r = |v: f32| (v * 100.0).round() / 100.0;
+                let used: Vec<f32> = corners.iter().flat_map(|&[x, y]| info.user_to_view(x as f32, y as f32)).map(r).collect();
+                let mut out = summary(self.doc(&a)?);
+                out["corners"] = json!(used);
+                out["detected"] = json!(given.is_none());
+                out
+            }
             "page_delete" => {
                 let pages = self.pages(&a, "pages")?;
                 self.apply(&a, Edit::DeletePages { pages })?
@@ -211,12 +256,12 @@ impl Automation {
             "doc_split" => self.doc_split(&a)?,
             "edit_undo" => {
                 let id = self.doc(&a)?.id;
-                let label = self.session.undo(id).map_err(failed)?;
+                let label = self.session.undo(id).map_err(failed)?.to_string();
                 json!({ "undone": label, "document": summary(self.doc(&a)?) })
             }
             "edit_redo" => {
                 let id = self.doc(&a)?.id;
-                let label = self.session.redo(id).map_err(failed)?;
+                let label = self.session.redo(id).map_err(failed)?.to_string();
                 json!({ "redone": label, "document": summary(self.doc(&a)?) })
             }
             "command_list" => self.command_list(&a)?,
@@ -409,7 +454,7 @@ impl Automation {
             }
             "text_paragraphs" => {
                 let page = self.page(&a)?;
-                let doc = self.doc(&a)?;
+                let doc = self.doc_to_copy(&a)?;
                 let info = &doc.info.pages[page];
                 let r = |x: f32| (x as f64 * 100.0).round() / 100.0;
                 let blocks: Vec<Value> = doc
@@ -552,6 +597,7 @@ impl Automation {
             "content_delete" => self.content_delete(&a)?,
             "doc_print" => self.doc_print(&a)?,
             "doc_remove_hidden" => self.doc_remove_hidden(&a)?,
+            "doc_audit_redactions" => self.doc_audit_redactions(&a)?,
             "fill_sign_add" => self.fill_sign_add(&a)?,
             "fill_sign_date_format" => self.fill_sign_date_format(&a)?,
             "measure_distance" => self.measurement_add(&a, pdfcraft_engine::measure::Kind::Distance)?,
@@ -664,6 +710,13 @@ impl Automation {
         self.session.get(DocId(id)).ok_or_else(|| ToolError::Failed(format!("no open document with id {id} (see doc_list)")))
     }
 
+    /// The document, if its security allows copying text and images out of it (Table 22, bit 5).
+    fn doc_to_copy(&self, a: &Args) -> Result<&Document> {
+        let doc = self.doc(a)?;
+        doc.check_copying().map_err(failed)?;
+        Ok(doc)
+    }
+
     fn doc_open(&mut self, a: &Args) -> Result<Value> {
         let path = self.resolve(a.str("path")?, false)?;
         let bytes = std::fs::read(&path).map_err(|e| failed(format!("{}: {e}", path.display())))?;
@@ -960,7 +1013,10 @@ impl Automation {
                     opacity: a.opt_num("opacity")?.unwrap_or(d.opacity),
                     rotation: a.opt_num("rotation")?.unwrap_or(d.rotation),
                     behind: a.opt_bool("behind")?.unwrap_or(false),
-                    offset: [0.0; 2],
+                    offset: [
+                        a.opt_num("offset_x")?.unwrap_or(0.0).clamp(-WATERMARK_MAX_OFFSET, WATERMARK_MAX_OFFSET),
+                        a.opt_num("offset_y")?.unwrap_or(0.0).clamp(-WATERMARK_MAX_OFFSET, WATERMARK_MAX_OFFSET),
+                    ],
                 };
                 Edit::AddWatermark { pages, settings: wm, replace, file }
             }
@@ -989,7 +1045,7 @@ impl Automation {
     }
 
     fn export(&mut self, tool: &str, a: &Args) -> Result<Value> {
-        let doc = self.doc(a)?;
+        let doc = self.doc_to_copy(a)?;
         let pages = match a.opt_ints("pages")? {
             Some(_) => self.pages(a, "pages")?,
             None => (0..doc.info.pages.len()).collect(),
@@ -1076,6 +1132,10 @@ impl Automation {
                     }
                     (None, None) => return Err(ToolError::InvalidArgs("text needs `text` or `path`".into())),
                 };
+                // The page font is Helvetica/WinAnsi: refuse what it would silently turn into `?`.
+                if let Some(c) = pdfcraft_engine::first_undrawable_plain(&text) {
+                    return Err(ToolError::InvalidArgs(pdfcraft_engine::undrawable_message(c)));
+                }
                 (format!("{title}.pdf"), self.session.create_from_text(&title, &text).map_err(failed)?)
             }
             other => return Err(ToolError::InvalidArgs(format!("unknown source {other:?}"))),
@@ -1212,8 +1272,8 @@ impl Automation {
 
     fn doc_create_multiple(&mut self, a: &Args) -> Result<Value> {
         let paths = a.strs("paths")?;
-        if paths.is_empty() || paths.len() > pdfcraft_engine::MAX_CREATE_FILES {
-            return Err(ToolError::InvalidArgs(format!("paths must list 1 to {} files", pdfcraft_engine::MAX_CREATE_FILES)));
+        if paths.is_empty() {
+            return Err(ToolError::InvalidArgs("paths must list at least one file".into()));
         }
         let separate = match a.opt_str("mode")? {
             None | Some("combine") => false,
@@ -1228,16 +1288,16 @@ impl Automation {
             Some(Value::Array(v)) if v.len() == paths.len() => v.iter().map(|x| x.as_str().map(str::to_owned)).collect(),
             Some(_) => return Err(ToolError::InvalidArgs("pages must list a range (or null) for each path".into())),
         };
-        let mut sources = Vec::new();
-        for (p, range) in paths.into_iter().zip(ranges) {
+        // Each file is read, converted and copied in turn, so a long list holds one file at a time.
+        let sources = paths.into_iter().zip(ranges).map(|(p, range)| -> std::result::Result<pdfcraft_engine::CombineSource, ToolError> {
             let path = self.resolve(p, false)?;
             let bytes = std::fs::read(&path).map_err(|e| failed(format!("{}: {e}", path.display())))?;
             let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
             let (_, pdf) = self.session.convert_to_pdf(&name, &Arc::new(bytes)).map_err(failed)?;
             let title = path.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
-            sources.push((title, pdf, range));
-        }
-        let bytes = self.session.combine_ranges(&sources).map_err(failed)?;
+            Ok((title, pdf, range))
+        });
+        let bytes = self.session.combine_each(sources)?.ok_or_else(|| ToolError::InvalidArgs("paths must list at least one file".into()))?;
         self.deliver(a, "Combined", bytes)
     }
 
@@ -1345,7 +1405,10 @@ impl Automation {
                     if let Some(g) = group {
                         firsts.push((g, path.clone(), sources.len()));
                     }
-                    Arc::new(std::fs::read(&path).map_err(|e| failed(format!("{}: {e}", path.display())))?)
+                    let bytes = Arc::new(std::fs::read(&path).map_err(|e| failed(format!("{}: {e}", path.display())))?);
+                    // Images and text files are made into PDFs first (#569), as in the Combine files tab.
+                    let file_name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
+                    self.session.as_pdf(&file_name, &bytes).map_err(failed)?
                 }
             };
             let name = path.file_stem().map(|n| n.to_string_lossy().into_owned()).unwrap_or_default();
@@ -1516,7 +1579,7 @@ impl Automation {
     }
 
     fn text_extract(&mut self, a: &Args) -> Result<Value> {
-        let doc = self.doc(a)?;
+        let doc = self.doc_to_copy(a)?;
         let id = doc.id;
         let pages = match a.opt_ints("pages")? {
             Some(_) => self.pages(a, "pages")?,
@@ -1533,22 +1596,46 @@ impl Automation {
         Ok(json!({ "pages": out }))
     }
 
+    /// Matches in document order, extracting page text in growing batches and stopping as soon as
+    /// `limit` is reached, so a bounded search doesn't extract (and cache) the whole document
+    /// (#971). One match past the limit is looked for, so `complete` is true only when no more
+    /// exist; otherwise `next` holds the arguments that continue the search.
     fn text_find(&mut self, a: &Args) -> Result<Value> {
         let doc = self.doc(a)?;
         let (id, n) = (doc.id, doc.info.pages.len());
         let query = a.str("query")?;
-        let limit = a.opt_int("limit")?.unwrap_or(500).max(1) as usize;
-        let texts = self.page_texts(id, &(0..n).collect::<Vec<_>>())?;
+        let limit = usize::try_from(a.opt_int("limit")?.unwrap_or(500).max(1)).unwrap_or(usize::MAX);
+        let start = match a.opt_int("start_page")? {
+            None => 0,
+            Some(p) if p >= 1 && usize::try_from(p).is_ok_and(|p| p <= n) => usize::try_from(p - 1).unwrap_or(0),
+            Some(p) => return Err(ToolError::InvalidArgs(format!("start_page {p} is out of range: the document has {n} pages"))),
+        };
+        let skip = usize::try_from(a.opt_int("skip")?.unwrap_or(0).max(0)).unwrap_or(usize::MAX);
         let mut matches = Vec::new();
-        'pages: for (p, text) in texts.iter().enumerate() {
-            for r in text.find(query) {
-                if matches.len() == limit {
-                    break 'pages;
+        let mut next = None;
+        let (mut first, mut batch) = (start, FIND_FIRST_BATCH);
+        'search: while first < n {
+            let end = first.saturating_add(batch).min(n);
+            let pages: Vec<usize> = (first..end).collect();
+            let texts = self.page_texts(id, &pages)?;
+            for (p, text) in pages.iter().zip(&texts) {
+                let skip_here = if *p == start { skip } else { 0 };
+                for (k, r) in text.find(query).into_iter().enumerate().skip(skip_here) {
+                    if matches.len() == limit {
+                        next = Some(json!({ "start_page": p + 1, "skip": k }));
+                        break 'search;
+                    }
+                    matches.push(json!({ "page": p + 1, "text": text.text_of(r.clone()), "rects": text.line_rects(r) }));
                 }
-                matches.push(json!({ "page": p + 1, "text": text.text_of(r.clone()), "rects": text.line_rects(r) }));
             }
+            first = end;
+            batch = batch.saturating_mul(2).min(FIND_MAX_BATCH);
         }
-        Ok(json!({ "query": query, "count": matches.len(), "matches": matches }))
+        let mut out = json!({ "query": query, "count": matches.len(), "complete": next.is_none(), "matches": matches });
+        if let (Some(next), Some(o)) = (next, out.as_object_mut()) {
+            o.insert("next".into(), next);
+        }
+        Ok(out)
     }
 
     fn command_list(&self, a: &Args) -> Result<Value> {
@@ -1996,6 +2083,85 @@ mod tests {
     use super::*;
     use pdfcraft_platform::staging::STAGING_ATTEMPTS;
 
+    /// `n` pages, page i showing "Page i".
+    fn numbered_pages(n: usize) -> Vec<u8> {
+        let mut objs: Vec<String> = vec!["<< /Type /Catalog /Pages 2 0 R >>".into()];
+        let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", 4 + 2 * i)).collect();
+        objs.push(format!("<< /Type /Pages /Kids [{}] /Count {n} /MediaBox [0 0 200 300] >>", kids.join(" ")));
+        objs.push("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into());
+        for i in 0..n {
+            objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 3 0 R >> >> >>", 5 + 2 * i));
+            let body = format!("BT /F1 24 Tf 20 150 Td (Page {}) Tj ET", i + 1);
+            objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+        }
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+        out
+    }
+
+    fn json(a: &mut Automation, tool: &str, args: Value) -> Value {
+        match a.call(tool, &args).map(|mut c| c.remove(0)) {
+            Ok(Content::Json(v)) => v,
+            other => panic!("{tool} {args}: {other:?}"),
+        }
+    }
+
+    #[test]
+    fn a_bounded_text_find_reads_only_the_pages_it_needs_and_says_it_stopped() {
+        let dir = std::env::temp_dir().join(format!("pdfcraft-automation-find-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("long.pdf"), numbered_pages(200)).unwrap();
+        let mut a = Automation::new().with_root(&dir).unwrap();
+        let doc = json(&mut a, "doc_open", json!({ "path": "long.pdf" }))["doc"].clone();
+        let extracted = |a: &Automation| a.texts.values().map(|(_, pages)| pages.iter().filter(|t| t.is_some()).count()).sum::<usize>();
+
+        // #971: the first match is on page 1 and the next on page 10, so the rest of the 200 pages
+        // aren't extracted or cached.
+        let first = json(&mut a, "text_find", json!({ "doc": doc, "query": "Page 1", "limit": 1 }));
+        assert_eq!(first["count"], 1);
+        assert_eq!(first["matches"][0]["page"], 1);
+        assert_eq!(first["complete"], false, "{first}");
+        assert_eq!(first["next"], json!({ "start_page": 10, "skip": 0 }));
+        assert!(extracted(&a) <= 3 * FIND_FIRST_BATCH, "{} pages extracted for one match", extracted(&a));
+
+        // Following `next` returns every match exactly once, in order, and then says it's complete.
+        // "1" appears twice on pages like 11 and 101, so continuing has to skip within a page.
+        let all = json(&mut a, "text_find", json!({ "doc": doc, "query": "1", "limit": 10_000 }));
+        assert_eq!(all["complete"], true);
+        assert!(all.get("next").is_none());
+        let mut pieced = Vec::new();
+        let mut args = json!({ "doc": doc, "query": "1", "limit": 3 });
+        loop {
+            let found = json(&mut a, "text_find", args.clone());
+            pieced.extend(found["matches"].as_array().unwrap().iter().map(|m| (m["page"].clone(), m["rects"].clone())));
+            if found["complete"] == true {
+                break;
+            }
+            args["start_page"] = found["next"]["start_page"].clone();
+            args["skip"] = found["next"]["skip"].clone();
+        }
+        let expected: Vec<_> = all["matches"].as_array().unwrap().iter().map(|m| (m["page"].clone(), m["rects"].clone())).collect();
+        assert_eq!(all["count"], expected.len());
+        assert_eq!(pieced, expected);
+
+        // A search that runs to the end below its limit is complete; a start page past the end is refused.
+        let few = json(&mut a, "text_find", json!({ "doc": doc, "query": "Page 200", "start_page": 150 }));
+        assert_eq!((few["count"].clone(), few["complete"].clone()), (json!(1), json!(true)));
+        assert!(a.call("text_find", &json!({ "doc": doc, "query": "x", "start_page": 201 })).is_err());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     #[test]
     fn dot_dot_resolves_by_name_and_never_climbs_above_the_start() {
         let base = std::env::temp_dir();
diff --git a/crates/automation/src/printing.rs b/crates/automation/src/printing.rs
index ef9f252c..9f85f433 100644
--- a/crates/automation/src/printing.rs
+++ b/crates/automation/src/printing.rs
@@ -105,9 +105,15 @@ impl Automation {
             None => PAPERS[0].1,
             Some(p) => PAPERS
                 .iter()
-                .find(|(n, _)| n.eq_ignore_ascii_case(p) || n.replace("US ", "").eq_ignore_ascii_case(p))
+                .find(|(n, _)| {
+                    n.eq_ignore_ascii_case(p)
+                        || n.replace("US ", "").eq_ignore_ascii_case(p)
+                        || n.split(" (").next().is_some_and(|name| name.eq_ignore_ascii_case(p))
+                })
                 .map(|x| x.1)
-                .ok_or_else(|| bad(format!("unknown paper {p:?} (Letter, Legal, Tabloid, A3, A4, A5)")))?,
+                .ok_or_else(|| {
+                    bad(format!("unknown paper {p:?}; choose one of {}", PAPERS.iter().map(|(name, _)| *name).collect::<Vec<_>>().join(", ")))
+                })?,
         };
         let settings = print::Settings { pages, paper, orientation, layout, content };
         let sizes: Vec<(f64, f64)> = self.doc(a)?.info.pages.iter().map(|p| (p.width as f64, p.height as f64)).collect();
diff --git a/crates/automation/src/redact.rs b/crates/automation/src/redact.rs
index ec8f232d..44baf5e6 100644
--- a/crates/automation/src/redact.rs
+++ b/crates/automation/src/redact.rs
@@ -163,6 +163,22 @@ impl Automation {
         Ok(json!({ "total": total, "categories": items }))
     }
 
+    pub(crate) fn doc_audit_redactions(&self, a: &Args) -> Result<Value> {
+        let findings = self.doc(a)?.audit_redactions().map_err(ToolError::Failed)?;
+        let items: Vec<Value> = findings
+            .into_iter()
+            .map(|f| {
+                json!({
+                    "page": f.page + 1,
+                    "kind": f.kind.id(),
+                    "rect": f.rect,
+                    "covered_text": f.covered_text,
+                })
+            })
+            .collect();
+        Ok(json!({ "findings": items, "count": items.len() }))
+    }
+
     pub(crate) fn doc_remove_hidden(&mut self, a: &Args) -> Result<Value> {
         let edit = match a.get("categories") {
             None => Edit::Sanitize,
diff --git a/crates/automation/src/signing.rs b/crates/automation/src/signing.rs
index f45ee5aa..7701f612 100644
--- a/crates/automation/src/signing.rs
+++ b/crates/automation/src/signing.rs
@@ -70,7 +70,8 @@ impl Automation {
             "timestamp_time": s.timestamp_time.map(|t| t.to_string()),
             "modification": modification,
             "changes": changes,
-            "details": s.details,
+            // Scripts read this, so the sentences stay in English, whatever the interface reads in.
+            "details": s.details.iter().map(|d| d.message.clone()).collect::<Vec<_>>(),
         }))
     }
 
@@ -171,6 +172,11 @@ impl Automation {
             }),
             Some(v) => Some(v.as_u64().filter(|n| (1..=3).contains(n)).ok_or_else(|| bad("certify must be 1, 2 or 3"))? as u8),
         };
+        let graphic = match a.get("graphic") {
+            None | Some(Value::Null) => None,
+            Some(g) if rect.is_none() && field.is_none() => return Err(bad(format!("graphic {g} needs a visible signature: pass rect or field"))),
+            Some(g) => Some(self.signature_graphic(g)?),
+        };
         let out = self.resolve(a.str("out")?, true)?;
         let opts = SignOptions {
             field,
@@ -180,9 +186,14 @@ impl Automation {
             location: a.opt_str("location")?.map(str::to_string),
             contact: a.opt_str("contact")?.map(str::to_string),
             certify,
+            graphic,
             ..SignOptions::default()
         };
-        let signed = self.session.sign(doc_id, &id, opts).map_err(failed)?;
+        let signed = self.session.sign(doc_id, &id, opts).map_err(|e| match e {
+            // A graphic the signer refuses is the caller's to fix.
+            pdfcraft_engine::EditError::Sign(m) if m.starts_with("the signature graphic") => bad(m),
+            e => failed(e),
+        })?;
         write_atomic(&out, &signed)?;
         let path = out.to_string_lossy().into_owned();
         self.session.mark_signed(doc_id, signed.clone(), Some(path.clone())).map_err(failed)?;
@@ -191,6 +202,33 @@ impl Automation {
         Ok(json!({ "path": path, "bytes": signed.len(), "signature": newest.map(|s| self.sig_json(a, &s)).transpose()? }))
     }
 
+    /// `{"image": path}` (PNG or JPEG), `{"text": name}` (typed in the script font) or
+    /// `{"strokes": [[[x, y], …], …]}` (y up; the drawing pad is 1 wide).
+    fn signature_graphic(&self, g: &Value) -> Result<sign::Graphic> {
+        let kinds = "graphic must be an object with exactly one of image (a PNG or JPEG path), text, or strokes";
+        let Some(o) = g.as_object().filter(|o| o.len() == 1) else { return Err(bad(kinds)) };
+        if let Some(path) = o.get("image") {
+            let path = self.resolve(path.as_str().ok_or_else(|| bad("graphic.image must be a path"))?, false)?;
+            let file = std::fs::File::open(&path).map_err(|e| bad(format!("graphic.image {}: {e}", path.display())))?;
+            return Ok(pdfcraft_engine::SignatureImage::read(file).map_err(|e| bad(e.to_string()))?.graphic());
+        }
+        if let Some(text) = o.get("text") {
+            let text = text.as_str().ok_or_else(|| bad("graphic.text must be a string"))?;
+            return pdfcraft_engine::typed_signature_graphic(text).ok_or_else(|| {
+                bad(format!(
+                    "graphic.text {text:?} has nothing the script font can draw (at most {} characters)",
+                    pdfcraft_engine::MAX_SIGNATURE_CHARS
+                ))
+            });
+        }
+        if let Some(strokes) = o.get("strokes") {
+            let strokes: Vec<Vec<[f64; 2]>> =
+                serde_json::from_value(strokes.clone()).map_err(|e| bad(format!("graphic.strokes must be strokes of [x, y] points: {e}")))?;
+            return Ok(sign::Graphic::Strokes(strokes));
+        }
+        Err(bad(kinds))
+    }
+
     pub(crate) fn sign_trust(&mut self, a: &Args) -> Result<Value> {
         let mut certs: Vec<Certificate> =
             if a.opt_bool("clear")?.unwrap_or(false) { Vec::new() } else { self.session.trusted_certificates().to_vec() };
diff --git a/crates/automation/src/tools.rs b/crates/automation/src/tools.rs
index f5771d68..7e5e0267 100644
--- a/crates/automation/src/tools.rs
+++ b/crates/automation/src/tools.rs
@@ -168,10 +168,12 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["doc"],
             )),
-        t("text_find", "Find text", "Find a phrase (case-insensitive, whitespace-normalised) and return each match with its page and line rectangles in points (origin top-left).")
+        t("text_find", "Find text", "Find a phrase (case-insensitive, whitespace-normalised) and return each match, in page order, with its page and line rectangles in points (origin top-left). Pages are read only until the limit is reached.")
             .ro()
             .cmd("edit.find")
-            .with(schema(json!({ "doc": doc(), "query": { "type": "string", "minLength": 1 }, "limit": { "type": "integer", "minimum": 1, "description": "Maximum matches (default 500)." } }), &["doc", "query"])),
+            .with(schema(json!({ "doc": doc(), "query": { "type": "string", "minLength": 1 }, "limit": { "type": "integer", "minimum": 1, "description": "Maximum matches (default 500). The search stops once it has this many; `complete` says whether every match was returned, and when it is false `next` holds the start_page and skip that continue the search." },
+                "start_page": { "type": "integer", "minimum": 1, "description": "Page to start searching from (default 1)." },
+                "skip": { "type": "integer", "minimum": 0, "description": "Matches to pass over on start_page before returning any (default 0)." } }), &["doc", "query"])),
         t("page_rotate", "Rotate pages", "Rotate pages by a multiple of 90 degrees (positive is clockwise): the listed pages (default all), filtered like Acrobat's Rotate Pages by subset (all, even, odd page numbers) and orientation (all, landscape, portrait). Undoable.")
             .cmd("page.rotate")
             .with(schema(
@@ -182,6 +184,18 @@ pub fn tools() -> Vec<ToolDef> {
                 }),
                 &["doc", "degrees"],
             )),
+        t("page_enhance_camera", "Enhance camera image", "Straighten a photographed document (Scan & OCR ▸ Enhance ▸ Camera image): the part of the page inside the four corners (x1, y1, … x4, y4 in top-left-origin points, any order, a convex quadrilateral; when omitted, the document's edges are found automatically, or an error says they could not be) is warped to an upright rectangle that replaces what the page shows, at the page picture's own resolution (at most 600 dpi). mode is how it looks: original, colour (default), greyscale or bw (black and white, stored losslessly). level (0–100, default 0) then cleans the photo up: even lighting so the paper turns white (casts, shadows, dark edges), more contrast, and from 60 no isolated specks; colour ink stays colour. For bw the level is the threshold (higher keeps fainter strokes black). The page's comments, links and bookmarks stay. Undoable.")
+            .cmd("ocr.enhance_camera")
+            .with(schema(
+                json!({
+                    "doc": doc(),
+                    "page": { "type": "integer", "minimum": 1 },
+                    "corners": { "type": "array", "items": { "type": "number" }, "minItems": 8, "maxItems": 8 },
+                    "level": { "type": "integer", "minimum": 0, "maximum": 100 },
+                    "mode": { "type": "string", "enum": ["original", "colour", "greyscale", "bw"] },
+                }),
+                &["doc", "page"],
+            )),
         t("page_delete", "Delete pages", "Delete pages. Undoable until saved.")
             .destructive()
             .cmd("page.delete")
@@ -205,7 +219,7 @@ pub fn tools() -> Vec<ToolDef> {
                 json!({ "doc": doc(), "pages": pages("to extract"), "out": save_out.clone(), "open": open.clone(), "separate": { "type": "boolean" }, "out_dir": { "type": "string" }, "delete": { "type": "boolean" } }),
                 &["doc", "pages"],
             )),
-        t("doc_combine", "Combine files", "Combine PDFs, in order, into one (bookmarks are kept under one entry per file). pages optionally chooses each file's pages, in step with paths: a range such as \"1-3, 6\" or null for all pages. passwords, also in step with paths, opens encrypted files (the open password, or the permissions password where a file's security doesn't allow copying pages; null for none). The result is not encrypted. Passwords are never echoed back. groups, also in step with paths, splits a file around others: entries with the same number (they must name the same path) are one file, copied once, so it keeps one bookmark at its first page, its links and its form fields; null for a file of its own. A group uses its first entry's password.")
+        t("doc_combine", "Combine files", "Combine files, in order, into one PDF (bookmarks are kept under one entry per file). Images (PNG, JPEG, TIFF, GIF, BMP, JPEG 2000) and .txt files are made into PDFs first. pages optionally chooses each file's pages, in step with paths: a range such as \"1-3, 6\" or null for all pages. passwords, also in step with paths, opens encrypted files (the open password, or the permissions password where a file's security doesn't allow copying pages; null for none). The result is not encrypted. Passwords are never echoed back. groups, also in step with paths, splits a file around others: entries with the same number (they must name the same path) are one file, copied once, so it keeps one bookmark at its first page, its links and its form fields; null for a file of its own. A group uses its first entry's password.")
             .cmd("page.combine")
             .with(schema(
                 json!({
@@ -222,7 +236,7 @@ pub fn tools() -> Vec<ToolDef> {
             .cmd("create.multiple")
             .with(schema(
                 json!({
-                    "paths": { "type": "array", "items": { "type": "string" }, "minItems": 1, "maxItems": pdfcraft_engine::MAX_CREATE_FILES },
+                    "paths": { "type": "array", "items": { "type": "string" }, "minItems": 1 },
                     "mode": { "type": "string", "enum": ["combine", "separate"] },
                     "pages": { "type": "array", "items": { "type": ["string", "null"] } },
                     "out": save_out.clone(),
@@ -435,6 +449,13 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["doc"],
         )),
+        t(
+            "doc_audit_redactions",
+            "Audit faux redactions",
+            "Find faux redactions: opaque filled rectangles painted over text that is still extractable, and /Redact annotations that were marked but never applied. Paint-order and colour-aware: a rectangle counts only when painted after the text and dark enough to hide it (page backgrounds and light shading are not flagged). Each finding reports the 1-based page, the kind (covered-text or unapplied-mark), the rectangle, and the hidden text. Fails closed: unreadable content is an error, never a clean bill. A properly applied redaction removes the text and never flags.",
+        )
+        .ro()
+        .with(schema(json!({ "doc": doc() }), &["doc"])),
         t("printers", "List printers", "The printers the system's print spooler knows (CUPS on macOS and Linux), with the default marked.").ro().with(schema(json!({}), &[])),
         t("printer_options", "List printer options", "A printer driver's own job options (CUPS: from its PPD), such as the paper tray, paper type or finishing: key, label, group, default and choices. Pass chosen values to doc_print as options. Empty on Windows, where the driver's preferences window holds them.")
             .ro()
@@ -442,7 +463,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "doc_print",
             "Print",
-            "Print with Acrobat's Print dialog options, or save the print-ready PDF. pages: a range such as \"1-3, 6, 9-\" (page labels allowed; default all); subset odd/even; reverse. layout: fit (default), actual, shrink, custom (scale %), multiple (per_sheet 2/4/6/9/16, order, border, auto_rotate; cut-stack order arranges single-sided sheets for cutting into piles and stacking left to right, top to bottom, keeping sheet order within each pile; duplex must be off), booklet (booklet_subset both/front/back, binding left/right), poster (scale %, overlap pt, cut_marks). orientation auto/portrait/landscape; comments_forms document / document-and-markups (default) / document-and-stamps / form-fields-only; paper Letter/Legal/Tabloid/A3/A4/A5. Then path (save) or printer (a name or \"default\") with copies, collate, duplex off/long-edge/short-edge, grayscale, and options (driver options from printer_options, CUPS).",
+            "Print with Acrobat's Print dialog options, or save the print-ready PDF. pages: a range such as \"1-3, 6, 9-\" (page labels allowed; default all); subset odd/even; reverse. layout: fit (default), actual, shrink, custom (scale %), multiple (per_sheet 2/4/6/9/16, order, border, auto_rotate; cut-stack order arranges single-sided sheets for cutting into piles and stacking left to right, top to bottom, keeping sheet order within each pile; duplex must be off), booklet (booklet_subset both/front/back, binding left/right), poster (scale %, overlap pt, cut_marks). orientation auto/portrait/landscape; comments_forms document / document-and-markups (default) / document-and-stamps / form-fields-only; paper Letter/Legal/Tabloid, ARCH A/B/C/D/E1/E, ANSI C/D/E, or A0/A1/A2/A3/A4/A5 (short names or full preset labels); use layout actual for 100% in the print-ready PDF; printer drivers may still substitute paper or scale. Then path (save) or printer (a name or \"default\") with copies, collate, duplex off/long-edge/short-edge, grayscale, and options (driver options from printer_options, CUPS).",
         )
         .with(schema(
             json!({
@@ -479,7 +500,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "page_add_text",
             "Add text to a page",
-            "Add text as page content (not a comment). Place it with at [x, y] (top-left, points from the top-left of the displayed page) and width (wrap width, default 200), or rect. Newlines start new lines; long lines wrap. Style: font helvetica/times/courier, size, bold, italic, color (#RRGGBB or a name), align left/center/right. It stays editable with content_update. Undoable.",
+            "Add text as page content (not a comment). Place it with at [x, y] (top-left, points from the top-left of the displayed page) and width (wrap width, default 200), or rect. Newlines start new lines; long lines wrap. Style: font helvetica/times/courier, size, bold, italic, color (#RRGGBB or a name), align left/center/right. Text must be Western European (WinAnsi) characters; others are refused. It stays editable with content_update. Undoable.",
         )
         .cmd("edit.text")
         .with(schema(
@@ -644,7 +665,7 @@ pub fn tools() -> Vec<ToolDef> {
             .ro()
             .cmd("sign.digital")
             .with(schema(json!({}), &[])),
-        t("sign_document", "Sign a document", "Sign with a digital ID (a .p12/.pfx path, or on macOS a Keychain identity: \"keychain:<common name or fingerprint>\" from sign_keychain_ids, or on Windows a store identity: \"windows:<common name or fingerprint>\" from sign_windows_ids) and save the signed file to `out` (signing always saves, as in Acrobat; the document then shows the signed file). Sign an existing empty signature field (`field`), or a new one on `page` at `rect` (omit rect for an invisible signature). certify: no_changes, form_fill or comments makes a certification signature. PAdES B-B, SHA-256 (SHA-384 for P-384 keys).")
+        t("sign_document", "Sign a document", "Sign with a digital ID (a .p12/.pfx path, or on macOS a Keychain identity: \"keychain:<common name or fingerprint>\" from sign_keychain_ids, or on Windows a store identity: \"windows:<common name or fingerprint>\" from sign_windows_ids) and save the signed file to `out` (signing always saves, as in Acrobat; the document then shows the signed file). Sign an existing empty signature field (`field`), or a new one on `page` at `rect` (omit rect for an invisible signature). certify: no_changes, form_fill or comments makes a certification signature. graphic shows a picture where the signer's name would be large (Acrobat: Configure Signature Appearance): {\"image\": path} (PNG or JPEG), {\"text\": name} (typed in the Fill & Sign script font) or {\"strokes\": [[[x, y], …], …]} (y up, the drawing pad 1 wide); it needs a visible signature. PAdES B-B, SHA-256 (SHA-384 for P-384 keys).")
             .cmd("sign.digital")
             .with(schema(
                 json!({
@@ -658,6 +679,17 @@ pub fn tools() -> Vec<ToolDef> {
                     "location": { "type": "string" },
                     "contact": { "type": "string" },
                     "certify": { "type": "string", "enum": ["no_changes", "form_fill", "comments"] },
+                    "graphic": {
+                        "type": "object",
+                        "description": "Exactly one of image, text or strokes.",
+                        "properties": {
+                            "image": { "type": "string", "description": "A PNG or JPEG file." },
+                            "text": { "type": "string", "description": "Typed in the script font." },
+                            "strokes": { "type": "array", "items": { "type": "array", "items": { "type": "array", "items": { "type": "number" }, "minItems": 2, "maxItems": 2 } } },
+                        },
+                        "minProperties": 1,
+                        "maxProperties": 1,
+                    },
                     "out": { "type": "string", "description": "Where to save the signed document." },
                 }),
                 &["doc", "id", "out"],
@@ -764,7 +796,7 @@ pub fn tools() -> Vec<ToolDef> {
             }),
             &["doc"],
         )),
-        t("doc_watermark", "Add watermark", "Add a watermark to pages: text, or a picture from `file` (an image, or page `file_page` of a PDF) at `scale` of the page (default 0.5); rotated (degrees counter-clockwise, default 45), semi-transparent (opacity 0–1, default 0.5), text fitted to the page unless font_size is given, on top unless behind: true. replace: true swaps out existing ones. Undoable.")
+        t("doc_watermark", "Add watermark", "Add a watermark to pages: text, or a picture from `file` (an image, or page `file_page` of a PDF) at `scale` of the page (default 0.5); rotated (degrees counter-clockwise, default 45), semi-transparent (opacity 0–1, default 0.5), text fitted to the page unless font_size is given, on top unless behind: true; moved from the page centre by `offset_x` (right) and `offset_y` (up) points (default 0). replace: true swaps out existing ones. Undoable.")
             .cmd("edit.watermark")
             .with(schema(
                 json!({
@@ -779,6 +811,8 @@ pub fn tools() -> Vec<ToolDef> {
                     "opacity": { "type": "number", "minimum": 0, "maximum": 1 },
                     "rotation": { "type": "number" },
                     "behind": { "type": "boolean" },
+                    "offset_x": { "type": "number", "description": "Points right of the page centre (negative: left)." },
+                    "offset_y": { "type": "number", "description": "Points above the page centre (negative: below)." },
                     "replace": { "type": "boolean" },
                 }),
                 &["doc"],
@@ -961,7 +995,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "fill_sign_add",
             "Fill & Sign: type text or place a mark",
-            "Fill in a form that has no fields, as Acrobat's Fill & Sign does: type text (`text`, 10 pt), place a check, cross, dot or line, today's date (in Preferences ▸ Date format, see fill_sign_date_format, or `format`), or a signature or initials (either `text` drawn in a script font, or `path` to a local PNG/JPEG image up to 4 MiB and 4 megapixels, preserving transparency). `at` [x, y] is in points from the top-left of the page: text's top-left, mark's centre, signature's left edge centred vertically. Image signatures fit within 150 pt wide and 32 pt tall (24 pt for initials). Creates movable, undoable annotations.",
+            "Fill in a form that has no fields, as Acrobat's Fill & Sign does: type text (`text`, 10 pt), place a check, cross, dot or line, today's date (in Preferences ▸ Date format, see fill_sign_date_format, or `format`), or a signature or initials (either `text` drawn in a script font, or `path` to a local PNG/JPEG image up to 4 MiB and 32 megapixels, scaled down to 4 megapixels, preserving transparency). `at` [x, y] is in points from the top-left of the page: text's top-left, mark's centre, signature's left edge centred vertically. Image signatures fit within 150 pt wide and 32 pt tall (24 pt for initials). Creates movable, undoable annotations.",
         )
         .cmd("sign.fill.text")
         .with(schema(
@@ -983,7 +1017,7 @@ pub fn tools() -> Vec<ToolDef> {
         t(
             "doc_create",
             "Create a PDF",
-            "Create a new, unsaved document and return it like doc_open: `blank` (pages, width, height in points; default 1 US Letter page), `images` (paths of PNG, JPEG, TIFF (every page), GIF or BMP files, one page each at the image's resolution) or `text` (a .txt path, or `text` directly). Save it with doc_save and a path.",
+            "Create a new, unsaved document and return it like doc_open: `blank` (pages, width, height in points; default 1 US Letter page), `images` (paths of PNG, JPEG, TIFF (every page), GIF or BMP files, one page each at the image's resolution) or `text` (a .txt path, or `text` directly; Western European (WinAnsi) characters only, others are refused). Save it with doc_save and a path.",
         )
         .with(schema(
             json!({
diff --git a/crates/automation/tests/automation.rs b/crates/automation/tests/automation.rs
index 26bc2b26..b07af9a2 100644
--- a/crates/automation/tests/automation.rs
+++ b/crates/automation/tests/automation.rs
@@ -167,6 +167,36 @@ fn edit_undo_redo_and_save_round_trip() {
     assert_eq!(after.windows(5).filter(|w| w == b"%%EOF").count(), 2);
 }
 
+/// #569: images and text files combine with PDFs, each made into a PDF first.
+#[test]
+fn combine_takes_images_and_text_files() {
+    let dir = workdir("combine-images");
+    let mut png = Vec::new();
+    {
+        let mut encoder = png::Encoder::new(&mut png, 4, 2);
+        encoder.set_color(png::ColorType::Rgb);
+        encoder.set_depth(png::BitDepth::Eight);
+        encoder.write_header().unwrap().write_image_data(&[90; 24]).unwrap();
+    }
+    std::fs::write(dir.join("scan.png"), png).unwrap();
+    std::fs::write(dir.join("notes.txt"), "Some notes").unwrap();
+    std::fs::write(dir.join("broken.png"), b"\x89PNG\r\n\x1a\nbroken").unwrap();
+    std::fs::write(dir.join("report.docx"), b"PK\x03\x04").unwrap();
+    let mut a = auto(&dir);
+    let combined = ok(&mut a, "doc_combine", json!({ "paths": ["a.pdf", "scan.png", "notes.txt"], "pages": [null, null, "1"], "open": true }));
+    let doc = combined["document"]["doc"].as_u64().unwrap();
+    assert_eq!(combined["document"]["pages"], 5);
+    assert_eq!(page_text(&mut a, doc), ["Page 1", "Page 2", "Page 3", "", "Some notes"]);
+    let marks = ok(&mut a, "bookmark_list", json!({ "doc": doc }))["bookmarks"].clone();
+    let titles: Vec<&str> = marks.as_array().unwrap().iter().map(|b| b["title"].as_str().unwrap()).collect();
+    assert_eq!(titles, ["a", "scan", "notes"]);
+    // A file that can't be made into a PDF stops the combine, and says which.
+    for bad in ["broken.png", "report.docx"] {
+        let refused = a.call("doc_combine", &json!({ "paths": ["a.pdf", bad] }));
+        assert!(matches!(&refused, Err(ToolError::Failed(e)) if e.contains(bad)), "{bad}: {refused:?}");
+    }
+}
+
 #[test]
 fn combine_extract_and_split() {
     let dir = workdir("organize");
@@ -1154,8 +1184,25 @@ fn protecting_through_tools() {
     assert!(matches!(b.call("page_delete", &json!({ "doc": re, "pages": [1] })), Err(ToolError::Failed(_))));
     assert!(matches!(b.call("doc_unprotect", &json!({ "doc": re })), Err(ToolError::Failed(_))));
     ok(&mut b, "comment_add", json!({ "doc": re, "page": 1, "type": "note", "at": [10, 10], "contents": "allowed" }));
+    // Copying wasn't allowed either (#568): no text or images come out, though search works.
+    for (tool, args) in [
+        ("text_extract", json!({ "doc": re })),
+        ("text_paragraphs", json!({ "doc": re, "page": 1 })),
+        ("doc_export_text", json!({ "doc": re, "path": "out.txt" })),
+        ("doc_export_images", json!({ "doc": re, "folder": "pages" })),
+        ("doc_export_all_images", json!({ "doc": re, "folder": "images" })),
+        ("doc_export_office", json!({ "doc": re, "path": "out.docx" })),
+    ] {
+        match b.call(tool, &args) {
+            Err(ToolError::Failed(m)) => assert!(m.contains("don't allow copying"), "{tool}: {m}"),
+            other => panic!("{tool} is refused: {other:?}"),
+        }
+    }
+    assert!(!dir.join("out.txt").exists() && !dir.join("pages").exists() && !dir.join("out.docx").exists());
+    assert_eq!(ok(&mut b, "text_find", json!({ "doc": re, "query": "Page" }))["count"], 3);
     // With the permissions password everything is possible, including removing security.
     let owner = ok(&mut b, "doc_open", json!({ "path": "locked.pdf", "password": "boss" }))["doc"].as_u64().unwrap();
+    assert!(ok(&mut b, "text_extract", json!({ "doc": owner }))["pages"][0]["text"].as_str().is_some_and(|t| t.contains("Page")));
     assert_eq!(ok(&mut b, "doc_unprotect", json!({ "doc": owner }))["security"]["protected"], false);
     ok(&mut b, "doc_save", json!({ "doc": owner, "path": "open.pdf" }));
     let mut c = auto(&dir);
@@ -1396,6 +1443,40 @@ fn headers_watermarks_and_backgrounds_through_tools() {
     ok(&mut a, "doc_save", json!({ "doc": doc, "path": "marked.pdf" }));
 }
 
+#[test]
+fn watermarks_move_from_the_page_centre_through_tools() {
+    let dir = workdir("wm-offset");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    // The top-left corner of "DRAFT" on page 1, in points (y grows downwards).
+    // Saved and reopened, so the search reads the file as another program would.
+    let mut saved = 0;
+    let mut corner = |a: &mut Automation| -> (f64, f64) {
+        saved += 1;
+        let path = format!("moved{saved}.pdf");
+        ok(a, "doc_save", json!({ "doc": doc, "path": path }));
+        let copy = ok(a, "doc_open", json!({ "path": path }))["doc"].as_u64().unwrap();
+        let found = ok(a, "text_find", json!({ "doc": copy, "query": "DRAFT" }));
+        let rect =
+            found["matches"][0]["rects"][0].as_array().unwrap_or_else(|| panic!("DRAFT is on the page: {found}; text: {:?}", page_text(a, copy)));
+        (rect[0].as_f64().unwrap(), rect[1].as_f64().unwrap())
+    };
+    // Both sit above the fixture's "Page 1" (at the page centre), or their letters would mix.
+    ok(&mut a, "doc_watermark", json!({ "doc": doc, "pages": [1], "text": "DRAFT", "rotation": 0, "font_size": 20, "offset_y": 60 }));
+    let centred = corner(&mut a);
+    ok(
+        &mut a,
+        "doc_watermark",
+        json!({ "doc": doc, "pages": [1], "text": "DRAFT", "rotation": 0, "font_size": 20, "offset_x": 30, "offset_y": 100, "replace": true }),
+    );
+    let moved = corner(&mut a);
+    assert!((moved.0 - centred.0 - 30.0).abs() < 1.0, "right: {centred:?} → {moved:?}");
+    assert!((centred.1 - moved.1 - 40.0).abs() < 1.0, "up is towards the top: {centred:?} → {moved:?}");
+    // Huge offsets are clamped, and a value that isn't a number is refused.
+    ok(&mut a, "doc_watermark", json!({ "doc": doc, "pages": [1], "text": "DRAFT", "offset_y": 1e300, "replace": true }));
+    assert!(matches!(a.call("doc_watermark", &json!({ "doc": doc, "text": "X", "offset_x": "left" })), Err(ToolError::InvalidArgs(_))));
+}
+
 #[test]
 fn exporting_images_and_text_through_tools() {
     let dir = workdir("export");
@@ -1599,6 +1680,66 @@ fn editing_page_images_through_tools() {
     assert!(matches!(a.call("image_edit", &json!({ "doc": made, "page": 1, "image": 1, "action": "delete" })), Err(ToolError::InvalidArgs(_))));
 }
 
+#[test]
+fn enhance_camera_image_through_tools() {
+    let dir = workdir("enhance-camera");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    ok(&mut a, "doc_export_images", json!({ "doc": doc, "folder": "src", "dpi": 72, "pages": [1] }));
+    let photo = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["src/a_page_1.png"] }))["doc"].as_u64().unwrap();
+    // A 200 × 300 pt page at one pixel per point; the corners, in any order, keep a 160 × 240 part.
+    let r = ok(&mut a, "page_enhance_camera", json!({ "doc": photo, "page": 1, "corners": [180, 270, 20, 30, 20, 270, 180, 30] }));
+    assert_eq!(r["undo"], "Enhance camera image");
+    assert_eq!(r["pages"], 1);
+    let images = ok(&mut a, "page_images", json!({ "doc": photo, "page": 1 }));
+    assert_eq!(images["count"], 1);
+    assert_eq!(images["images"][0]["pixels"], json!([160, 240]));
+    assert_eq!(images["images"][0]["rect"], json!([0.0, 0.0, 160.0, 240.0]));
+    for bad in [json!([0, 0, 10, 10, 20, 20, 30, 30]), json!([0, 0, 10]), json!("corners")] {
+        let e = a.call("page_enhance_camera", &json!({ "doc": photo, "page": 1, "corners": bad }));
+        assert!(matches!(e, Err(ToolError::InvalidArgs(_) | ToolError::Failed(_))), "{bad}: {e:?}");
+    }
+    // Without corners on a page with no photo, the edges can't be found: an error that says so.
+    let e = a.call("page_enhance_camera", &json!({ "doc": photo, "page": 1 }));
+    assert!(matches!(&e, Err(ToolError::Failed(m)) if m.contains("corners")), "{e:?}");
+    assert!(matches!(
+        a.call("page_enhance_camera", &json!({ "doc": photo, "page": 9, "corners": [0, 0, 9, 0, 9, 9, 0, 9] })),
+        Err(ToolError::InvalidArgs(_))
+    ));
+}
+
+#[test]
+fn enhance_camera_image_finds_the_edges_by_itself() {
+    let dir = workdir("enhance-camera-auto");
+    // A 600 × 450 photo: a white sheet, tilted, on a dark table.
+    let sheet = [[90.0, 60.0], [500.0, 30.0], [525.0, 405.0], [60.0, 375.0]];
+    let inside = |x: f64, y: f64| {
+        (0..4).all(|i| {
+            let (a, b): ([f64; 2], [f64; 2]) = (sheet[i], sheet[(i + 1) % 4]);
+            (b[0] - a[0]) * (y - a[1]) - (b[1] - a[1]) * (x - a[0]) >= 0.0
+        })
+    };
+    let img = image::RgbImage::from_fn(600, 450, |x, y| {
+        if inside(x as f64 + 0.5, y as f64 + 0.5) { image::Rgb([240, 238, 232]) } else { image::Rgb([70, 60, 50]) }
+    });
+    img.save(dir.join("photo.jpg")).unwrap();
+    let mut a = auto(&dir);
+    let photo = ok(&mut a, "doc_create", json!({ "from": "images", "paths": ["photo.jpg"] }))["doc"].as_u64().unwrap();
+    let r = ok(&mut a, "page_enhance_camera", json!({ "doc": photo, "page": 1 }));
+    assert_eq!(r["detected"], true);
+    assert_eq!(r["undo"], "Enhance camera image");
+    // A clean-up level outside 0–100 is refused before anything changes.
+    let e = a.call("page_enhance_camera", &json!({ "doc": photo, "page": 1, "corners": [0, 0, 100, 0, 100, 100, 0, 100], "level": 101 }));
+    assert!(matches!(&e, Err(ToolError::InvalidArgs(m)) if m.contains("level")), "{e:?}");
+    ok(&mut a, "page_enhance_camera", json!({ "doc": photo, "page": 1, "corners": [0, 0, 100, 0, 100, 100, 0, 100], "level": 80 }));
+    // One point per pixel: the corners it used are the sheet's.
+    let used: Vec<f64> = r["corners"].as_array().unwrap().iter().map(|v| v.as_f64().unwrap()).collect();
+    for (k, p) in sheet.iter().enumerate() {
+        let (x, y) = (used[2 * k], used[2 * k + 1]);
+        assert!((x - p[0]).hypot(y - p[1]) < 4.0, "{used:?} vs {sheet:?}");
+    }
+}
+
 #[test]
 fn editing_form_artwork_through_tools() {
     use pdfcraft_cos::{Dict, Document, Object, SaveOptions, Stream, write_incremental};
@@ -1881,6 +2022,26 @@ fn creating_and_reducing_through_tools() {
     assert!(matches!(a.call("doc_create", &json!({ "from": "images", "paths": ["notes.txt"] })), Err(ToolError::Failed(_))));
 }
 
+#[test]
+fn creating_from_text_refuses_what_the_font_cannot_draw() {
+    let dir = workdir("create-undrawable");
+    std::fs::write(dir.join("kr.txt"), "ABC 제안서 시험").unwrap();
+    let mut a = auto(&dir);
+    let refused = |r: Result<Vec<Content>, ToolError>| match r {
+        Err(ToolError::InvalidArgs(m) | ToolError::Failed(m)) => assert!(m.contains("U+C81C"), "{m}"),
+        other => panic!("expected a refusal, got {other:?}"),
+    };
+    assert!(matches!(a.call("doc_create", &json!({ "from": "text", "text": "ABC 제안서 시험" })), Err(ToolError::InvalidArgs(_))));
+    refused(a.call("doc_create", &json!({ "from": "text", "text": "ABC 제안서 시험" })));
+    refused(a.call("doc_create", &json!({ "from": "text", "path": "kr.txt" })));
+    // WinAnsi characters, line breaks and tabs are still fine.
+    let d = ok(&mut a, "doc_create", json!({ "from": "text", "text": "Price: 5 € at café\r\n\tnext\u{c}page two" }))["doc"].as_u64().unwrap();
+    assert_eq!(page_text(&mut a, d).len(), 2);
+    // #959: page_add_text refuses it too.
+    let doc = ok(&mut a, "doc_create", json!({ "from": "blank" }))["doc"].as_u64().unwrap();
+    refused(a.call("page_add_text", &json!({ "doc": doc, "page": 1, "text": "ABC 제안서 시험", "at": [20, 20] })));
+}
+
 #[test]
 fn creating_from_multiple_files_through_tools() {
     let dir = workdir("create-multiple");
@@ -1937,6 +2098,17 @@ fn creating_from_multiple_files_through_tools() {
     assert!(!dir.join("out/a.pdf").exists());
 }
 
+#[test]
+fn create_multiple_has_no_file_count_limit() {
+    let dir = workdir("create-many");
+    let mut a = auto(&dir);
+    // The same 3-page PDF listed 1,001 times: every listed file is a source, however many there are.
+    let paths = vec!["a.pdf"; 1001];
+    let made = ok(&mut a, "doc_create_multiple", json!({ "paths": paths, "out": "many.pdf", "open": true }));
+    assert_eq!(made["document"]["pages"], 3 * 1001, "{made}");
+    assert!(dir.join("many.pdf").is_file());
+}
+
 #[test]
 fn creating_images_with_dpi_through_tools() {
     let dir = workdir("image-dpi");
@@ -2198,6 +2370,50 @@ fn removing_hidden_information_through_tools() {
     assert!(matches!(a.call("doc_remove_hidden", &json!({ "doc": doc, "categories": ["nonsense"] })), Err(ToolError::InvalidArgs(_))));
 }
 
+/// A one-page PDF whose text "TOP SECRET" sits under an opaque black rectangle.
+fn faux_redacted_fixture() -> Vec<u8> {
+    let body = "BT /F1 24 Tf 100 700 Td (TOP SECRET) Tj ET\n0 g\n90 688 220 32 re f";
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [4 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".to_vec(),
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 5 0 R /Resources << /Font << /F1 3 0 R >> >> >>".to_string().into_bytes(),
+        format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()).into_bytes(),
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+#[test]
+fn auditing_faux_redactions_through_tools() {
+    let dir = workdir("audit-redactions");
+    std::fs::write(dir.join("redacted.pdf"), faux_redacted_fixture()).unwrap();
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "redacted.pdf" }))["doc"].as_u64().unwrap();
+    let r = ok(&mut a, "doc_audit_redactions", json!({ "doc": doc }));
+    assert_eq!(r["count"], 1, "{r}");
+    let f = &r["findings"][0];
+    assert_eq!(f["page"], 1);
+    assert_eq!(f["kind"], "covered-text");
+    assert!(f["covered_text"].as_str().unwrap().contains("TOP SECRET"), "{f}");
+    // A clean document audits clean.
+    let clean = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    assert_eq!(ok(&mut a, "doc_audit_redactions", json!({ "doc": clean }))["count"], 0);
+}
+
 #[test]
 fn printing_through_tools() {
     let dir = workdir("print");
@@ -2815,6 +3031,74 @@ fn drawing_comments_through_tools() {
     assert!(matches!(png[0], Content::Png { .. }));
 }
 
+#[test]
+fn signing_with_an_image_typed_or_drawn_graphic_through_tools() {
+    let dir = workdir("signing-graphic");
+    // A solid red 120 x 40 picture.
+    let mut png = Vec::new();
+    {
+        let mut encoder = png::Encoder::new(&mut png, 120, 40);
+        encoder.set_color(png::ColorType::Rgba);
+        encoder.set_depth(png::BitDepth::Eight);
+        let rgba: Vec<u8> = (0..120 * 40).flat_map(|_| [220, 0, 0, 255]).collect();
+        encoder.write_header().unwrap().write_image_data(&rgba).unwrap();
+    }
+    std::fs::write(dir.join("logo.png"), png).unwrap();
+    std::fs::write(dir.join("broken.png"), b"broken").unwrap();
+    let mut a = auto(&dir);
+    ok(&mut a, "sign_id_create", json!({ "name": "Ada Lovelace", "key": "p256", "password": "secret1", "path": "ada.p12" }));
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let sign = |a: &mut Automation, rect: [f64; 4], graphic: Value, out: &str| {
+        a.call(
+            "sign_document",
+            &json!({ "doc": doc, "id": "ada.p12", "password": "secret1", "page": 1, "rect": rect, "graphic": graphic, "out": out }),
+        )
+    };
+    for (graphic, why) in [
+        (json!({ "image": "logo.png", "text": "Ada" }), "two kinds"),
+        (json!({}), "no kind"),
+        (json!({ "picture": "logo.png" }), "unknown key"),
+        (json!("logo.png"), "not an object"),
+        (json!({ "image": "broken.png" }), "not an image"),
+        (json!({ "text": "   " }), "nothing to draw"),
+        (json!({ "strokes": [[[0, 0], ["x", 1]]] }), "malformed strokes"),
+        (json!({ "strokes": [] }), "empty strokes"),
+    ] {
+        let r = sign(&mut a, [20.0, 200.0, 180.0, 250.0], graphic, "bad.pdf");
+        assert!(matches!(r, Err(ToolError::InvalidArgs(_))), "{why}: {r:?}");
+    }
+    // A missing file fails as it does for every tool that reads one.
+    assert!(matches!(sign(&mut a, [20.0, 200.0, 180.0, 250.0], json!({ "image": "missing.png" }), "bad.pdf"), Err(ToolError::Failed(_))));
+    // An invisible signature shows nothing, so a graphic for one is a mistake.
+    let r = a.call("sign_document", &json!({ "doc": doc, "id": "ada.p12", "password": "secret1", "graphic": { "text": "Ada" }, "out": "bad.pdf" }));
+    assert!(matches!(r, Err(ToolError::InvalidArgs(_))), "{r:?}");
+    assert!(!dir.join("bad.pdf").exists());
+
+    // Image, typed and drawn graphics, each a signature of its own, all intact.
+    sign(&mut a, [20.0, 200.0, 180.0, 250.0], json!({ "image": "logo.png" }), "s1.pdf").unwrap();
+    sign(&mut a, [20.0, 130.0, 180.0, 180.0], json!({ "text": "Ada Lovelace" }), "s2.pdf").unwrap();
+    sign(&mut a, [20.0, 60.0, 180.0, 110.0], json!({ "strokes": [[[0, 0], [0.3, 0.2], [0.6, 0], [1, 0.2]]] }), "s3.pdf").unwrap();
+    let list = ok(&mut a, "sign_list", json!({ "doc": doc }));
+    assert_eq!(list["count"], 3);
+    for s in list["signatures"].as_array().unwrap() {
+        assert_eq!((s["status"].as_str(), s["visible"].as_bool()), (Some("unknown"), Some(true)), "{s}");
+    }
+    // At 72 dpi a pixel is a point. Each graphic is in the left half of its box (x 23–97), the
+    // details on the right.
+    let png = a.call("page_render", &json!({ "doc": doc, "page": 1, "dpi": 72 })).unwrap();
+    let Content::Png { data, width, .. } = &png[0] else { panic!("expected an image") };
+    let mut reader = png::Decoder::new(std::io::Cursor::new(data.as_slice())).read_info().unwrap();
+    let mut buf = vec![0; reader.output_buffer_size().unwrap()];
+    let frame = reader.next_frame(&mut buf).unwrap();
+    let channels = frame.line_size / *width as usize;
+    let px = |x: usize, y: usize| buf[y * frame.line_size + x * channels..][..3].to_vec();
+    assert_eq!(px(60, 225), [220, 0, 0], "the image fills the left half's middle");
+    assert_ne!(px(150, 225), [220, 0, 0], "and not the details");
+    let inked = |y0: usize, y1: usize| (y0..y1).any(|y| (23..97).any(|x| px(x, y).iter().all(|c| *c < 100)));
+    assert!(inked(130, 180), "the typed name is drawn");
+    assert!(inked(60, 110), "the strokes are drawn");
+}
+
 #[test]
 fn digital_ids_signing_and_validation_through_tools() {
     let dir = workdir("signing");
@@ -3917,3 +4201,51 @@ fn text_extract_with_a_rect_takes_one_column() {
         assert!(matches!(e, ToolError::InvalidArgs(_)), "{bad}: {e}");
     }
 }
+
+/// Independent inch/mm dimensions, checked in the saved file through the tool path.
+#[test]
+fn architectural_and_iso_papers_through_tools() {
+    let dir = workdir("plotter-papers");
+    let mut a = auto(&dir);
+    let doc = ok(&mut a, "doc_open", json!({ "path": "a.pdf" }))["doc"].as_u64().unwrap();
+    let mm = 72.0 / 25.4;
+    for (name, w, h) in [
+        ("ARCH A", 9.0 * 72.0, 12.0 * 72.0),
+        ("arch b", 12.0 * 72.0, 18.0 * 72.0),
+        ("ARCH C", 18.0 * 72.0, 24.0 * 72.0),
+        ("ARCH D", 24.0 * 72.0, 36.0 * 72.0),
+        ("ARCH E1", 30.0 * 72.0, 42.0 * 72.0),
+        ("ARCH E (36 x 48 in)", 36.0 * 72.0, 48.0 * 72.0),
+        ("ANSI C", 17.0 * 72.0, 22.0 * 72.0),
+        ("ANSI D", 22.0 * 72.0, 34.0 * 72.0),
+        ("ANSI E", 34.0 * 72.0, 44.0 * 72.0),
+        ("A2", 420.0 * mm, 594.0 * mm),
+        ("A1", 594.0 * mm, 841.0 * mm),
+        ("A0", 841.0 * mm, 1189.0 * mm),
+        ("Letter", 612.0, 792.0),
+        ("US Legal", 612.0, 1008.0),
+        ("Tabloid", 792.0, 1224.0),
+    ] {
+        for orientation in ["portrait", "landscape"] {
+            let out = ok(
+                &mut a,
+                "doc_print",
+                json!({"doc": doc, "pages": "1", "paper": name,
+                "layout": "actual", "orientation": orientation, "path": "plot.pdf"}),
+            );
+            assert_eq!(out["sheets"], 1);
+            let bytes = std::fs::read(dir.join("plot.pdf")).unwrap();
+            let saved = pdfcraft_cos::Document::open(std::sync::Arc::new(bytes)).unwrap();
+            let pages = pdfcraft_model::pages(&saved);
+            assert_eq!(pages.len(), 1);
+            let (ew, eh) = if orientation == "landscape" { (h, w) } else { (w, h) };
+            let (aw, ah) = pages[0].display_size(&saved);
+            assert!((aw - ew).abs() < 0.02 && (ah - eh).abs() < 0.02, "{name} {orientation}: {aw} x {ah}");
+        }
+    }
+    let before = std::fs::read(dir.join("plot.pdf")).unwrap();
+    let bad = a.call("doc_print", &json!({"doc": doc, "paper": "ARCH Z", "path": "plot.pdf"}));
+    assert!(matches!(bad, Err(ToolError::InvalidArgs(m)) if m.contains("ARCH E1") && m.contains("A0")));
+    assert_eq!(std::fs::read(dir.join("plot.pdf")).unwrap(), before);
+    assert!(a.call("doc_print", &json!({"doc": doc, "paper": "ARCH D", "path": "../escape.pdf"})).is_err());
+}
diff --git a/crates/automation/tests/hostile_args.rs b/crates/automation/tests/hostile_args.rs
index 08b51b6a..60769689 100644
--- a/crates/automation/tests/hostile_args.rs
+++ b/crates/automation/tests/hostile_args.rs
@@ -81,8 +81,9 @@ fn zoo() -> Vec<Value> {
 
 /// Paths that must never resolve inside the root. Absolute ones point into the test's own temp
 /// `base` (the root's parent), never at real system files or network shares, so a confinement
-/// bug can only touch what the test made.
-fn escapes(base: &std::path::Path) -> Vec<String> {
+/// bug can only touch what the test made. `linked`: the root holds `link-out`, a symbolic link
+/// to `base`.
+fn escapes(base: &std::path::Path, linked: bool) -> Vec<String> {
     let mut out: Vec<String> = vec![
         "../outside.pdf".into(),
         "../../outside.pdf".into(),
@@ -92,8 +93,10 @@ fn escapes(base: &std::path::Path) -> Vec<String> {
         base.join("outside.pdf").to_string_lossy().into_owned(),
         base.join("new-outside.pdf").to_string_lossy().into_owned(),
         base.join("sub").join("new-outside.pdf").to_string_lossy().into_owned(),
-        "link-out/outside.pdf".into(), // through a planted symbolic link, when the system allows one
     ];
+    if linked {
+        out.push("link-out/outside.pdf".into());
+    }
     // Backslashes separate only on Windows; elsewhere this is an ordinary file name in the root.
     if cfg!(windows) {
         out.push(r"..\..\outside.pdf".into());
@@ -101,6 +104,23 @@ fn escapes(base: &std::path::Path) -> Vec<String> {
     out
 }
 
+/// A symbolic link to a folder, where the system allows one (Windows needs Developer Mode or an
+/// administrator for it, #948).
+fn dir_symlink(target: &std::path::Path, link: &std::path::Path) -> std::io::Result<()> {
+    #[cfg(unix)]
+    {
+        std::os::unix::fs::symlink(target, link)
+    }
+    #[cfg(windows)]
+    {
+        std::os::windows::fs::symlink_dir(target, link)
+    }
+    #[cfg(not(any(unix, windows)))]
+    {
+        Err(std::io::Error::other(format!("no symbolic links here: {} {}", target.display(), link.display())))
+    }
+}
+
 /// The properties of `def` whose values are paths, by name and whether they are a list.
 fn path_props(def: &pdfcraft_automation::ToolDef) -> Vec<(String, bool)> {
     let Some(props) = def.input_schema["properties"].as_object() else { return Vec::new() };
@@ -223,11 +243,15 @@ fn no_tool_escapes_the_root() {
     .expect("outside file");
     let before = listing(&base);
 
-    // A link inside the root pointing out of it, where the system allows one to be made.
-    #[cfg(unix)]
-    let _ = std::os::unix::fs::symlink(&base, root.join("link-out"));
-    #[cfg(windows)]
-    let _ = std::os::windows::fs::symlink_dir(&base, root.join("link-out"));
+    // A link inside the root pointing out of it, where the system allows one to be made. Without
+    // it `link-out/…` is an ordinary path inside the root, which tools that write rightly accept.
+    let linked = match dir_symlink(&base, &root.join("link-out")) {
+        Ok(()) => true,
+        Err(e) => {
+            eprintln!("escapes through a symbolic link not checked: {e}");
+            false
+        }
+    };
 
     let mut a = Automation::new().with_root(&root).expect("root");
 
@@ -247,7 +271,7 @@ fn no_tool_escapes_the_root() {
 
     for def in tools() {
         for (prop, is_list) in path_props(&def) {
-            for escape in escapes(&base) {
+            for escape in escapes(&base, linked) {
                 let mut obj = plausible_with(&def, Some(doc));
                 obj.insert(prop.clone(), if is_list { json!([escape]) } else { json!(escape) });
                 let args = Value::Object(obj);
diff --git a/crates/cos/src/document.rs b/crates/cos/src/document.rs
index e2c2b219..6938f82b 100644
--- a/crates/cos/src/document.rs
+++ b/crates/cos/src/document.rs
@@ -145,6 +145,8 @@ impl ObjectReader {
 
     pub(crate) fn try_get(&mut self, reference: ObjRef) -> Result<Arc<Object>, CosError> {
         let object = self.document.try_get(reference.num);
+        // A missed eviction here only costs a re-parse, so never fail the read on a poisoned
+        // lock. The editing-cache evictors propagate instead; they guard user edits.
         if let Ok(mut streams) = self.document.objstms.lock() {
             // Only insertion changes this private cache between reads. Most neighboring
             // objects reuse a decoded stream: do not sum the whole store for every object.
@@ -355,10 +357,7 @@ impl Document {
             return Ok(());
         };
         let params = crate::security::encrypt_dict(self, &dict);
-        let id0 = match self.trailer.get(b"ID") {
-            Some(Object::Array(a)) => a.first().and_then(|s| s.as_string()).map(|s| s.bytes.clone()).unwrap_or_default(),
-            _ => Vec::new(),
-        };
+        let id0 = self.first_id();
         let handler = pdfcraft_crypt::SecurityHandler::open(params, &id0, password).map_err(|e| match e {
             pdfcraft_crypt::CryptError::WrongPassword if password.is_none() => CosError::NeedsPassword,
             pdfcraft_crypt::CryptError::WrongPassword => CosError::WrongPassword,
@@ -372,6 +371,31 @@ impl Document {
         Ok(())
     }
 
+    /// The first file identifier, part of the encryption key (empty when there is none).
+    fn first_id(&self) -> Vec<u8> {
+        match self.trailer.get(b"ID") {
+            Some(Object::Array(a)) => a.first().and_then(|s| s.as_string()).map(|s| s.bytes.clone()).unwrap_or_default(),
+            _ => Vec::new(),
+        }
+    }
+
+    /// Lift the restrictions of a document opened with its user password by entering the
+    /// owner (permissions) password (§7.6.4). Fails with `WrongPassword` for any other
+    /// password. Does nothing when the document is unencrypted or already opened as owner.
+    /// Both passwords unlock the same file key, so nothing read so far is decoded again.
+    pub fn unlock(&mut self, password: &str) -> Result<(), CosError> {
+        let Some(current) = self.security.as_deref() else { return Ok(()) };
+        if current.auth() == pdfcraft_crypt::Auth::Owner {
+            return Ok(());
+        }
+        let owner = current.authenticate_owner(&self.first_id(), password).map_err(|e| match e {
+            pdfcraft_crypt::CryptError::WrongPassword => CosError::WrongPassword,
+            other => CosError::Security(other.to_string()),
+        })?;
+        self.security = Some(Arc::new(owner));
+        Ok(())
+    }
+
     /// The security handler, when the document is encrypted.
     pub fn security(&self) -> Option<&pdfcraft_crypt::SecurityHandler> {
         self.security.as_deref()
@@ -607,10 +631,81 @@ impl Document {
             LoadGuard::enter(num).ok_or_else(|| CosError::Syntax { offset: 0, detail: format!("reference cycle while loading object {num}") })?;
         let obj = self.load(num, 0)?;
         let obj = Arc::new(obj);
+        // The editing cache is bounded like the scan reader's: re-parsing a file-backed view
+        // is cheap, and returned objects outlive eviction.
         self.cache.lock().map_err(|_| CosError::Poisoned)?.insert(num, obj.clone());
+        self.evict_editor_cache_if_over_budget(num, &obj)?;
         Ok(obj)
     }
 
+    /// Bounds for the editing cache: roomier than the scan reader's (128 objects / 8 MB)
+    /// so interactive editing does not thrash, but still capped so touching a large
+    /// document cannot pin its whole object graph. Only owned (decrypted/copied) bytes
+    /// count; file-backed views re-parse for free.
+    ///
+    /// Worst case per document: input bytes + up to `EDITOR_CACHE_OBJECTS` ×
+    /// `EDITOR_LARGE_OBJECT` (1024 × 256 KB = 256 MB) of small objects between full
+    /// accounting passes + `EDITOR_OBJSTM_BYTES` (32 MB) + unsaved `overlay` edits.
+    /// The count cap always holds; byte accounting between passes is approximate.
+    /// Clones share these caches, so one clone's eviction drops another's hot set;
+    /// that only costs re-parsing, never correctness. Eviction keeps just the newcomer:
+    /// file-backed views re-parse cheaply and editor working sets stay far below 1024.
+    const EDITOR_CACHE_OBJECTS: usize = 1024;
+    const EDITOR_CACHE_BYTES: usize = 32 * 1024 * 1024;
+    /// Object streams decode to megabytes each, so fewer are kept than plain objects.
+    const EDITOR_OBJSTM_OBJECTS: usize = 256;
+    const EDITOR_OBJSTM_BYTES: usize = 32 * 1024 * 1024;
+    /// Newcomers above this force a full accounting pass even below the count cap:
+    /// `EDITOR_CACHE_BYTES / 128`, so 128 large newcomers always trigger a pass before the
+    /// byte budget can double.
+    const EDITOR_LARGE_OBJECT: usize = 256 * 1024;
+
+    fn evict_editor_cache_if_over_budget(&self, fresh_num: u32, fresh: &Object) -> Result<(), CosError> {
+        // Fast path: the full fold is O(cache) per insert, so skip it for a small newcomer
+        // below the count cap. `len` is copied out first; nothing here holds the lock.
+        let len = self.cache.lock().map_err(|_| CosError::Poisoned)?.len();
+        if len <= Self::EDITOR_CACHE_OBJECTS && owned_bytes(fresh, &self.data, 0) <= Self::EDITOR_LARGE_OBJECT {
+            return Ok(());
+        }
+        // Walk a snapshot off-lock; re-lock only to evict.
+        let live: Vec<(u32, Arc<Object>)> = self.cache.lock().map_err(|_| CosError::Poisoned)?.iter().map(|(n, o)| (*n, o.clone())).collect();
+        let data = &self.data;
+        let owned: usize = live.iter().fold(0usize, |n, (_, o)| n.saturating_add(owned_bytes(o, data, 0)));
+        if live.len() <= Self::EDITOR_CACHE_OBJECTS && owned <= Self::EDITOR_CACHE_BYTES {
+            return Ok(());
+        }
+        // Re-check under the final lock: another thread may have inserted or evicted since
+        // the snapshot. Keep its newcomers, and skip the eviction if back within budget.
+        let snapshot: std::collections::HashSet<u32> = live.into_iter().map(|(n, _)| n).collect();
+        let mut cache = self.cache.lock().map_err(|_| CosError::Poisoned)?;
+        if cache.len() <= Self::EDITOR_CACHE_OBJECTS {
+            let data = &self.data;
+            let owned: usize = cache.values().fold(0usize, |n, o| n.saturating_add(owned_bytes(o, data, 0)));
+            if owned <= Self::EDITOR_CACHE_BYTES {
+                return Ok(());
+            }
+        }
+        cache.retain(|n, _| *n == fresh_num || !snapshot.contains(n));
+        Ok(())
+    }
+
+    fn evict_editor_streams_if_over_budget(&self, current: u32) -> Result<(), CosError> {
+        // The caller inserts `current` first, so retaining it keeps a live entry.
+        let over = {
+            let streams = self.objstms.lock().map_err(|_| CosError::Poisoned)?;
+            let bytes = streams.values().fold(0usize, |bytes, stream| {
+                bytes
+                    .saturating_add(stream.data.capacity())
+                    .saturating_add(stream.index.capacity().saturating_mul(std::mem::size_of::<(u32, usize)>()))
+            });
+            bytes > Self::EDITOR_OBJSTM_BYTES || streams.len() > Self::EDITOR_OBJSTM_OBJECTS
+        };
+        if over {
+            self.objstms.lock().map_err(|_| CosError::Poisoned)?.retain(|n, _| *n == current);
+        }
+        Ok(())
+    }
+
     /// Visit every current object without filling this document's editing cache.
     ///
     /// Full-document searches (for example, standalone timestamps) need to inspect objects
@@ -720,7 +815,10 @@ impl Document {
             index.push((onum.max(0) as u32, first + off.max(0) as usize));
         }
         let stm = Arc::new(ObjStm { index, data: Arc::new(data) });
+        // Same bound as the object cache: decoded object streams can be megabytes each.
+        // Insert first so the retained `num` is actually in the map.
         self.objstms.lock().map_err(|_| CosError::Poisoned)?.insert(num, stm.clone());
+        self.evict_editor_streams_if_over_budget(num)?;
         Ok(stm)
     }
 
@@ -1361,6 +1459,74 @@ mod tests {
         }
     }
 
+    #[test]
+    fn editor_cache_stays_bounded() {
+        let mut source = Document::new_empty();
+        let objects: Vec<_> = (0..(Document::EDITOR_CACHE_OBJECTS + 64))
+            .map(|i| {
+                let mut value = vec![b'x'; 1024];
+                value[..4].copy_from_slice(&(i as u32).to_le_bytes());
+                Object::Ref(source.add(Object::String(crate::PdfString::literal(value))))
+            })
+            .collect();
+        source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
+        let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
+        let doc = Document::open(bytes).unwrap();
+        let root = doc.get(doc.root().unwrap());
+        let references = root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap().clone();
+        let mut held = None;
+        for (i, reference) in references.iter().enumerate() {
+            let Object::Ref(reference) = reference else { panic!("indirect object") };
+            let object = doc.get(*reference);
+            assert_eq!(&object.as_string().unwrap().bytes[..4], &(i as u32).to_le_bytes());
+            if i == 0 {
+                held = Some(object);
+            }
+            assert!(doc.cache.lock().unwrap().len() <= Document::EDITOR_CACHE_OBJECTS, "editing must not pin the whole object graph");
+            // Eviction keeps the newcomer.
+            assert!(doc.cache.lock().unwrap().contains_key(&reference.num), "eviction must keep the newcomer");
+        }
+        // Returned objects survive eviction, through both handles of the shared cache.
+        assert_eq!(&held.unwrap().as_string().unwrap().bytes[..4], &0u32.to_le_bytes());
+        let snapshot = doc.clone();
+        let first = references[0].as_ref().unwrap();
+        assert_eq!(&snapshot.get(first).as_string().unwrap().bytes[..4], &0u32.to_le_bytes());
+    }
+
+    #[test]
+    fn editor_cache_byte_bound_fires() {
+        // 40 × 1 MB strings: far below the count cap, above the 32 MB byte budget. Each
+        // newcomer exceeds EDITOR_LARGE_OBJECT, so every insert takes a full accounting pass.
+        let mut source = Document::new_empty();
+        let objects: Vec<_> = (0..40)
+            .map(|i| {
+                let mut value = vec![b'y'; 1024 * 1024];
+                value[..4].copy_from_slice(&(i as u32).to_le_bytes());
+                Object::Ref(source.add(Object::String(crate::PdfString::literal(value))))
+            })
+            .collect();
+        source.update_dict(source.root().unwrap(), |d| d.set(b"Extension".to_vec(), Object::Array(objects))).unwrap();
+        let bytes = Arc::new(crate::write_full(&source, &crate::SaveOptions::default()).unwrap());
+        let doc = Document::open(bytes).unwrap();
+        let root = doc.get(doc.root().unwrap());
+        let references = root.as_dict().unwrap().get(b"Extension").unwrap().as_array().unwrap().clone();
+        let mut held = None;
+        for (i, reference) in references.iter().enumerate() {
+            let Object::Ref(reference) = reference else { panic!("indirect object") };
+            let object = doc.get(*reference);
+            assert_eq!(&object.as_string().unwrap().bytes[..4], &(i as u32).to_le_bytes());
+            if i == 0 {
+                held = Some(object);
+            }
+            // Eviction keeps the newcomer.
+            assert!(doc.cache.lock().unwrap().contains_key(&reference.num), "eviction must keep the newcomer");
+        }
+        assert!(doc.cache.lock().unwrap().len() < references.len(), "the byte budget must evict even below the count cap");
+        let last = references[references.len() - 1].as_ref().unwrap();
+        assert!(doc.cache.lock().unwrap().contains_key(&last.num), "eviction must keep the newcomer");
+        assert_eq!(&held.unwrap().as_string().unwrap().bytes[..4], &0u32.to_le_bytes());
+    }
+
     #[test]
     fn a_stream_limited_document_cannot_be_saved() {
         let bytes = Arc::new(crate::write_full(&Document::new_empty(), &crate::SaveOptions::default()).unwrap());
diff --git a/crates/cos/src/object.rs b/crates/cos/src/object.rs
index 7053fd2f..dc7648d4 100644
--- a/crates/cos/src/object.rs
+++ b/crates/cos/src/object.rs
@@ -230,6 +230,17 @@ impl Stream {
         pdfcraft_filters::decode(&chain, &self.raw, MAX_DECODED).map_err(|e| CosError::Filter(e.to_string()))
     }
 
+    /// Data after the first filter alone, bounded by `max`: the rest of the chain stays encoded.
+    /// Any corruption in that first filter is an error.
+    pub fn decoded_first_filter_strict(&self, max: usize) -> Result<Vec<u8>, CosError> {
+        let mut chain = self.filters();
+        chain.truncate(1);
+        if chain.is_empty() {
+            return self.raw_within(max);
+        }
+        pdfcraft_filters::decode(&chain, &self.raw, max.min(MAX_DECODED)).map_err(|e| CosError::Filter(e.to_string()))
+    }
+
     fn raw_within(&self, max: usize) -> Result<Vec<u8>, CosError> {
         let max = max.min(MAX_DECODED);
         // An empty decoder chain still produces an owned output buffer: check its limit
@@ -470,4 +481,20 @@ mod tests {
         assert_eq!(stream.decoded_within(3).unwrap(), b"abc");
         assert_eq!(stream.decoded_strict().unwrap(), b"abc");
     }
+
+    #[test]
+    fn first_filter_decodes_only_the_outer_wrapper() {
+        let data = "0 0 m 100 100 l S\n".repeat(64).into_bytes();
+        let inner = Stream::flate(Dict::new(), &data).raw.to_vec();
+        for (outer, name, corrupt) in [(Filter::Ascii85, "ASCII85Decode", &b"{~>"[..]), (Filter::AsciiHex, "ASCIIHexDecode", &b"G0>"[..])] {
+            let encoded = pdfcraft_filters::encode(&outer, &Params::default(), &inner).unwrap();
+            let mut dict = Dict::new();
+            dict.set(b"Filter".to_vec(), Object::Array(vec![Object::name(name), Object::name("FlateDecode")]));
+            let stream = Stream::from_raw(dict.clone(), encoded);
+            assert_eq!(stream.decoded_first_filter_strict(usize::MAX).unwrap(), inner);
+            assert_eq!(stream.decoded_strict().unwrap(), data);
+            assert!(matches!(stream.decoded_first_filter_strict(inner.len() - 1), Err(CosError::Filter(_))));
+            assert!(matches!(Stream::from_raw(dict, corrupt.to_vec()).decoded_first_filter_strict(usize::MAX), Err(CosError::Filter(_))));
+        }
+    }
 }
diff --git a/crates/cos/tests/encryption.rs b/crates/cos/tests/encryption.rs
index 8f4ee124..6868a6dc 100644
--- a/crates/cos/tests/encryption.rs
+++ b/crates/cos/tests/encryption.rs
@@ -102,6 +102,36 @@ fn empty_user_password_opens_but_reports_restrictions() {
     assert!(Document::open(Arc::new(fixture())).unwrap().permissions().is_none(), "unencrypted: no restrictions");
 }
 
+#[test]
+fn the_permissions_password_unlocks_an_open_document() {
+    for alg in ALL {
+        // Only a permissions password: opens without asking, restricted (#995).
+        let mut doc = Document::open(Arc::new(protect(alg, "", "perms", 0b0100))).unwrap();
+        // Read something before unlocking: it must stay readable afterwards.
+        assert_eq!(content(&doc), SECRET, "{alg:?}");
+        assert_eq!(doc.unlock("").unwrap_err(), CosError::WrongPassword, "{alg:?}");
+        assert_eq!(doc.unlock("nope").unwrap_err(), CosError::WrongPassword, "{alg:?}");
+        assert!(!doc.permissions().unwrap().modify(), "{alg:?}: still restricted");
+        doc.unlock("perms").unwrap();
+        assert_eq!(doc.security().unwrap().auth(), Auth::Owner, "{alg:?}");
+        assert!(doc.permissions().unwrap().modify(), "{alg:?}");
+        assert_eq!(content(&doc), SECRET, "{alg:?}");
+        assert_eq!(title(&doc).as_deref(), Some("Quarterly numbers"), "{alg:?}");
+        // Unlocked, security can be removed.
+        doc.remove_encryption();
+        let plain = write_full(&doc, &SaveOptions::default()).unwrap();
+        assert!(Document::open(Arc::new(plain)).unwrap().security().is_none(), "{alg:?}");
+    }
+    // Opened with a separate open password: that password doesn't unlock.
+    let mut doc = Document::open_with_password(Arc::new(protect(Algorithm::Aes256, "open", "perms", 0b0100)), Some("open")).unwrap();
+    assert_eq!(doc.unlock("open").unwrap_err(), CosError::WrongPassword);
+    doc.unlock("perms").unwrap();
+    assert!(doc.permissions().unwrap().modify());
+    // Nothing to unlock: unencrypted, or already the owner.
+    Document::open(Arc::new(fixture())).unwrap().unlock("anything").unwrap();
+    doc.unlock("anything").unwrap();
+}
+
 #[test]
 fn incremental_edits_of_encrypted_documents_stay_encrypted() {
     for alg in ALL {
diff --git a/crates/create/src/lib.rs b/crates/create/src/lib.rs
index 09b07270..aa6e8f6f 100644
--- a/crates/create/src/lib.rs
+++ b/crates/create/src/lib.rs
@@ -314,7 +314,13 @@ fn png_image(name: &str, bytes: &[u8]) -> Result<Embedded, CreateError> {
         _ => (72.0, 72.0),
     };
     let icc = reader.info().icc_profile.as_ref().map(|p| p.to_vec());
-    let mut buf = vec![0; reader.output_buffer_size().ok_or_else(|| bad("image too large".into()))?];
+    // The decoded size comes from the header alone, so a file of a few bytes can claim any
+    // size: keep the ceiling, and ask for the memory fallibly (a failed allocation would abort
+    // the whole app, and no `catch_unwind` stops that).
+    let size = reader.output_buffer_size().filter(|n| *n <= MAX_DECODED_BYTES).ok_or_else(|| bad("image too large".into()))?;
+    let mut buf = Vec::new();
+    buf.try_reserve_exact(size).map_err(|_| bad("not enough memory for this image".into()))?;
+    buf.resize(size, 0);
     let frame = reader.next_frame(&mut buf).map_err(|e| bad(e.to_string()))?;
     let (w, h) = (frame.width, frame.height);
     let data = &buf[..frame.buffer_size()];
@@ -327,8 +333,14 @@ fn png_image(name: &str, bytes: &[u8]) -> Result<Embedded, CreateError> {
     };
     let has_alpha = channels == 2 || channels == 4;
     let colour_n = if has_alpha { channels - 1 } else { channels };
-    let mut colour = Vec::with_capacity(w as usize * h as usize * colour_n);
+    let mut colour = Vec::new();
+    colour
+        .try_reserve_exact((w as usize).saturating_mul(h as usize).saturating_mul(colour_n))
+        .map_err(|_| bad("not enough memory for this image".into()))?;
     let mut alpha = Vec::new();
+    if has_alpha {
+        alpha.try_reserve_exact((w as usize).saturating_mul(h as usize)).map_err(|_| bad("not enough memory for this image".into()))?;
+    }
     for px in data.chunks_exact(channels) {
         colour.extend_from_slice(&px[..colour_n]);
         if has_alpha {
@@ -385,8 +397,9 @@ fn decoded(name: &str, bytes: &[u8], format: image::ImageFormat) -> Result<Embed
     Ok(rgba_image(rgba.as_raw(), rgba.dimensions(), (72.0, 72.0)))
 }
 
-/// Most decoded bytes one TIFF page may take: room for the 768 MiB CMYK poster in #665, twice over.
-const MAX_TIFF_DECODED_BYTES: usize = 2 << 30;
+/// Most decoded bytes one TIFF page or PNG may take: room for the 768 MiB CMYK poster in #665,
+/// twice over.
+const MAX_DECODED_BYTES: usize = 2 << 30;
 
 /// Every page of a TIFF (multi-page scans become multi-page PDFs).
 fn tiff_pages(name: &str, bytes: &[u8]) -> Result<Vec<Embedded>, CreateError> {
@@ -398,7 +411,7 @@ fn tiff_pages(name: &str, bytes: &[u8]) -> Result<Vec<Embedded>, CreateError> {
     // 12000x16000 CMYK is 768 MiB. Raise it, but keep a ceiling so a tiny file claiming
     // enormous dimensions can't ask for unbounded memory.
     let mut limits = Limits::default();
-    limits.decoding_buffer_size = MAX_TIFF_DECODED_BYTES;
+    limits.decoding_buffer_size = MAX_DECODED_BYTES;
     let mut dec = Decoder::new(std::io::Cursor::new(bytes)).map_err(|e| bad(e.to_string()))?.with_limits(limits);
     let mut out = Vec::new();
     loop {
diff --git a/crates/create/src/tests.rs b/crates/create/src/tests.rs
index d83cefc5..79732121 100644
--- a/crates/create/src/tests.rs
+++ b/crates/create/src/tests.rs
@@ -198,6 +198,64 @@ fn a_tiff_claiming_enormous_dimensions_is_refused() {
     assert!(matches!(from_images(&[("huge.tif".into(), tif)]), Err(CreateError::Image(..))));
 }
 
+/// A PNG of a few bytes whose header claims `w`×`h` 8-bit RGBA pixels, with no pixel data.
+fn png_claiming(w: u32, h: u32) -> Vec<u8> {
+    fn crc32(bytes: &[u8]) -> u32 {
+        let mut c = !0u32;
+        for &b in bytes {
+            c ^= u32::from(b);
+            for _ in 0..8 {
+                c = if c & 1 != 0 { 0xEDB8_8320 ^ (c >> 1) } else { c >> 1 };
+            }
+        }
+        !c
+    }
+    let mut png = b"\x89PNG\r\n\x1a\n".to_vec();
+    let mut chunk = |kind: &[u8], data: &[u8]| {
+        png.extend_from_slice(&(data.len() as u32).to_be_bytes());
+        let body = [kind, data].concat();
+        png.extend_from_slice(&body);
+        png.extend_from_slice(&crc32(&body).to_be_bytes());
+    };
+    let ihdr = [&w.to_be_bytes()[..], &h.to_be_bytes(), &[8, 6, 0, 0, 0]].concat();
+    chunk(b"IHDR", &ihdr);
+    // An empty zlib stream: one stored block of no bytes.
+    chunk(b"IDAT", &[0x78, 0x01, 0x01, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01]);
+    chunk(b"IEND", &[]);
+    png
+}
+
+#[test]
+fn a_tiny_png_claiming_huge_dimensions_is_refused_before_allocating() {
+    // 68 bytes claiming 13 GiB (and 1 TiB) of pixels: refused before anything is allocated,
+    // where it used to abort the process when the allocation failed.
+    for (w, h) in [(60_000, 60_000), (1 << 20, 1 << 18)] {
+        let png = png_claiming(w, h);
+        assert_eq!(png.len(), 68);
+        let r = from_images(&[("huge.png".into(), png)]);
+        assert!(matches!(&r, Err(CreateError::Image(_, m)) if m.contains("too large")), "{w}x{h}");
+    }
+}
+
+/// Likewise a PNG: the png crate's limits don't cover the frame buffer, which its header sizes
+/// (60000x60000 RGBA is 14.4 GB). Refused before anything is allocated, not after.
+#[test]
+fn a_png_claiming_enormous_dimensions_is_refused() {
+    let mut png = Vec::new();
+    {
+        let mut enc = png::Encoder::new(&mut png, 60_000, 60_000);
+        enc.set_color(png::ColorType::Rgba);
+        enc.set_depth(png::BitDepth::Eight);
+        let mut w = enc.write_header().unwrap();
+        // A zlib stream holding one zero byte: far too little data, but a well-formed start.
+        w.write_chunk(png::chunk::IDAT, &[0x78, 0x01, 0x01, 0x01, 0x00, 0xFE, 0xFF, 0x00, 0x00, 0x01, 0x00, 0x01]).unwrap();
+    }
+    match from_images(&[("huge.png".into(), png)]) {
+        Err(CreateError::Image(_, m)) => assert!(m.contains("too large"), "{m}"),
+        other => panic!("expected a refusal, got {:?}", other.map(|_| ())),
+    }
+}
+
 #[test]
 fn images_export_as_jpeg_unchanged_and_others_as_png() {
     let doc = reopen(
diff --git a/crates/crypt/src/lib.rs b/crates/crypt/src/lib.rs
index 9c2c1dab..b93fd825 100644
--- a/crates/crypt/src/lib.rs
+++ b/crates/crypt/src/lib.rs
@@ -180,6 +180,18 @@ impl SecurityHandler {
         Ok(Self { dict, key, auth, recovered_user })
     }
 
+    /// Upgrade to owner access with the owner (permissions) password, as when a restricted
+    /// document is unlocked after opening. The user password, or any other, is `WrongPassword`.
+    /// Both passwords unlock the same file key, so what was decrypted so far stays valid; a
+    /// different key is refused too.
+    pub fn authenticate_owner(&self, id0: &[u8], password: &str) -> Result<Self, CryptError> {
+        let owner = Self::open(self.dict.clone(), id0, Some(password))?;
+        if owner.auth != Auth::Owner || owner.key != self.key {
+            return Err(CryptError::WrongPassword);
+        }
+        Ok(owner)
+    }
+
     pub fn auth(&self) -> Auth {
         self.auth
     }
diff --git a/crates/crypt/src/tests.rs b/crates/crypt/src/tests.rs
index dc3a1964..e940af50 100644
--- a/crates/crypt/src/tests.rs
+++ b/crates/crypt/src/tests.rs
@@ -69,6 +69,29 @@ fn created_encryption_authenticates_owner_and_user() {
     }
 }
 
+#[test]
+fn the_owner_password_upgrades_a_user_session() {
+    for alg in ALL {
+        let d = new(alg, "", "secret", 0b0100).dict().clone();
+        let user = SecurityHandler::open(d, ID, None).unwrap();
+        assert!(!user.permissions().modify(), "{alg:?}");
+        // The (empty) user password and wrong ones don't unlock anything.
+        assert_eq!(user.authenticate_owner(ID, "").unwrap_err(), CryptError::WrongPassword, "{alg:?}");
+        assert_eq!(user.authenticate_owner(ID, "nope").unwrap_err(), CryptError::WrongPassword, "{alg:?}");
+        let owner = user.authenticate_owner(ID, "secret").unwrap();
+        assert_eq!(owner.auth(), Auth::Owner, "{alg:?}");
+        assert_eq!(owner.file_key(), user.file_key(), "{alg:?}");
+        assert!(owner.permissions().modify(), "{alg:?}");
+    }
+    // A separate open password is not the permissions password.
+    for alg in ALL {
+        let d = new(alg, "open", "perms", 0b0100).dict().clone();
+        let user = SecurityHandler::open(d, ID, Some("open")).unwrap();
+        assert_eq!(user.authenticate_owner(ID, "open").unwrap_err(), CryptError::WrongPassword, "{alg:?}");
+        assert_eq!(user.authenticate_owner(ID, "perms").unwrap().auth(), Auth::Owner, "{alg:?}");
+    }
+}
+
 #[test]
 fn empty_user_password_opens_without_asking() {
     for alg in ALL {
diff --git a/crates/edit/src/added.rs b/crates/edit/src/added.rs
index daf4a25a..575affb4 100644
--- a/crates/edit/src/added.rs
+++ b/crates/edit/src/added.rs
@@ -8,13 +8,13 @@
 //! after `/UserUnit` and `/Rotate`), so items stay upright on rotated pages; an item records the
 //! `/UserUnit` it was written for.
 
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 
 use pdfcraft_cos::{Dict, Document, ObjRef, Object, PdfString, Stream};
 use pdfcraft_fonts::{GlyphError, GlyphOutline, ShapedCluster, arabic_glyph, helvetica_width, literal, shape_arabic, win_ansi};
 use unicode_bidi::{Level, ParagraphBidiInfo};
 
-use crate::{EditError, check, contents, n, page_list, place_tagged};
+use crate::{EditError, MarkKind, check, contents, n, page_list, place_tagged};
 
 const TAG: &str = "Added";
 
@@ -198,6 +198,13 @@ pub struct Added {
     pub content: Content,
 }
 
+/// PdfCraft-owned page content discovered in one page/content traversal.
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct MarkerScan {
+    pub marks: Vec<MarkKind>,
+    pub added: Vec<Added>,
+}
+
 fn nums(doc: &Document, o: Option<&Object>) -> Vec<f64> {
     o.map(|o| doc.resolve(o)).and_then(|a| a.as_array().map(|a| a.iter().filter_map(Object::as_f64).collect())).unwrap_or_default()
 }
@@ -380,24 +387,43 @@ fn font_name(base: &str) -> String {
     format!("PCF{}", base.replace('-', ""))
 }
 
-/// Most glyphs in one Type 3 font: its codes are single bytes, 1–240.
+/// Most glyphs in one Type 3 font: its codes are single bytes, 1–240. An item gets one such font
+/// per 240 distinct glyphs it needs.
 const GLYPHS_PER_FONT: usize = 240;
-/// Most Type 3 fonts one item may use, which bounds the objects it adds (ordinary text needs one
-/// or two).
-const MAX_ARABIC_FONTS: usize = 16;
+
+/// A line of an Arabic item after layout: its text, whether its paragraph runs right to left, its
+/// pieces in drawing order and its width at the item's size.
+type LaidLine = (String, bool, Vec<Piece>, f64);
 
 /// Draw a text item that has Arabic in it. Each line is laid out in display order; Arabic glyphs
 /// come from Type 3 fonts drawn from the craft-fonts face's outlines (no font file is embedded),
-/// with a ToUnicode map for copy and search. Other text uses the item's standard font `latin`.
-fn draw_arabic(doc: &mut Document, t: &AddedText, latin: &str, taken: &Dict, fonts: &mut Dict, out: &mut Vec<u8>) -> Result<(), EditError> {
+/// with a ToUnicode map for copy and search. Other text uses the item's standard font.
+fn draw_arabic(doc: &mut Document, t: &AddedText, taken: &Dict, fonts: &mut Dict, out: &mut Vec<u8>) -> Result<(), EditError> {
+    let laid = wrapped(t)
+        .into_iter()
+        .map(|(line, rtl)| arabic_layout(t, &line, rtl).map(|(pieces, w)| (line, rtl, pieces, w)))
+        .collect::<Result<Vec<_>, _>>()?;
+    draw_laid_arabic(doc, t, &laid, taken, fonts, out, arabic_glyph)
+}
+
+/// [`draw_arabic`] for lines that are already laid out. `outline` is the source of glyph outlines
+/// (the craft-fonts face, or a stand-in in tests).
+fn draw_laid_arabic(
+    doc: &mut Document,
+    t: &AddedText,
+    laid: &[LaidLine],
+    taken: &Dict,
+    fonts: &mut Dict,
+    out: &mut Vec<u8>,
+    outline: impl Fn(u32) -> Result<GlyphOutline, GlyphError>,
+) -> Result<(), EditError> {
     let r = text_rect(t);
-    let lines = wrapped(t);
-    let laid = lines.iter().map(|(line, rtl)| arabic_layout(t, line, *rtl)).collect::<Result<Vec<_>, _>>()?;
+    let latin = font_name(t.family.base_font(t.bold, t.italic));
     // Every distinct cluster (a letter with its dots and the text it stands for) is one glyph of
     // one of the fonts, so copy and search get each character exactly once.
     let mut keys: Vec<&ShapedCluster> = Vec::new();
     let mut index: HashMap<ClusterKey, usize> = HashMap::new();
-    for c in laid.iter().flat_map(|(pieces, _)| pieces).flat_map(|p| match p {
+    for c in laid.iter().flat_map(|(_, _, pieces, _)| pieces).flat_map(|p| match p {
         Piece::Arabic(clusters) => clusters.as_slice(),
         Piece::Latin(_) => &[],
     }) {
@@ -406,18 +432,17 @@ fn draw_arabic(doc: &mut Document, t: &AddedText, latin: &str, taken: &Dict, fon
             keys.len() - 1
         });
     }
-    if keys.len() > GLYPHS_PER_FONT * MAX_ARABIC_FONTS {
-        return Err(EditError::Invalid("the text uses too many different Arabic glyphs; split it into several boxes".into()));
-    }
     // Every outline is read before anything is written, so a failure leaves the document as it was.
     let mut outlines = HashMap::new();
     for c in &keys {
         for (id, _) in &c.glyphs {
             if !outlines.contains_key(id) {
-                outlines.insert(*id, arabic_glyph(*id).map_err(|e| arabic_error(e, &c.text))?);
+                outlines.insert(*id, outline(*id).map_err(|e| arabic_error(e, &c.text))?);
             }
         }
     }
+    // The names the page and this item already use: a new font never takes one of them.
+    let mut taken_names: HashSet<Vec<u8>> = taken.iter().chain(fonts.iter()).map(|(name, _)| name.clone()).collect();
     let mut names = Vec::new();
     for chunk in keys.chunks(GLYPHS_PER_FONT) {
         let font = type3_arabic(doc, chunk, &outlines);
@@ -425,19 +450,20 @@ fn draw_arabic(doc: &mut Document, t: &AddedText, latin: &str, taken: &Dict, fon
         // numbers alone don't do: a full save renumbers objects but keeps resource names).
         let mut name = format!("PCAr{}", font.num);
         let mut suffix = 0usize;
-        while taken.contains(name.as_bytes()) || fonts.contains(name.as_bytes()) {
+        while taken_names.contains(name.as_bytes()) {
             suffix = suffix.saturating_add(1);
             name = format!("PCAr{}_{suffix}", font.num);
         }
+        taken_names.insert(name.clone().into_bytes());
         fonts.set(name.clone().into_bytes(), Object::Ref(font));
         names.push(name);
     }
     let [cr, cg, cb] = t.color.map(|v| v.clamp(0.0, 1.0));
     out.extend(format!("BT {} {} {} rg\n", n(cr), n(cg), n(cb)).bytes());
-    for (i, ((line, rtl), (pieces, w))) in lines.iter().zip(&laid).enumerate() {
+    for (i, (line, rtl, pieces, w)) in laid.iter().enumerate() {
         let spaces = line.matches(' ').count();
         // Justified: the spaces of every line but the last stretch to fill the box.
-        let tw = if t.align == Align::Justify && i + 1 < lines.len() && spaces > 0 { ((r[2] - r[0]) - w).max(0.0) / spaces as f64 } else { 0.0 };
+        let tw = if t.align == Align::Justify && i + 1 < laid.len() && spaces > 0 { ((r[2] - r[0]) - w).max(0.0) / spaces as f64 } else { 0.0 };
         let x = match t.align {
             // A right-to-left paragraph's unstretched last line ends at the right edge.
             Align::Justify if *rtl => r[2] - w - tw * spaces as f64,
@@ -454,7 +480,7 @@ fn draw_arabic(doc: &mut Document, t: &AddedText, latin: &str, taken: &Dict, fon
                     out.extend(format!("/{latin} {} Tf {} Tw 1 0 0 1 {} {} Tm ", n(t.size), n(tw), n(pen), n(y)).bytes());
                     out.extend(literal(&win_ansi(s)));
                     out.extend_from_slice(b" Tj\n");
-                    current = Some(latin);
+                    current = Some(latin.as_str());
                     pen += t.family.width(s, t.size, t.bold) + tw * s.matches(' ').count() as f64;
                 }
                 Piece::Arabic(clusters) => {
@@ -586,7 +612,7 @@ fn draw(doc: &mut Document, c: &Content, view: [f64; 6], taken: &Dict, existing:
             let mut fonts = Dict::new();
             fonts.set(name.clone().into_bytes(), Object::Dict(font));
             if t.text.chars().any(is_arabic) && (pdfcraft_fonts::document_arabic_font().is_some() || !existing) {
-                draw_arabic(doc, t, &name, taken, &mut fonts, &mut out)?;
+                draw_arabic(doc, t, taken, &mut fonts, &mut out)?;
                 res.set(b"Font".to_vec(), Object::Dict(fonts));
                 out.extend_from_slice(b"Q\n");
                 return Ok((out, res));
@@ -728,6 +754,76 @@ fn parse(doc: &Document, d: &Dict) -> Option<Content> {
     }
 }
 
+fn with_resolved<T>(doc: &Document, object: &Object, f: impl FnOnce(&Object) -> T) -> T {
+    match object {
+        Object::Ref(reference) => {
+            let resolved = doc.get(*reference);
+            f(&resolved)
+        }
+        direct => f(direct),
+    }
+}
+
+fn for_each_content_entry(doc: &Document, page: &pdfcraft_model::Page, mut visit: impl FnMut(&Object)) {
+    let Some(contents) = page.dict.get(b"Contents") else { return };
+    with_resolved(doc, contents, |resolved| match resolved {
+        Object::Array(entries) => {
+            for entry in entries {
+                visit(entry);
+            }
+        }
+        _ => visit(contents),
+    });
+}
+
+/// Finds page marks and editable added content in one pass over the page content entries.
+pub fn scan_markers(doc: &Document) -> MarkerScan {
+    let mut scan = MarkerScan::default();
+    for (pi, page) in page_list(doc).iter().enumerate() {
+        for_each_content_entry(doc, page, |entry| {
+            with_resolved(doc, entry, |resolved| {
+                let Some(dict) = resolved.as_dict() else { return };
+                let tag = dict.name(b"PCMark");
+                let kind = if tag == Some(&b"HeaderFooter"[..]) {
+                    Some(MarkKind::HeaderFooter)
+                } else if tag == Some(&b"Watermark"[..]) {
+                    Some(MarkKind::Watermark)
+                } else if tag == Some(&b"Background"[..]) {
+                    Some(MarkKind::Background)
+                } else {
+                    None
+                };
+                if let Some(kind) = kind
+                    && !scan.marks.contains(&kind)
+                {
+                    scan.marks.push(kind);
+                }
+
+                let Some(obj) = Object::as_ref(entry) else { return };
+                if tag != Some(TAG.as_bytes()) {
+                    return;
+                }
+                let Some(params_object) = dict.get(b"PCAdded") else { return };
+                with_resolved(doc, params_object, |resolved_params| {
+                    let Some(params) = resolved_params.as_dict() else { return };
+                    if let Some(content) = parse(doc, params) {
+                        // Display points depend on the page's /UserUnit. An item records the one it was
+                        // written for; none means 1, as for items written before display space followed
+                        // /UserUnit.
+                        let written = params
+                            .get(b"UserUnit")
+                            .and_then(Object::as_f64)
+                            .filter(|u| u.is_finite() && *u >= 1.0)
+                            .map_or(1.0, |u| u.min(pdfcraft_model::MAX_USER_UNIT));
+                        scan.added.push(Added { page: pi, obj, content: content.scaled(page.user_unit(doc) / written) });
+                    }
+                });
+            });
+        });
+    }
+    scan
+}
+
 fn validate(c: &Content) -> Result<(), EditError> {
     let r = c.rect();
     if !r.iter().all(|v| v.is_finite()) {
@@ -816,37 +912,7 @@ fn write(doc: &mut Document, page: usize, c: &Content, obj: Option<ObjRef>) -> R
 
 /// Every added item, page by page, in drawing order.
 pub fn list_added(doc: &Document) -> Vec<Added> {
-    let mut out = Vec::new();
-    for (pi, p) in page_list(doc).iter().enumerate() {
-        let list: Vec<Object> = match p.dict.get(b"Contents") {
-            Some(c) => match &*doc.resolve(c) {
-                Object::Array(a) => a.clone(),
-                _ => vec![c.clone()],
-            },
-            None => Vec::new(),
-        };
-        for o in list {
-            let Some(r) = o.as_ref() else { continue };
-            let obj = doc.get(r);
-            let Some(d) = obj.as_dict() else { continue };
-            if d.name(b"PCMark") != Some(TAG.as_bytes()) {
-                continue;
-            }
-            let Some(params) = d.get(b"PCAdded").and_then(|o| doc.resolve(o).as_dict().cloned()) else { continue };
-            if let Some(c) = parse(doc, &params) {
-                // Display points depend on the page's /UserUnit. An item records the one it was
-                // written for; none means 1, as for items written before display space followed
-                // /UserUnit.
-                let written = params
-                    .get(b"UserUnit")
-                    .and_then(Object::as_f64)
-                    .filter(|u| u.is_finite() && *u >= 1.0)
-                    .map_or(1.0, |u| u.min(pdfcraft_model::MAX_USER_UNIT));
-                out.push(Added { page: pi, obj: r, content: c.scaled(p.user_unit(doc) / written) });
-            }
-        }
-    }
-    out
+    scan_markers(doc).added
 }
 
 /// Add an item to a page (0-based). Returns its index among the page's added items.
@@ -915,3 +981,6 @@ fn drop_fonts(doc: &Document, res: &mut Dict, names: &[Vec<u8>]) {
     }
     res.set(b"Font".to_vec(), Object::Dict(fonts));
 }
+
+#[cfg(test)]
+mod arabic_tests;
diff --git a/crates/edit/src/added/arabic_tests.rs b/crates/edit/src/added/arabic_tests.rs
new file mode 100644
index 00000000..5feb62bb
--- /dev/null
+++ b/crates/edit/src/added/arabic_tests.rs
@@ -0,0 +1,218 @@
+//! Arabic items too big for one Type 3 font. Shaped clusters and glyph outlines are injected here,
+//! so these run without the craft-fonts Arabic face. Shaping itself is covered by the face tests in
+//! `tests.rs`, which run where the face is built in.
+
+use std::cell::Cell;
+
+use super::*;
+
+/// The fingerprint of an item below the old limit, from the code before the change: its content
+/// stream, its new fonts and every object of the document.
+const SMALL_ITEM_FINGERPRINT: u64 = 14_135_892_979_695_233_112;
+
+/// A cluster that shows one character with the single glyph `id`, at `advance` em.
+fn cluster(id: u32, advance: f64) -> ShapedCluster {
+    ShapedCluster { glyphs: vec![(id, [0.0, 0.0])], advance, text: "ب".into() }
+}
+
+/// One run of `clusters` as a line of an item at `item()`'s size.
+fn line(clusters: Vec<ShapedCluster>, rtl: bool) -> LaidLine {
+    let text = clusters.iter().map(|c| c.text.as_str()).collect();
+    let width = clusters.iter().map(|c| c.advance).sum::<f64>() * item().size;
+    (text, rtl, vec![Piece::Arabic(clusters)], width)
+}
+
+/// A glyph outline: a box on the baseline, `advance` em wide.
+fn boxed(advance: f64) -> GlyphOutline {
+    let contours = vec![vec![[0.0, 0.0], [advance, 0.0], [advance, 0.5], [0.0, 0.5]]];
+    GlyphOutline { contours, width: advance, bbox: [0.0, 0.0, advance, 0.5] }
+}
+
+fn item() -> AddedText {
+    AddedText { rect: [72.0, 600.0, 540.0, 700.0], ..AddedText::default() }
+}
+
+/// Every object of `doc`, serialised: equal snapshots mean the document did not change.
+fn snapshot(doc: &Document) -> Vec<u8> {
+    let mut bytes = Vec::new();
+    for num in doc.object_numbers() {
+        let obj = doc.get(ObjRef { num, generation: doc.generation(num) });
+        pdfcraft_cos::serialize(&obj, &mut bytes);
+        bytes.push(b'\n');
+    }
+    bytes
+}
+
+/// The fonts an item drew, in creation order, with their glyph counts.
+fn fonts_of(doc: &Document, fonts: &Dict) -> Vec<(Vec<u8>, usize)> {
+    fonts
+        .iter()
+        .map(|(name, font)| {
+            let glyphs = match doc.dict(font).as_ref().and_then(|f| f.get(b"CharProcs")) {
+                Some(Object::Dict(procs)) => procs.len(),
+                _ => 0,
+            };
+            (name.clone(), glyphs)
+        })
+        .collect()
+}
+
+/// The font and code of every glyph the content stream shows, in drawing order.
+fn glyphs_shown(out: &[u8]) -> Vec<(Vec<u8>, u8)> {
+    let mut font = Vec::new();
+    let mut shown = Vec::new();
+    for op in pdfcraft_content::parse(out).ops {
+        if op.is("Tf") {
+            font = op.name(0).unwrap_or_default().to_vec();
+        } else if op.is("Tj")
+            && let Some(Object::String(s)) = op.operands.first()
+        {
+            shown.push((font.clone(), s.bytes.first().copied().unwrap_or_default()));
+        }
+    }
+    shown
+}
+
+/// 64-bit FNV-1a: a stable fingerprint for the golden check.
+fn fnv1a(bytes: &[u8]) -> u64 {
+    bytes.iter().fold(0xcbf2_9ce4_8422_2325, |h, b| (h ^ u64::from(*b)).wrapping_mul(0x0100_0000_01b3))
+}
+
+#[test]
+fn an_item_past_the_old_glyph_limit_gets_a_font_per_240_glyphs() {
+    // Sixteen fonts of 240 glyphs was the most an item could use. This one needs 3,841 glyphs.
+    let n = 16 * GLYPHS_PER_FONT + 1;
+    let laid = vec![line((0..n).map(|i| cluster(i as u32 + 1, 0.5)).collect(), false)];
+    let mut doc = Document::new_empty();
+    let (mut fonts, mut out) = (Dict::new(), Vec::new());
+    let drawn = draw_laid_arabic(&mut doc, &item(), &laid, &Dict::new(), &mut fonts, &mut out, |_| Ok(boxed(0.5)));
+    assert!(drawn.is_ok(), "{drawn:?}");
+    let made = fonts_of(&doc, &fonts);
+    let mut expected = vec![GLYPHS_PER_FONT; 16];
+    expected.push(1);
+    assert_eq!(made.iter().map(|(_, glyphs)| *glyphs).collect::<Vec<_>>(), expected);
+    let shown = glyphs_shown(&out);
+    assert_eq!(shown.len(), n);
+    for (k, (font, code)) in shown.iter().enumerate() {
+        assert_eq!(font, &made[k / GLYPHS_PER_FONT].0, "glyph {k} is drawn from the wrong font");
+        assert_eq!(usize::from(*code), k % GLYPHS_PER_FONT + 1, "glyph {k} has the wrong code");
+    }
+}
+
+#[test]
+fn an_outline_missing_from_a_later_font_leaves_the_document_unchanged() {
+    // Two fonts' worth of glyphs; the glyph in the second font has no outline.
+    let n = 2 * GLYPHS_PER_FONT;
+    let laid = vec![line((0..n).map(|i| cluster(i as u32 + 1, 0.5)).collect(), false)];
+    let mut doc = Document::new_empty();
+    let before = snapshot(&doc);
+    let missing = n as u32;
+    let (mut fonts, mut out) = (Dict::new(), Vec::new());
+    let drawn = draw_laid_arabic(&mut doc, &item(), &laid, &Dict::new(), &mut fonts, &mut out, |id| {
+        if id == missing { Err(GlyphError::Missing) } else { Ok(boxed(0.5)) }
+    });
+    assert!(matches!(&drawn, Err(EditError::Invalid(msg)) if msg.contains("can't show")), "{drawn:?}");
+    assert_eq!(snapshot(&doc), before);
+    assert!(fonts.is_empty() && out.is_empty());
+}
+
+#[test]
+fn an_item_below_the_old_limit_is_drawn_exactly_as_before() {
+    // A left-to-right line with a Latin run, a space and a two-glyph cluster, then a right-to-left
+    // line. Glyphs repeat across the two lines and share one font.
+    let space = ShapedCluster { glyphs: vec![(6, [0.0, 0.0])], advance: 0.25, text: " ".into() };
+    let ligature = ShapedCluster { glyphs: vec![(4, [0.0, 0.0]), (5, [-0.1, 0.2])], advance: 0.6, text: "لا".into() };
+    let mixed: LaidLine =
+        ("Hi ب".into(), false, vec![Piece::Latin("Hi ".into()), Piece::Arabic(vec![cluster(1, 0.5), cluster(2, 0.5), space, ligature])], 4.0);
+    let rtl = line(vec![cluster(2, 0.5), cluster(9, 0.75)], true);
+    let laid = vec![mixed, rtl];
+    let mut doc = Document::new_empty();
+    let (mut fonts, mut out) = (Dict::new(), Vec::new());
+    let drawn = draw_laid_arabic(&mut doc, &item(), &laid, &Dict::new(), &mut fonts, &mut out, |id| Ok(boxed(0.5 + f64::from(id) * 0.01)));
+    assert!(drawn.is_ok(), "{drawn:?}");
+    assert_eq!(fonts.len(), 1);
+    let mut bytes = out.clone();
+    pdfcraft_cos::serialize(&Object::Dict(fonts.clone()), &mut bytes);
+    bytes.extend(snapshot(&doc));
+    assert_eq!(fnv1a(&bytes), SMALL_ITEM_FINGERPRINT, "output changed; the golden is the code before the sharding change");
+}
+
+#[test]
+fn long_text_with_few_distinct_glyphs_needs_one_font() {
+    // 5,000 clusters that repeat three glyphs: one font, and one outline read per glyph.
+    let clusters: Vec<ShapedCluster> = (0..5_000u32).map(|i| cluster(1 + i % 3, 0.5)).collect();
+    let laid = vec![line(clusters, false)];
+    let reads = Cell::new(0usize);
+    let mut doc = Document::new_empty();
+    let (mut fonts, mut out) = (Dict::new(), Vec::new());
+    let drawn = draw_laid_arabic(&mut doc, &item(), &laid, &Dict::new(), &mut fonts, &mut out, |_| {
+        reads.set(reads.get() + 1);
+        Ok(boxed(0.5))
+    });
+    assert!(drawn.is_ok(), "{drawn:?}");
+    assert_eq!(fonts_of(&doc, &fonts).iter().map(|(_, glyphs)| *glyphs).collect::<Vec<_>>(), [3]);
+    assert_eq!(reads.get(), 3);
+    assert_eq!(glyphs_shown(&out).len(), 5_000);
+}
+
+#[test]
+fn distinct_clusters_past_the_old_limit_share_their_glyph_outlines() {
+    // 3,841 different clusters (their advances differ) built from four glyphs: four outlines are read.
+    let clusters: Vec<ShapedCluster> = (0..3_841u32)
+        .map(|i| ShapedCluster { glyphs: vec![(1 + i % 4, [0.0, 0.0])], advance: 0.5 + f64::from(i) * 1e-6, text: "ب".into() })
+        .collect();
+    let laid = vec![line(clusters, false)];
+    let reads = Cell::new(0usize);
+    let mut doc = Document::new_empty();
+    let (mut fonts, mut out) = (Dict::new(), Vec::new());
+    let drawn = draw_laid_arabic(&mut doc, &item(), &laid, &Dict::new(), &mut fonts, &mut out, |_| {
+        reads.set(reads.get() + 1);
+        Ok(boxed(0.5))
+    });
+    assert!(drawn.is_ok(), "{drawn:?}");
+    assert_eq!(fonts.len(), 17);
+    assert_eq!(reads.get(), 4);
+    assert_eq!(glyphs_shown(&out).len(), 3_841);
+}
+
+#[test]
+fn hostile_clusters_draw_empty_or_fail_without_changing_the_document() {
+    // A cluster with no glyphs and no text draws nothing, but it is still one glyph of a font.
+    let empty = ShapedCluster { glyphs: Vec::new(), advance: 0.0, text: String::new() };
+    let laid = vec![line(vec![empty, cluster(1, 0.5)], false)];
+    let mut doc = Document::new_empty();
+    let (mut fonts, mut out) = (Dict::new(), Vec::new());
+    let drawn = draw_laid_arabic(&mut doc, &item(), &laid, &Dict::new(), &mut fonts, &mut out, |_| Ok(boxed(0.5)));
+    assert!(drawn.is_ok(), "{drawn:?}");
+    assert_eq!(glyphs_shown(&out).len(), 2);
+    // A glyph id the face doesn't have fails the item before anything is written.
+    let before = snapshot(&doc);
+    let laid = vec![line(vec![cluster(1, 0.5), cluster(u32::MAX, 0.5)], false)];
+    let (mut fonts, mut out) = (Dict::new(), Vec::new());
+    let drawn = draw_laid_arabic(&mut doc, &item(), &laid, &Dict::new(), &mut fonts, &mut out, |id| {
+        if id == u32::MAX { Err(GlyphError::Missing) } else { Ok(boxed(0.5)) }
+    });
+    assert!(drawn.is_err());
+    assert_eq!(snapshot(&doc), before);
+    assert!(fonts.is_empty() && out.is_empty());
+}
+
+#[test]
+fn a_font_name_the_page_already_uses_is_not_reused() {
+    let laid = vec![line(vec![cluster(1, 0.5)], false)];
+    let mut doc = Document::new_empty();
+    let (mut fonts, mut out) = (Dict::new(), Vec::new());
+    let drawn = draw_laid_arabic(&mut doc, &item(), &laid, &Dict::new(), &mut fonts, &mut out, |_| Ok(boxed(0.5)));
+    assert!(drawn.is_ok(), "{drawn:?}");
+    let first = fonts_of(&doc, &fonts)[0].0.clone();
+    // The same item on a page whose resources already use that name.
+    let mut taken = Dict::new();
+    taken.set(first.clone(), Object::Null);
+    let mut doc = Document::new_empty();
+    let (mut fonts, mut out) = (Dict::new(), Vec::new());
+    let drawn = draw_laid_arabic(&mut doc, &item(), &laid, &taken, &mut fonts, &mut out, |_| Ok(boxed(0.5)));
+    assert!(drawn.is_ok(), "{drawn:?}");
+    let second = fonts_of(&doc, &fonts)[0].0.clone();
+    assert_ne!(second, first);
+    assert!(second.starts_with(b"PCAr"), "{}", String::from_utf8_lossy(&second));
+}
diff --git a/crates/edit/src/images.rs b/crates/edit/src/images.rs
index c6c0cb5d..134211bd 100644
--- a/crates/edit/src/images.rs
+++ b/crates/edit/src/images.rs
@@ -248,6 +248,34 @@ pub fn turn_about_centre(rect: [f64; 4], quarters: i32, flip_h: bool, flip_v: bo
     [a, b, c, d, cx - a * cx - c * cy, cy - b * cx - d * cy]
 }
 
+/// For a `Do` at `op` that sits alone in `q re W n cm Do Q`: the index of the `re` and the `cm` matrix.
+/// That clip belongs to this image only, so it may move with it. A `cm` this move put before the
+/// `re` earlier (`q cm re W n cm Do Q`) keeps the pattern, so the image can be moved again.
+fn exclusive_clip(ops: &[Op], op: usize) -> Option<(usize, Matrix)> {
+    let at = op.checked_sub(4)?;
+    let mut q = at.checked_sub(1)?;
+    while ops.get(q)?.is("cm") {
+        q = q.checked_sub(1)?;
+    }
+    let ok = ops.get(q)?.is("q")
+        && ops.get(at)?.is("re")
+        && (ops.get(at + 1)?.is("W") || ops.get(at + 1)?.is("W*"))
+        && ops.get(at + 2)?.is("n")
+        && ops.get(at + 3)?.is("cm")
+        && ops.get(op + 1)?.is("Q");
+    if !ok {
+        return None;
+    }
+    Some((at, Matrix(ops.get(at + 3)?.nums::<6>()?)))
+}
+
+/// The `cm` to put before the clip so that user-space transform `t` also moves the clip:
+/// the clip is drawn in the CTM before the image's own `cm` (`cm` · that = `draw`).
+fn clip_matrix(draw: Matrix, cm: Matrix, t: Matrix) -> Option<Matrix> {
+    let outer = cm.invert()?.then(&draw);
+    Some(outer.then(&t).then(&outer.invert()?))
+}
+
 /// Change image `index` (from [`page_images`]) on `page`.
 pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &ImageChange) -> Result<(), EditError> {
     let images = page_images(doc, page)?;
@@ -258,6 +286,7 @@ pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &Imag
     let mut ops = parse(&data).ops;
     let original = ops.get(img.op).cloned().ok_or_else(|| EditError::Invalid("the image operation is missing".into()))?;
     let mut resources = None;
+    let mut clip_move = None;
     let replacement: Vec<Op> = match change {
         ImageChange::Delete => Vec::new(),
         ImageChange::Transform(t) => {
@@ -271,7 +300,17 @@ pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &Imag
             if !m.0.iter().all(|v| v.is_finite()) {
                 return Err(EditError::Invalid("the image transform is too large".into()));
             }
-            vec![Op::new("q", vec![]), Op::new("cm", m.0.iter().map(|v| pdfcraft_content::num(*v)).collect()), original, Op::new("Q", vec![])]
+            // `q re W n cm Do Q` clips only this image: move the clip with it instead of leaving it behind.
+            if let Some((at, cm)) = exclusive_clip(&ops, img.op) {
+                if let Some(c) = clip_matrix(Matrix(img.draw_matrix), cm, Matrix(*t)).filter(|c| c.0.iter().all(|v| v.is_finite())) {
+                    clip_move = Some((at, Op::new("cm", c.0.iter().map(|v| pdfcraft_content::num(*v)).collect())));
+                    vec![original]
+                } else {
+                    return Err(EditError::Invalid("the image transform is too large".into()));
+                }
+            } else {
+                vec![Op::new("q", vec![]), Op::new("cm", m.0.iter().map(|v| pdfcraft_content::num(*v)).collect()), original, Op::new("Q", vec![])]
+            }
         }
         ImageChange::Replace(r) => {
             if img.is_form {
@@ -289,6 +328,9 @@ pub fn change_image(doc: &mut Document, page: usize, index: usize, change: &Imag
         }
     };
     ops.splice(img.op..=img.op, replacement);
+    if let Some((at, cm)) = clip_move {
+        ops.insert(at, cm);
+    }
     let mut dict = match &*doc.resolve(&obj) {
         Object::Stream(s) => s.dict.clone(),
         _ => Dict::new(),
@@ -339,7 +381,7 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
         if !movement.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12) {
             return Err(EditError::Invalid("the image move is too large".into()));
         }
-        plans.insert((image.stream, image.op), movement);
+        plans.insert((image.stream, image.op), (movement, placement, offset));
     }
     let mut data = Vec::with_capacity(all.len());
     let mut inside_text = false;
@@ -355,8 +397,23 @@ pub(crate) fn translate_images(doc: &mut Document, page: usize, indexes: &[usize
                 return Err(EditError::Invalid("an image inside a text object cannot be moved in a group".into()));
             }
         }
+        // Images alone in their own `q re W n cm Do Q` take the clip with them.
+        let mut clips = std::collections::BTreeMap::new();
+        for index in 0..ops.len() {
+            let Some(&(_, placement, offset)) = plans.get(&(stream, index)) else { continue };
+            let Some((at, cm)) = exclusive_clip(&ops, index) else { continue };
+            let translation = Matrix([1.0, 0.0, 0.0, 1.0, offset[0], offset[1]]);
+            let Some(c) = clip_matrix(placement, cm, translation).filter(|c| c.0.iter().all(|v| v.is_finite() && v.abs() <= 1e12)) else {
+                return Err(EditError::Invalid("the image move is too large".into()));
+            };
+            plans.remove(&(stream, index));
+            clips.insert((stream, at), c);
+        }
         let changed = crate::text::splice(&pieces, &ops, |index| {
-            let Some(matrix) = plans.remove(&(stream, index)) else { return (Vec::new(), true) };
+            if let Some(c) = clips.remove(&(stream, index)) {
+                return (vec![Op::new("cm", c.0.map(Object::Real).to_vec())], true);
+            }
+            let Some((matrix, _, _)) = plans.remove(&(stream, index)) else { return (Vec::new(), true) };
             let original = ops.get(index).cloned().into_iter();
             // Local translations can be tiny under a large CTM. Preserve their precision
             // rather than rounding them to zero or amplifying an error on the page.
diff --git a/crates/edit/src/lib.rs b/crates/edit/src/lib.rs
index 467f5dd2..0e97c63e 100644
--- a/crates/edit/src/lib.rs
+++ b/crates/edit/src/lib.rs
@@ -387,10 +387,18 @@ pub(crate) fn drawable<'a>(lines: impl IntoIterator<Item = &'a str>) -> Result<(
 
 /// The refusal for page text with `c`, which nothing here can draw.
 pub(crate) fn undrawable(c: char) -> EditError {
-    EditError::Invalid(format!(
-        "the standard fonts can't draw \"{c}\" (U+{:04X}); only Western European characters can be added as text for now",
-        u32::from(c)
-    ))
+    EditError::Invalid(undrawable_message(c))
+}
+
+/// The wording of the refusal for text with `c`, which the standard fonts can't draw.
+pub fn undrawable_message(c: char) -> String {
+    format!("the standard fonts can't draw \"{c}\" (U+{:04X}); only Western European characters can be added as text for now", u32::from(c))
+}
+
+/// The first character of plain `text` that Helvetica/WinAnsi can't draw (line and page breaks
+/// and tabs are layout, not glyphs).
+pub fn first_undrawable_plain(text: &str) -> Option<char> {
+    text.chars().find(|c| !matches!(c, '\r' | '\n' | '\t' | '\u{c}') && !pdfcraft_fonts::win_ansi_encodable(*c))
 }
 
 fn text_op(x: f64, y: f64, text: &str) -> Vec<u8> {
@@ -491,7 +499,12 @@ pub fn add_watermark(doc: &mut Document, pages: &[usize], wm: &Watermark, replac
     if wm.source.is_none() {
         drawable(text.lines())?;
     }
-    if !(wm.opacity.is_finite() && wm.rotation.is_finite() && wm.font_size.is_finite() && wm.font_size >= 0.0) {
+    if !(wm.opacity.is_finite()
+        && wm.rotation.is_finite()
+        && wm.font_size.is_finite()
+        && wm.font_size >= 0.0
+        && wm.offset.iter().all(|o| o.is_finite()))
+    {
         return Err(EditError::Invalid("invalid watermark settings".into()));
     }
     if replace {
@@ -606,24 +619,7 @@ pub fn remove_marks(doc: &mut Document, pages: &[usize], kind: MarkKind) -> Resu
 
 /// Which kinds of marks the document has (for enabling Update/Remove).
 pub fn marks_present(doc: &Document) -> Vec<MarkKind> {
-    let mut found = Vec::new();
-    for page in page_list(doc) {
-        let obj = doc.get(page.obj);
-        let Some(c) = obj.as_dict().and_then(|d| d.get(b"Contents").cloned()) else { continue };
-        let list = match &*doc.resolve(&c) {
-            Object::Array(a) => a.clone(),
-            _ => vec![c.clone()],
-        };
-        for o in list {
-            if let Some(t) = stream_tag(doc, &o)
-                && let Some(kind) = [MarkKind::HeaderFooter, MarkKind::Watermark, MarkKind::Background].into_iter().find(|m| m.tag() == t)
-                && !found.contains(&kind)
-            {
-                found.push(kind);
-            }
-        }
-    }
-    found
+    added::scan_markers(doc).marks
 }
 
 pub mod objects;
@@ -636,7 +632,10 @@ pub use images::{ImageChange, PageImage, change_image, page_images, reading_imag
 pub mod text;
 pub use text::{BlockStyle, LineEdit, TextBlock, TextLine, reading_blocks, replace_block, replace_line, rewrite_block, text_blocks, text_lines};
 pub mod added;
-pub use added::{Added, AddedImage, AddedText, Align, Content, Family, add_content, delete_content, first_undrawable, list_added, update_content};
+pub use added::{
+    Added, AddedImage, AddedText, Align, Content, Family, MarkerScan, add_content, delete_content, first_undrawable, list_added, scan_markers,
+    update_content,
+};
 
 #[cfg(test)]
 mod tests;
diff --git a/crates/edit/src/tests.rs b/crates/edit/src/tests.rs
index d9f7f548..720b6fcd 100644
--- a/crates/edit/src/tests.rs
+++ b/crates/edit/src/tests.rs
@@ -150,6 +150,26 @@ fn watermarks_rotate_fade_and_can_go_behind() {
     assert_eq!(s.len(), 2, "no wrapper needed for content behind");
 }
 
+#[test]
+fn watermark_offset_moves_the_centre_right_and_up() {
+    let mut doc = fixture();
+    let wm = Watermark { text: "DRAFT".into(), rotation: 0.0, offset: [-100.0, 50.0], ..Watermark::default() };
+    add_watermark(&mut doc, &[0], &wm, false).unwrap();
+    let s = streams(&doc, 0);
+    let mark = s.iter().find(|c| c.contains("/PCMark /Watermark")).expect("the watermark stream");
+    assert!(mark.contains("1 0 0 1 200 450 cm"), "{mark}");
+}
+
+#[test]
+fn a_watermark_offset_that_is_not_finite_is_refused() {
+    for offset in [[f64::NAN, 0.0], [0.0, f64::INFINITY], [f64::NEG_INFINITY, 0.0]] {
+        let mut doc = fixture();
+        let wm = Watermark { text: "DRAFT".into(), offset, ..Watermark::default() };
+        assert!(matches!(add_watermark(&mut doc, &[0], &wm, false), Err(EditError::Invalid(_))), "{offset:?}");
+        assert!(!doc.is_modified());
+    }
+}
+
 #[test]
 fn invalid_requests_change_nothing() {
     let mut doc = fixture();
@@ -247,6 +267,170 @@ fn added_items_follow_the_page_user_unit() {
     assert_eq!((old.rect[0], old.rect[2], old.rect[3], old.size), (144.0, 600.0, 1400.0, 28.0), "scaled to points");
 }
 
+fn tagged_dictionary(tag: &str, added: Option<Object>) -> Dict {
+    let mut dict = Dict::new();
+    dict.set(b"PCMark".to_vec(), Object::name(tag));
+    if let Some(added) = added {
+        dict.set(b"PCAdded".to_vec(), added);
+    }
+    dict
+}
+
+fn tagged_stream(doc: &mut Document, tag: &str, added: Option<Object>) -> Object {
+    Object::Ref(doc.add(Object::Stream(Stream::from_raw(tagged_dictionary(tag, added), Vec::new()))))
+}
+
+fn added_text_params() -> Dict {
+    let mut params = Dict::new();
+    params.set(b"Rect".to_vec(), Object::Array([10, 20, 110, 40].into_iter().map(Object::Int).collect()));
+    params.set(b"Kind".to_vec(), Object::name("Text"));
+    params.set(b"Text".to_vec(), Object::String(pdfcraft_cos::PdfString::text("Added text")));
+    params.set(b"Size".to_vec(), Object::Int(12));
+    params
+}
+
+fn added_image_params(image: pdfcraft_cos::ObjRef) -> Dict {
+    let mut params = Dict::new();
+    params.set(b"Rect".to_vec(), Object::Array([10, 20, 110, 70].into_iter().map(Object::Int).collect()));
+    params.set(b"Kind".to_vec(), Object::name("Image"));
+    params.set(b"Image".to_vec(), Object::Ref(image));
+    params
+}
+
+fn set_page_contents(doc: &mut Document, contents: Object, user_unit: Option<Object>) {
+    let page = pdfcraft_model::pages(doc)[0].obj;
+    doc.update_dict(page, |dict| {
+        dict.set(b"Contents".to_vec(), contents);
+        if let Some(user_unit) = user_unit {
+            dict.set(b"UserUnit".to_vec(), user_unit);
+        }
+    })
+    .unwrap();
+}
+
+fn assert_marker_scan_matches_legacy(doc: &Document, label: &str, marks: &[MarkKind], added: usize) -> MarkerScan {
+    let expected_marks = marks_present(doc);
+    let expected_added = list_added(doc);
+    let scan = scan_markers(doc);
+    assert_eq!(scan.marks, expected_marks, "{label}: marks differ from the independent scan");
+    assert_eq!(scan.added, expected_added, "{label}: added content differs from the independent scan");
+    assert_eq!(scan.marks, marks, "{label}: fixture's mark order or deduplication is wrong");
+    assert_eq!(scan.added.len(), added, "{label}: fixture's added-item count is wrong");
+    scan
+}
+
+#[test]
+fn combined_marker_scan_matches_the_independent_scans() {
+    let empty = build(&["<< /Type /Catalog /Pages 2 0 R >>", "<< /Type /Pages /Kids [3 0 R] /Count 1 >>", "<< /Type /Page /Parent 2 0 R >>"]);
+    assert_marker_scan_matches_legacy(&empty, "empty page", &[], 0);
+    assert_marker_scan_matches_legacy(&fixture(), "ordinary streams and a page without contents", &[], 0);
+
+    for (tag, kind) in [("HeaderFooter", MarkKind::HeaderFooter), ("Watermark", MarkKind::Watermark), ("Background", MarkKind::Background)] {
+        let mut doc = fixture();
+        let marker = tagged_stream(&mut doc, tag, None);
+        set_page_contents(&mut doc, marker, None);
+        assert_marker_scan_matches_legacy(&doc, tag, &[kind], 0);
+    }
+
+    let mut all_marks = fixture();
+    let background = tagged_stream(&mut all_marks, "Background", None);
+    let watermark = tagged_stream(&mut all_marks, "Watermark", None);
+    let header = tagged_stream(&mut all_marks, "HeaderFooter", None);
+    set_page_contents(
+        &mut all_marks,
+        Object::Array(vec![background.clone(), watermark.clone(), header.clone(), watermark, header, background]),
+        None,
+    );
+    assert_marker_scan_matches_legacy(&all_marks, "all mark kinds repeated", &[MarkKind::Background, MarkKind::Watermark, MarkKind::HeaderFooter], 0);
+
+    let mut single_reference = fixture();
+    let marker = tagged_stream(&mut single_reference, "Watermark", None);
+    set_page_contents(&mut single_reference, marker, None);
+    assert_marker_scan_matches_legacy(&single_reference, "contents as one reference", &[MarkKind::Watermark], 0);
+
+    let mut text_only = fixture();
+    let text = tagged_stream(&mut text_only, "Added", Some(Object::Dict(added_text_params())));
+    set_page_contents(&mut text_only, text, None);
+    let text_scan = assert_marker_scan_matches_legacy(&text_only, "one added text item", &[], 1);
+    assert!(matches!(&text_scan.added[0].content, Content::Text(text) if text.text == "Added text"));
+
+    let mut indirect_params = fixture();
+    let params = indirect_params.add(Object::Dict(added_text_params()));
+    let text = tagged_stream(&mut indirect_params, "Added", Some(Object::Ref(params)));
+    set_page_contents(&mut indirect_params, text, None);
+    let indirect_scan = assert_marker_scan_matches_legacy(&indirect_params, "indirect PCAdded dictionary", &[], 1);
+    assert!(matches!(&indirect_scan.added[0].content, Content::Text(text) if text.text == "Added text"));
+
+    let mut image_only = fixture();
+    let image = image_only.add(Object::Stream(Stream::from_raw(Dict::new(), vec![0])));
+    let image_item = tagged_stream(&mut image_only, "Added", Some(Object::Dict(added_image_params(image))));
+    set_page_contents(&mut image_only, image_item, None);
+    let image_scan = assert_marker_scan_matches_legacy(&image_only, "one added image item", &[], 1);
+    assert!(matches!(&image_scan.added[0].content, Content::Image(item) if item.image == image));
+
+    let mut interleaved = fixture();
+    let text = tagged_stream(&mut interleaved, "Added", Some(Object::Dict(added_text_params())));
+    let watermark = tagged_stream(&mut interleaved, "Watermark", None);
+    let image = interleaved.add(Object::Stream(Stream::from_raw(Dict::new(), vec![0])));
+    let image_item = tagged_stream(&mut interleaved, "Added", Some(Object::Dict(added_image_params(image))));
+    let header = tagged_stream(&mut interleaved, "HeaderFooter", None);
+    set_page_contents(&mut interleaved, Object::Array(vec![text, watermark, image_item, header]), None);
+    let interleaved_scan =
+        assert_marker_scan_matches_legacy(&interleaved, "marks and added content interleaved", &[MarkKind::Watermark, MarkKind::HeaderFooter], 2);
+    assert!(matches!(&interleaved_scan.added[0].content, Content::Text(_)));
+    assert!(matches!(&interleaved_scan.added[1].content, Content::Image(_)));
+
+    let mut array_contents = fixture();
+    let background = tagged_stream(&mut array_contents, "Background", None);
+    let array_ref = array_contents.add(Object::Array(vec![background]));
+    set_page_contents(&mut array_contents, Object::Ref(array_ref), None);
+    assert_marker_scan_matches_legacy(&array_contents, "contents as an indirect array", &[MarkKind::Background], 0);
+
+    let mut malformed = fixture();
+    let indirect_mark = malformed.add(Object::Dict(tagged_dictionary("HeaderFooter", None)));
+    let missing_added = tagged_stream(&mut malformed, "Added", None);
+    let invalid_added = tagged_stream(&mut malformed, "Added", Some(Object::String(pdfcraft_cos::PdfString::text("bad params"))));
+    let unknown = tagged_stream(&mut malformed, "FutureKind", None);
+    let direct_watermark = Object::Dict(tagged_dictionary("Watermark", None));
+    let direct_added = Object::Dict(tagged_dictionary("Added", Some(Object::Dict(added_text_params()))));
+    set_page_contents(
+        &mut malformed,
+        Object::Array(vec![
+            Object::Null,
+            Object::Int(7),
+            Object::name("not-a-stream"),
+            direct_watermark,
+            Object::Ref(indirect_mark),
+            missing_added,
+            invalid_added,
+            unknown,
+            direct_added,
+        ]),
+        None,
+    );
+    assert_marker_scan_matches_legacy(
+        &malformed,
+        "malformed, non-stream, unknown and direct entries",
+        &[MarkKind::Watermark, MarkKind::HeaderFooter],
+        0,
+    );
+
+    let mut shared = fixture();
+    let added = tagged_stream(&mut shared, "Added", Some(Object::Dict(added_text_params())));
+    let mark = tagged_stream(&mut shared, "Background", None);
+    set_page_contents(&mut shared, Object::Array(vec![added.clone(), mark.clone(), added.clone(), mark]), None);
+    let shared_scan = assert_marker_scan_matches_legacy(&shared, "repeated shared stream references", &[MarkKind::Background], 2);
+    assert_eq!(shared_scan.added[0].obj, shared_scan.added[1].obj);
+
+    let mut user_unit = fixture();
+    let added = tagged_stream(&mut user_unit, "Added", Some(Object::Dict(added_text_params())));
+    set_page_contents(&mut user_unit, added, Some(Object::Int(2)));
+    let unit_scan = assert_marker_scan_matches_legacy(&user_unit, "non-1.0 UserUnit", &[], 1);
+    let Content::Text(text) = &unit_scan.added[0].content else { panic!() };
+    assert_eq!(text.rect, [20.0, 40.0, 220.0, 80.0]);
+    assert_eq!(text.size, 24.0);
+}
+
 #[test]
 fn added_text_and_images_are_page_content_that_stays_editable() {
     let mut doc = fixture();
@@ -656,6 +840,180 @@ fn japanese_paragraph_uses_unicode_type3_fallback() {
     assert_eq!(text::text_blocks(&reopened, 0).unwrap()[0].text, replacement);
 }
 
+/// The first `n` Japanese characters, in code point order, that every craft-fonts face can draw, so
+/// whichever face an edit picks has them all. Without craft-fonts there are no faces, every character
+/// passes, and the text is still long.
+fn covered_japanese_chars(n: usize) -> String {
+    let faces = pdfcraft_fonts::document_japanese_fonts_for_style(false, false);
+    (0x4E00..0xA000)
+        .filter_map(char::from_u32)
+        .filter(|ch| faces.iter().all(|face| pdfcraft_fonts::japanese_glyph_from(face, *ch).is_ok()))
+        .take(n)
+        .collect()
+}
+
+/// The page's Type 3 fallback fonts (`PCJp`, `PCJp1`, ...) by resource name.
+fn fallback_fonts(doc: &Document) -> Vec<(Vec<u8>, Dict)> {
+    let p = pdfcraft_model::pages(doc).swap_remove(0);
+    let res = doc.resolve(p.dict.get(b"Resources").unwrap());
+    let fonts = doc.resolve(res.as_dict().unwrap().get(b"Font").unwrap());
+    fonts
+        .as_dict()
+        .unwrap()
+        .iter()
+        .filter(|(name, _)| name.starts_with(b"PCJp"))
+        .map(|(name, font)| (name.clone(), doc.resolve(font).as_dict().unwrap().clone()))
+        .collect()
+}
+
+/// More unique fallback glyphs than one Type 3 font holds (240) are split across several generated
+/// fonts, each within that limit, and the text still reads back as one line.
+#[test]
+fn japanese_replacement_over_240_unique_glyphs_is_split_across_fallback_fonts() {
+    let replacement = covered_japanese_chars(300);
+    let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
+    if without_craft_fonts("japanese_replacement_over_240_unique_glyphs_is_split_across_fallback_fonts") {
+        // Without craft-fonts the long text gets the clear error, not the old limit message.
+        let err = text::replace_line(&mut doc, 0, 0, &replacement).unwrap_err().to_string();
+        assert!(err.contains("CRAFT_FONTS_DIR"), "{err}");
+        return;
+    }
+    text::replace_line(&mut doc, 0, 0, &replacement).unwrap();
+    let reopened = reopen(&doc);
+    let lines = text::text_lines(&reopened, 0).unwrap();
+    assert_eq!(lines.len(), 1, "one line: {:?}", lines.iter().map(|l| &l.text).collect::<Vec<_>>());
+    assert_eq!(lines[0].text, replacement);
+    let fonts = fallback_fonts(&reopened);
+    assert_eq!(fonts.len(), 2, "300 glyphs take a 240-glyph font and a 60-glyph font");
+    let mut glyphs = 0;
+    for (name, font) in &fonts {
+        let procs = reopened.resolve(font.get(b"CharProcs").unwrap());
+        let count = procs.as_dict().unwrap().len();
+        let last = font.get(b"LastChar").and_then(|o| o.as_int()).unwrap_or(i64::MAX);
+        assert!(count <= 240 && last <= 240, "{name:?}: {count} glyphs, LastChar {last}");
+        glyphs += count;
+    }
+    assert_eq!(glyphs, 300);
+}
+
+/// A replacement whose last glyph no face draws (in a later font) changes nothing: neither the
+/// document nor a snapshot taken before the edit, which is what undo restores.
+#[test]
+fn japanese_replacement_missing_a_glyph_after_240_changes_nothing() {
+    if without_craft_fonts("japanese_replacement_missing_a_glyph_after_240_changes_nothing") {
+        return;
+    }
+    // The first CJK character that no face draws: the 242nd unique character, in a second font.
+    let faces = pdfcraft_fonts::document_japanese_fonts_for_style(false, false);
+    let missing = (0x4E00u32..0x9FFF)
+        .filter_map(char::from_u32)
+        .find(|ch| faces.iter().all(|face| pdfcraft_fonts::japanese_glyph_from(face, *ch).is_err()))
+        .expect("some CJK character is outside every face");
+    let replacement = format!("{}{missing}", covered_japanese_chars(241));
+    let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
+    let saved = write_incremental(&doc, &SaveOptions::default()).unwrap();
+    let snapshot = doc.clone();
+    let err = text::replace_line(&mut doc, 0, 0, &replacement).unwrap_err().to_string();
+    assert!(err.contains(&format!("U+{:04X}", missing as u32)), "{err}");
+    assert_eq!(write_incremental(&doc, &SaveOptions::default()).unwrap(), saved);
+    assert_eq!(write_incremental(&snapshot, &SaveOptions::default()).unwrap(), saved);
+}
+
+/// Runs that change font move nothing: with two glyphs per font the text reads back the same, in the
+/// same box as with one font, and the font is switched only where the text moves to another font.
+#[test]
+fn japanese_fallback_split_across_fonts_keeps_order_and_positions() {
+    if without_craft_fonts("japanese_fallback_split_across_fonts_keeps_order_and_positions") {
+        return;
+    }
+    // 見 and 商 are in the first font, 御 in the second: runs [見商], [御], [見], three switches.
+    let replacement = "見商御見";
+    let mut whole = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
+    let mut split = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
+    text::replace_line_with_limit(&mut whole, 0, 0, replacement, 240).unwrap();
+    text::replace_line_with_limit(&mut split, 0, 0, replacement, 2).unwrap();
+    let (whole, split) = (reopen(&whole), reopen(&split));
+    assert_eq!(fallback_fonts(&whole).len(), 1);
+    assert_eq!(fallback_fonts(&split).len(), 2);
+    let (one, many) = (text::text_lines(&whole, 0).unwrap(), text::text_lines(&split, 0).unwrap());
+    assert_eq!(many.len(), 1, "one line: {:?}", many.iter().map(|l| &l.text).collect::<Vec<_>>());
+    assert_eq!(many[0].text, replacement);
+    for (a, b) in one[0].rect.iter().zip(many[0].rect.iter()) {
+        assert!((a - b).abs() < 1e-6, "box {:?} vs {:?}", one[0].rect, many[0].rect);
+    }
+    // One `Tf` per run plus the page's own switch to F2 and the switch back after the text.
+    let content = String::from_utf8_lossy(&page_content_bytes(&split, 0)).into_owned();
+    assert_eq!(content.matches(" Tf").count(), 5, "{content}");
+    let content = String::from_utf8_lossy(&page_content_bytes(&whole, 0)).into_owned();
+    assert_eq!(content.matches(" Tf").count(), 3, "{content}");
+}
+
+/// Only a change of font gets a `Tf`: alternating characters with one glyph per font switch at every
+/// character, and a run of one font's characters switches nowhere.
+#[test]
+fn japanese_fallback_switches_font_only_between_runs() {
+    if without_craft_fonts("japanese_fallback_switches_font_only_between_runs") {
+        return;
+    }
+    let alternating = "見商".repeat(500);
+    let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
+    text::replace_line_with_limit(&mut doc, 0, 0, &alternating, 1).unwrap();
+    let reopened = reopen(&doc);
+    assert_eq!(text::text_lines(&reopened, 0).unwrap()[0].text, alternating);
+    let content = String::from_utf8_lossy(&page_content_bytes(&reopened, 0)).into_owned();
+    assert_eq!(content.matches(" Tf").count(), 1000 + 2, "1000 runs, the F2 switch before and after");
+    let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
+    text::replace_line_with_limit(&mut doc, 0, 0, "見見見", 1).unwrap();
+    let content = String::from_utf8_lossy(&page_content_bytes(&reopen(&doc), 0)).into_owned();
+    assert_eq!(content.matches(" Tf").count(), 1 + 1 + 1, "{content}");
+}
+
+/// A paragraph set in several fallback fonts reads back as one block with the same text, and it
+/// wraps across lines.
+#[test]
+fn japanese_paragraph_split_across_fonts_reads_back_as_one_block() {
+    if without_craft_fonts("japanese_paragraph_split_across_fonts_reads_back_as_one_block") {
+        return;
+    }
+    // Spaces are glyphs too, so two glyphs per font needs several fonts; the narrow box wraps the text.
+    let replacement = "見 商 御 見 商";
+    let style = text::BlockStyle { width: Some(40.0), ..Default::default() };
+    let mut doc = text_page("BT /F2 12 Tf 72 700 Td (ab) Tj ET");
+    text::rewrite_block_with_limit(&mut doc, 0, 0, Some(replacement), &style, 2).unwrap();
+    let reopened = reopen(&doc);
+    assert!(fallback_fonts(&reopened).len() >= 2);
+    let blocks = text::text_blocks(&reopened, 0).unwrap();
+    assert_eq!(blocks.len(), 1, "one paragraph: {:?}", blocks.iter().map(|b| &b.text).collect::<Vec<_>>());
+    assert_eq!(blocks[0].text, replacement);
+    assert!(blocks[0].lines.len() > 1, "wrapped to {} line(s)", blocks[0].lines.len());
+}
+
+/// A paragraph whose move or width is refused (not finite, or drawn in a space it cannot be moved in)
+/// leaves the document as it was: the fallback fonts are written only once the edit is accepted.
+#[test]
+fn japanese_paragraph_refused_before_its_fallback_fonts_are_written() {
+    if without_craft_fonts("japanese_paragraph_refused_before_its_fallback_fonts_are_written") {
+        return;
+    }
+    let plain = "BT /F2 12 Tf 72 700 Td (ab) Tj ET";
+    let cases = [
+        (plain, text::BlockStyle { offset: Some([f64::NAN, 0.0]), ..Default::default() }, "can't be moved that far"),
+        (plain, text::BlockStyle { width: Some(f64::INFINITY), ..Default::default() }, "width must be a number"),
+        (
+            "0 0 0 0 0 0 cm BT /F2 12 Tf 72 700 Td (ab) Tj ET",
+            text::BlockStyle { offset: Some([5.0, 0.0]), ..Default::default() },
+            "can't be moved in",
+        ),
+    ];
+    for (content, style, message) in cases {
+        let mut doc = text_page(content);
+        let saved = write_incremental(&doc, &SaveOptions::default()).unwrap();
+        let err = text::rewrite_block(&mut doc, 0, 0, Some("見本商会　御中"), &style).unwrap_err().to_string();
+        assert!(err.contains(message), "{err}");
+        assert_eq!(write_incremental(&doc, &SaveOptions::default()).unwrap(), saved, "{message}: the document changed");
+    }
+}
+
 /// Every Type 3 fallback glyph starts with a well-formed `d1`: six operands, the second 0, and a
 /// box that encloses every point of the glyph. Acrobat shows a bullet for a glyph whose `d1`
 /// has the wrong operand count.
@@ -1003,7 +1361,10 @@ fn page_content_bytes(doc: &Document, page: usize) -> Vec<u8> {
 
 /// A page drawing image XObject /Im0 at 100,100 size 200 × 100 (pixels 4 × 2).
 fn image_page() -> Document {
-    let content = "q 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Caption) Tj ET";
+    image_page_with("q 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Caption) Tj ET")
+}
+
+fn image_page_with(content: &str) -> Document {
     let objs: Vec<String> = vec![
         "<< /Type /Catalog /Pages 2 0 R >>".into(),
         "<< /Type /Pages /Kids [3 0 R] /Count 1 >>".into(),
@@ -1027,6 +1388,49 @@ fn image_page() -> Document {
     Document::open(Arc::new(out)).unwrap()
 }
 
+/// The box of the first `re` on the page in user space, after the `cm`s before it.
+fn first_rect_in_user_space(doc: &Document) -> [f64; 4] {
+    let mut ctm = pdfcraft_content::Matrix::IDENTITY;
+    for op in pdfcraft_content::parse(&page_content_bytes(doc, 0)).ops {
+        if op.is("cm") {
+            ctm = pdfcraft_content::Matrix(op.nums::<6>().unwrap()).then(&ctm);
+        } else if op.is("re") {
+            let [x, y, w, h] = op.nums::<4>().unwrap();
+            return ctm.bbox([x, y, x + w, y + h]);
+        }
+    }
+    panic!("no clip rectangle");
+}
+
+#[test]
+fn moving_an_image_moves_its_own_clip_too() {
+    let content = "q 100 100 200 100 re W* n 200 0 0 100 100 100 cm /Im0 Do Q BT /F1 12 Tf 72 700 Td (Caption) Tj ET";
+    let target = [50.0, 400.0, 350.0, 600.0];
+    let mut doc = image_page_with(content);
+    let before = images::page_images(&doc, 0).unwrap()[0].rect;
+    images::change_image(&mut doc, 0, 0, &images::ImageChange::Transform(images::rect_to_rect(before, target))).unwrap();
+    let mut doc = reopen(&doc);
+    assert!(close(images::page_images(&doc, 0).unwrap()[0].rect, target));
+    assert!(close(first_rect_in_user_space(&doc), target), "{:?}", first_rect_in_user_space(&doc));
+    // A second edit still finds the clip, now behind the `cm` the first one put before it.
+    let moved = [80.0, 420.0, 380.0, 620.0];
+    images::change_image(&mut doc, 0, 0, &images::ImageChange::Transform(images::rect_to_rect(target, moved))).unwrap();
+    assert!(close(first_rect_in_user_space(&doc), moved));
+    images::translate_images(&mut doc, 0, &[0], [10.0, 0.0]).unwrap();
+    assert!(close(images::page_images(&doc, 0).unwrap()[0].rect, [90.0, 420.0, 390.0, 620.0]));
+    assert!(close(first_rect_in_user_space(&doc), [90.0, 420.0, 390.0, 620.0]));
+    // Moving it with the group move helper takes the clip along as well.
+    let mut doc = image_page_with(content);
+    images::translate_images(&mut doc, 0, &[0], [30.0, -20.0]).unwrap();
+    assert!(close(images::page_images(&doc, 0).unwrap()[0].rect, [130.0, 80.0, 330.0, 180.0]));
+    assert!(close(first_rect_in_user_space(&doc), [130.0, 80.0, 330.0, 180.0]));
+    // A clip shared with other drawing is left where it is.
+    let shared = "q 100 100 200 100 re W n q 200 0 0 100 100 100 cm /Im0 Do Q 0 0 10 10 re f Q";
+    let mut doc = image_page_with(shared);
+    images::change_image(&mut doc, 0, 0, &images::ImageChange::Transform(images::rect_to_rect(before, target))).unwrap();
+    assert!(close(first_rect_in_user_space(&doc), [100.0, 100.0, 300.0, 200.0]));
+}
+
 fn close(a: [f64; 4], b: [f64; 4]) -> bool {
     a.iter().zip(b).all(|(x, y)| (x - y).abs() < 1e-6)
 }
diff --git a/crates/edit/src/text.rs b/crates/edit/src/text.rs
index 2d1b07f1..e84ab1ad 100644
--- a/crates/edit/src/text.rs
+++ b/crates/edit/src/text.rs
@@ -38,6 +38,8 @@ pub struct TextLine {
     /// Whether new text in this font can only be shown by substituting another font (no
     /// Unicode mapping for the line, so nothing could be reused).
     pub decodable: bool,
+    /// The Japanese fallback face the font subsets, when the line is in one (see [`same_font`]).
+    face: Option<String>,
     /// The content stream piece the line starts in, and its operators (indices into the page's
     /// streams parsed joined).
     stream: usize,
@@ -127,6 +129,14 @@ impl TextLine {
     pub fn origin_baseline(&self) -> f64 {
         self.origin.baseline
     }
+
+    /// Paint position of the line's last text-showing operator: `(content-stream index,
+    /// operator index in the page's joined stream)`. Lines paint in order of this tuple.
+    /// (Lines from `text_lines` never come from form XObjects, so `stream` is always a
+    /// page content-stream index and `ops` are indices into the joined operator list.)
+    pub fn paint_pos(&self) -> (usize, usize) {
+        (self.stream, self.ops.iter().max().copied().unwrap_or(0))
+    }
 }
 
 /// What replacing a line did.
@@ -142,6 +152,8 @@ struct Ts {
     /// The operators that set the current fill colour (`g`, `rg`, `k`, or `cs` + `sc`/`scn`).
     fill: Vec<Op>,
     font: Option<(Vec<u8>, Rc<Metrics>)>,
+    /// The Japanese fallback face the font subsets, when the font is one (see [`is_japanese_fallback`]).
+    face: Option<String>,
     size: f64,
     char_spacing: f64,
     word_spacing: f64,
@@ -265,6 +277,7 @@ struct Shown {
     bt: usize,
     font: Vec<u8>,
     base_font: String,
+    face: Option<String>,
     size: f64,
     bold: bool,
     italic: bool,
@@ -285,6 +298,7 @@ impl Carry {
             ctm: Matrix::IDENTITY,
             fill: Vec::new(),
             font: None,
+            face: None,
             size: 0.0,
             char_spacing: 0.0,
             word_spacing: 0.0,
@@ -304,7 +318,7 @@ fn interpret(
     doc: &Document,
     ops: &[Op],
     fonts_res: &Dict,
-    cache: &mut HashMap<Vec<u8>, Rc<Metrics>>,
+    cache: &mut HashMap<Vec<u8>, (Rc<Metrics>, Option<String>)>,
     carry: &mut Carry,
     mut invoked: Option<&mut Vec<Invocation>>,
 ) -> Vec<Shown> {
@@ -341,16 +355,14 @@ fn interpret(
             b"Tf" => {
                 ts.size = op.num(1).unwrap_or(ts.size);
                 if let Some(name) = op.name(0) {
-                    let m = cache.entry(name.to_vec()).or_insert_with(|| {
-                        Rc::new(
-                            fonts_res
-                                .get(name)
-                                .and_then(|f| doc.resolve(f).as_dict().cloned())
-                                .map(|d| Metrics::from_dict(doc, &d))
-                                .unwrap_or_else(Metrics::fallback),
-                        )
+                    let (m, face) = cache.entry(name.to_vec()).or_insert_with(|| {
+                        let dict = fonts_res.get(name).and_then(|f| doc.resolve(f).as_dict().cloned());
+                        let metrics = dict.as_ref().map_or_else(Metrics::fallback, |d| Metrics::from_dict(doc, d));
+                        let face = dict.filter(is_japanese_fallback).map(|_| metrics.base_font.clone());
+                        (Rc::new(metrics), face)
                     });
                     ts.font = Some((name.to_vec(), m.clone()));
+                    ts.face = face.clone();
                 }
             }
             b"Tc" => ts.char_spacing = op.num(0).unwrap_or(0.0),
@@ -460,6 +472,7 @@ fn interpret(
                     bt,
                     font: name,
                     base_font: m.base_font.clone(),
+                    face: ts.face.clone(),
                     size: if size_user > 0.0 { size_user } else { ts.size },
                     bold: m.bold,
                     italic: m.italic,
@@ -495,7 +508,7 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
         let joins = last.is_some_and(|(piece, bt, base, end, size)| {
             piece == si
                 && bt == s.bt
-                && lines.last().is_some_and(|l| l.font.as_bytes() == s.font.as_slice())
+                && lines.last().is_some_and(|l| same_font(l, &s.font, s.face.as_deref()))
                 && lines.last().is_some_and(|l| {
                     (s.size - l.size).abs() < 0.01 && s.bold == l.bold && s.italic == l.italic && fill_color(&s.state.fill) == l.color
                 })
@@ -524,6 +537,7 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
                 italic: s.italic,
                 color: fill_color(&s.state.fill),
                 decodable: s.decodable,
+                face: s.face.clone(),
                 stream: si,
                 ops: vec![s.op],
                 origin: Origin {
@@ -551,7 +565,7 @@ pub fn text_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditErro
 fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<(usize, f64, f64, f64)>, s: Shown, stream: usize) {
     let joins = last.is_some_and(|(bt, base, end, size)| {
         bt == s.bt
-            && lines.last().is_some_and(|l| l.font.as_bytes() == s.font.as_slice())
+            && lines.last().is_some_and(|l| same_font(l, &s.font, s.face.as_deref()))
             && lines
                 .last()
                 .is_some_and(|l| (s.size - l.size).abs() < 0.01 && s.bold == l.bold && s.italic == l.italic && fill_color(&s.state.fill) == l.color)
@@ -580,6 +594,7 @@ fn add_shown(lines: &mut Vec<TextLine>, last: &mut Option<(usize, f64, f64, f64)
             italic: s.italic,
             color: fill_color(&s.state.fill),
             decodable: s.decodable,
+            face: s.face.clone(),
             stream,
             ops: vec![s.op],
             origin: Origin {
@@ -713,8 +728,8 @@ fn reading_lines(doc: &Document, page: usize) -> Result<Vec<TextLine>, EditError
     Ok(lines)
 }
 
-/// Text → the bytes that show it in the chosen font.
-type Encoder = Box<dyn Fn(&str) -> Option<Vec<u8>>>;
+/// Text → the runs that show it: each run's font resource name and the bytes shown in that font.
+type Encoder = Box<dyn Fn(&str) -> Option<Vec<(String, Vec<u8>)>>>;
 
 fn is_win_ansi_char(c: char) -> bool {
     c == '\t' || pdfcraft_fonts::win_ansi_byte(c).is_some()
@@ -724,6 +739,21 @@ fn needs_type3(text: &str) -> bool {
     text.chars().any(|c| !is_win_ansi_char(c))
 }
 
+/// The `/Name` of the Type 3 fonts generated for Japanese text.
+const JAPANESE_FONT_NAME: &str = "PCJapanese";
+
+/// Whether `font` is one of those generated fonts: a replacement longer than one of them is split
+/// across several, which read back as one line (see [`same_font`]).
+fn is_japanese_fallback(font: &Dict) -> bool {
+    font.name(b"Subtype") == Some(b"Type3") && font.name(b"Name") == Some(JAPANESE_FONT_NAME.as_bytes())
+}
+
+/// Whether a run shown in `font` (a resource name, and the Japanese fallback face it subsets, if
+/// any) continues `line`: the same font resource, or another subset of the same face.
+fn same_font(line: &TextLine, font: &[u8], face: Option<&str>) -> bool {
+    line.font.as_bytes() == font || (line.face.is_some() && line.face.as_deref() == face)
+}
+
 fn source_family(base_font: &str) -> crate::added::Family {
     let name = base_font.to_ascii_lowercase();
     if ["courier", "mono", "consolas", "menlo", "monaco", "lucida console"].iter().any(|s| name.contains(s)) {
@@ -741,12 +771,26 @@ const SUBSTITUTE_NAME: &str = "PCEdHelv";
 const SUBSTITUTE: &[u8] = SUBSTITUTE_NAME.as_bytes();
 const MAX_TYPE3_GLYPHS: usize = 240;
 
+/// The generated fonts for one replacement: one per run of at most `max_glyphs` unique characters,
+/// in order of first appearance.
 #[derive(Clone)]
 struct Type3Fallback {
-    name: String,
     /// The family its glyphs come from ("Shippori Mincho").
     family: &'static str,
-    codes: Vec<(char, u8, f64)>,
+    /// The fonts' resource names in order; the first is `PCJp`.
+    names: Vec<String>,
+    /// Every unique character with its advance (em), in order of first appearance.
+    widths: Vec<(char, f64)>,
+    /// Where each character is shown: the index of its font in `names`, and its code there.
+    codes: HashMap<char, (usize, u8)>,
+}
+
+/// One glyph of a generated font: its code there, its character, its glyph procedure and advance.
+struct Type3Glyph {
+    code: u8,
+    ch: char,
+    path: Vec<u8>,
+    width: f64,
 }
 
 fn pdf_num(v: f64) -> String {
@@ -821,14 +865,20 @@ fn fallback_face<'a>(faces: &[&'a CraftFont], chars: &[char], has_glyph: impl Fn
     faces.iter().copied().find(|face| chars.iter().all(|ch| has_glyph(face, *ch))).or_else(|| faces.first().copied())
 }
 
-fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str, family: crate::added::Family, bold: bool) -> Result<Type3Fallback, EditError> {
+fn type3_font(
+    doc: &mut Document,
+    fonts_res: &mut Dict,
+    text: &str,
+    family: crate::added::Family,
+    bold: bool,
+    max_glyphs: usize,
+) -> Result<Type3Fallback, EditError> {
     let faces = pdfcraft_fonts::document_japanese_fonts_for_style(family == crate::added::Family::Times, bold);
+    // Each unique character once, in order of first appearance.
     let mut chars = Vec::new();
+    let mut seen = std::collections::HashSet::new();
     for ch in text.chars() {
-        if !chars.contains(&ch) {
-            if chars.len() >= MAX_TYPE3_GLYPHS {
-                return Err(EditError::Invalid("Japanese replacement has too many unique characters".into()));
-            }
+        if seen.insert(ch) {
             chars.push(ch);
         }
     }
@@ -838,27 +888,54 @@ fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str, family: crat
     // The faces differ in coverage (e.g. of Cyrillic), so use the best face that has every
     // character. When none has them all, the best face reports the character it lacks.
     let face = fallback_face(&faces, &chars, |face, ch| japanese_glyph_from(face, ch).is_ok()).ok_or_else(no_japanese_font)?;
-    let family = face.family;
-    let mut codes = Vec::with_capacity(chars.len());
+    // Every outline is read before the document is touched, so a character that fails leaves it
+    // as it was. Each font takes the next `per_font` characters; codes restart at 1 in each.
+    let per_font = max_glyphs.clamp(1, MAX_TYPE3_GLYPHS);
+    let mut glyphs = Vec::with_capacity(chars.len());
+    for (i, ch) in chars.into_iter().enumerate() {
+        let (path, width) = type3_path(face, ch)?;
+        let code = u8::try_from((i % per_font).saturating_add(1))
+            .map_err(|_| EditError::Invalid("Japanese replacement has too many unique characters".into()))?;
+        glyphs.push(Type3Glyph { code, ch, path, width });
+    }
+    let mut codes = HashMap::with_capacity(glyphs.len());
+    let mut widths = Vec::with_capacity(glyphs.len());
+    let mut names = Vec::new();
+    let mut glyphs = glyphs.into_iter();
+    loop {
+        let group: Vec<Type3Glyph> = glyphs.by_ref().take(per_font).collect();
+        if group.is_empty() {
+            break;
+        }
+        for glyph in &group {
+            codes.insert(glyph.ch, (names.len(), glyph.code));
+            widths.push((glyph.ch, glyph.width));
+        }
+        names.push(add_type3_font(doc, fonts_res, face, group));
+    }
+    Ok(Type3Fallback { family: face.family, names, widths, codes })
+}
+
+/// Adds one generated font whose codes 1 to `glyphs.len()` show `glyphs`, and returns its resource
+/// name (`PCJp`, then `PCJp1`, ...). Nothing here can fail: the outlines were read already.
+fn add_type3_font(doc: &mut Document, fonts_res: &mut Dict, face: &CraftFont, glyphs: Vec<Type3Glyph>) -> String {
+    let last_char = glyphs.len();
     let mut charprocs = Dict::new();
-    let mut widths = Vec::with_capacity(chars.len());
+    let mut widths = Vec::with_capacity(last_char);
     let mut differences = vec![Object::Int(1)];
     let mut cmap = String::from(
         "/CIDInit /ProcSet findresource begin\n12 dict begin\nbegincmap\n/CMapType 2 def\n1 begincodespacerange\n<01> <FF>\nendcodespacerange\n",
     );
-    cmap.push_str(&format!("{} beginbfchar\n", chars.len()));
-    for (i, ch) in chars.into_iter().enumerate() {
-        let code = u8::try_from(i + 1).map_err(|_| EditError::Invalid("Japanese replacement has too many unique characters".into()))?;
-        let glyph_name = format!("g{code:02X}");
-        let (path, width) = type3_path(face, ch)?;
+    cmap.push_str(&format!("{last_char} beginbfchar\n"));
+    for glyph in glyphs {
+        let glyph_name = format!("g{:02X}", glyph.code);
         let mut pd = Dict::new();
-        pd.set(b"Length".to_vec(), path.len() as i64);
-        let proc_ref = doc.add(Object::Stream(Stream::from_raw(pd, path)));
+        pd.set(b"Length".to_vec(), glyph.path.len() as i64);
+        let proc_ref = doc.add(Object::Stream(Stream::from_raw(pd, glyph.path)));
         charprocs.set(glyph_name.as_bytes().to_vec(), Object::Ref(proc_ref));
         differences.push(Object::name(&glyph_name));
-        widths.push(Object::Real((width * 1000.0).round()));
-        cmap.push_str(&format!("<{code:02X}> <{}>\n", unicode_hex(ch)));
-        codes.push((ch, code, width));
+        widths.push(Object::Real((glyph.width * 1000.0).round()));
+        cmap.push_str(&format!("<{:02X}> <{}>\n", glyph.code, unicode_hex(glyph.ch)));
     }
     cmap.push_str("endbfchar\nendcmap\nCMapName currentdict /CMap defineresource pop\nend\nend\n");
     let mut cmap_dict = Dict::new();
@@ -870,7 +947,7 @@ fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str, family: crat
     let mut font = Dict::new();
     font.set(b"Type".to_vec(), Object::name("Font"));
     font.set(b"Subtype".to_vec(), Object::name("Type3"));
-    font.set(b"Name".to_vec(), Object::name("PCJapanese"));
+    font.set(b"Name".to_vec(), Object::name(JAPANESE_FONT_NAME));
     let mut descriptor = Dict::new();
     descriptor.set(b"Type".to_vec(), Object::name("FontDescriptor"));
     descriptor.set(b"FontName".to_vec(), Object::name(&format!("{}-{}", face.family, face.style).replace(' ', "")));
@@ -885,7 +962,7 @@ fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str, family: crat
         Object::Array(vec![Object::Real(0.001), Object::Int(0), Object::Int(0), Object::Real(0.001), Object::Int(0), Object::Int(0)]),
     );
     font.set(b"FirstChar".to_vec(), Object::Int(1));
-    font.set(b"LastChar".to_vec(), Object::Int(codes.len() as i64));
+    font.set(b"LastChar".to_vec(), Object::Int(last_char as i64));
     font.set(b"Widths".to_vec(), Object::Array(widths));
     font.set(b"Encoding".to_vec(), Object::Dict(encoding));
     font.set(b"CharProcs".to_vec(), Object::Dict(charprocs));
@@ -897,15 +974,30 @@ fn type3_font(doc: &mut Document, fonts_res: &mut Dict, text: &str, family: crat
         name = format!("PCJp{suffix}");
     }
     fonts_res.set(name.as_bytes().to_vec(), Object::Dict(font));
-    Ok(Type3Fallback { name, family, codes })
+    name
 }
 
-fn type3_encode(fallback: &Type3Fallback, text: &str) -> Option<Vec<u8>> {
-    text.chars().map(|ch| fallback.codes.iter().find(|(c, _, _)| *c == ch).map(|(_, code, _)| *code)).collect()
+/// The runs that show `text` in the fallback: consecutive characters in one font form one run, so
+/// a font is switched only where the text moves to another font. `None` if a character has no code.
+fn type3_encode(fallback: &Type3Fallback, text: &str) -> Option<Vec<(String, Vec<u8>)>> {
+    let mut runs: Vec<(usize, Vec<u8>)> = Vec::new();
+    for ch in text.chars() {
+        let (font, code) = *fallback.codes.get(&ch)?;
+        match runs.last_mut() {
+            Some((last, bytes)) if *last == font => bytes.push(code),
+            _ => runs.push((font, vec![code])),
+        }
+    }
+    runs.into_iter().map(|(font, bytes)| Some((fallback.names.get(font)?.clone(), bytes))).collect()
 }
 
 /// Replace the text of line `line` (an index into [`text_lines`]) on `page` with `text`.
 pub fn replace_line(doc: &mut Document, page: usize, line: usize, text: &str) -> Result<LineEdit, EditError> {
+    replace_line_with_limit(doc, page, line, text, MAX_TYPE3_GLYPHS)
+}
+
+/// [`replace_line`] with the most unique characters one generated font may hold (tests lower it).
+pub(crate) fn replace_line_with_limit(doc: &mut Document, page: usize, line: usize, text: &str, max_glyphs: usize) -> Result<LineEdit, EditError> {
     let text = text.replace(['\n', '\r'], " ");
     let lines = text_lines(doc, page)?;
     let target = lines.get(line).cloned().ok_or_else(|| EditError::Invalid(format!("page {} has no line {}", page + 1, line + 1)))?;
@@ -935,12 +1027,14 @@ pub fn replace_line(doc: &mut Document, page: usize, line: usize, text: &str) ->
         Some(bytes) => replacement.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))])),
         None => {
             if needs_type3(&text) {
-                let fallback = type3_font(doc, &mut fonts_res, &text, source_family(&target.base_font), target.bold)?;
-                let bytes = type3_encode(&fallback, &text)
+                let fallback = type3_font(doc, &mut fonts_res, &text, source_family(&target.base_font), target.bold, max_glyphs)?;
+                let runs = type3_encode(&fallback, &text)
                     .ok_or_else(|| EditError::Invalid(format!("\"{text}\" can't be shown by the Japanese fallback")))?;
                 let size = font_size_before(&ops, first).unwrap_or(target.size);
-                replacement.push(Op::new("Tf", vec![Object::name(&fallback.name), pdfcraft_content::num(size)]));
-                replacement.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
+                for (name, bytes) in runs {
+                    replacement.push(Op::new("Tf", vec![Object::name(&name), pdfcraft_content::num(size)]));
+                    replacement.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
+                }
                 replacement.push(Op::new("Tf", vec![Object::name(&target.font), pdfcraft_content::num(size)]));
                 substituted = Some(format!("{} Type3", fallback.family));
             } else {
@@ -1043,7 +1137,7 @@ fn group_blocks(lines: &[TextLine]) -> Vec<TextBlock> {
                 let prev = &lines[p];
                 let g = prev.origin.baseline - l.origin.baseline;
                 prev.stream == l.stream
-                    && prev.font == l.font
+                    && same_font(prev, l.font.as_bytes(), l.face.as_deref())
                     && prev.base_font == l.base_font
                     && prev.bold == l.bold
                     && prev.italic == l.italic
@@ -1144,6 +1238,18 @@ pub struct BlockStyle {
 
 /// Rewrite paragraph `block` with new text (or its own) and formatting, rewrapped to its width.
 pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option<&str>, style: &BlockStyle) -> Result<LineEdit, EditError> {
+    rewrite_block_with_limit(doc, page, block, text, style, MAX_TYPE3_GLYPHS)
+}
+
+/// [`rewrite_block`] with the most unique characters one generated font may hold (tests lower it).
+pub(crate) fn rewrite_block_with_limit(
+    doc: &mut Document,
+    page: usize,
+    block: usize,
+    text: Option<&str>,
+    style: &BlockStyle,
+    max_glyphs: usize,
+) -> Result<LineEdit, EditError> {
     let lines = text_lines(doc, page)?;
     let blocks = group_blocks(&lines);
     let b = blocks.get(block).cloned().ok_or_else(|| EditError::Invalid(format!("page {} has no paragraph {}", page + 1, block + 1)))?;
@@ -1175,7 +1281,6 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
     // The chosen style also determines the real Japanese fallback outlines and advances.
     let (family, bold, italic) = style.family.unwrap_or((source_family(&b.base_font), b.bold, b.italic));
     let bold = style.bold.unwrap_or(bold);
-    let type3 = if !reuse && needs_type3(&text) { Some(type3_font(doc, &mut fonts_res, &text, family, bold)?) } else { None };
     let std_width = move |s: &str, size: f64| -> f64 {
         match family {
             crate::added::Family::Courier => s.chars().count() as f64 * 0.6 * size,
@@ -1196,6 +1301,19 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
         None if members.len() == 1 => (b.rect[2] - b.rect[0]).max(size * k).max(p.crop(doc)[2] - 36.0 - (b.rect[0] + dx)),
         None => (b.rect[2] - b.rect[0]).max(size * k),
     };
+    // The move and the width are checked here, before the fallback fonts are written: a refused
+    // paragraph leaves the document as it was. The move is in page space, so it is taken back through
+    // the CTM's linear part into the space the paragraph is drawn in.
+    let movement = if dx != 0.0 || dy != 0.0 {
+        let c = o.ctm;
+        let back = Matrix([c[0], c[1], c[2], c[3], 0.0, 0.0])
+            .invert()
+            .ok_or_else(|| EditError::Invalid("the paragraph is drawn in a space it can't be moved in".into()))?;
+        Some(back.apply(dx, dy))
+    } else {
+        None
+    };
+    let type3 = if !reuse && needs_type3(&text) { Some(type3_font(doc, &mut fonts_res, &text, family, bold, max_glyphs)?) } else { None };
     let advance = |s: &str| -> f64 {
         let t = match (&metrics, reuse) {
             (Some(m), true) => m
@@ -1208,7 +1326,13 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
                 })
                 .unwrap_or(0.0),
             _ if let Some(fallback) = &type3 => {
-                fallback.codes.iter().map(|(ch, _, width)| s.chars().filter(|c| c == ch).count() as f64 * width * size).sum::<f64>()
+                // Each character's count in `s`, from one pass over `s`.
+                let mut counts: HashMap<char, usize> = HashMap::new();
+                for c in s.chars() {
+                    let count = counts.entry(c).or_insert(0);
+                    *count = count.saturating_add(1);
+                }
+                fallback.widths.iter().map(|(ch, width)| counts.get(ch).copied().unwrap_or(0) as f64 * width * size).sum::<f64>()
                     + s.chars().count() as f64 * o_state.char_spacing
             }
             _ => std_width(s, size) + s.chars().count() as f64 * o_state.char_spacing,
@@ -1219,12 +1343,12 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
     let mut substituted = None;
     let new_font = !reuse;
     let (show_font, encode): (String, Encoder) = if let Some(m) = metrics.clone().filter(|_| reuse) {
-        (font_name.clone(), Box::new(move |s: &str| m.encode(s)))
+        let name = font_name.clone();
+        (font_name.clone(), Box::new(move |s: &str| m.encode(s).map(|bytes| vec![(name.clone(), bytes)])))
     } else if let Some(fallback) = type3.clone() {
-        let name = fallback.name.clone();
-        let encoder = fallback.clone();
         substituted = Some(format!("{} Type3", fallback.family));
-        (name, Box::new(move |s: &str| type3_encode(&encoder, s)))
+        let first = fallback.names.first().cloned().ok_or_else(no_japanese_font)?;
+        (first, Box::new(move |s: &str| type3_encode(&fallback, s)))
     } else {
         let win = pdfcraft_fonts::win_ansi(&text);
         let back: String = win.iter().map(|c| char::from_u32(u32::from(*c)).unwrap_or('?')).collect();
@@ -1242,7 +1366,8 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
         if style.family.is_none() {
             substituted = Some(base.to_string());
         }
-        (name, Box::new(|s: &str| Some(pdfcraft_fonts::win_ansi(s))))
+        let shown = name.clone();
+        (name, Box::new(move |s: &str| Some(vec![(shown.clone(), pdfcraft_fonts::win_ansi(s))])))
     };
     // Line spacing in text space: the paragraph's own (scaled with the size), or 1.2 × the size.
     let lead = match style.line_spacing {
@@ -1254,19 +1379,15 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
     let n = pdfcraft_content::num;
     // In its own graphics state, so a new colour (or anything else) stops at the paragraph.
     let mut block_ops = vec![Op::new("q", vec![])];
-    // Moved: a translation inside that state. The move is in page space, so it is taken back
-    // through the CTM's linear part into the space the paragraph is drawn in.
-    if dx != 0.0 || dy != 0.0 {
-        let c = o.ctm;
-        let back = Matrix([c[0], c[1], c[2], c[3], 0.0, 0.0])
-            .invert()
-            .ok_or_else(|| EditError::Invalid("the paragraph is drawn in a space it can't be moved in".into()))?;
-        let (ax, ay) = back.apply(dx, dy);
+    // Moved: a translation inside that state.
+    if let Some((ax, ay)) = movement {
         block_ops.push(Op::new("cm", vec![n(1.0), n(0.0), n(0.0), n(1.0), n(ax), n(ay)]));
     }
     block_ops.push(Op::new("BT", vec![]));
     let mut state = o_state.clone();
     state.word_spacing = 0.0;
+    // The font the next run is shown in: the one the BT sets, until a run of another fallback subset.
+    let mut shown_font = show_font.clone();
     state.font = Some((show_font, size));
     if let Some([r, g, bl]) = style.color {
         state.fill = vec![Op::new("rg", vec![n(r), n(g), n(bl)])];
@@ -1301,8 +1422,13 @@ pub fn rewrite_block(doc: &mut Document, page: usize, block: usize, text: Option
             block_ops.push(Op::new("Tw", vec![n(tw)]));
             tw_set = tw;
         }
-        let bytes = encode(line).ok_or_else(|| EditError::Invalid(format!("\"{line}\" can't be shown")))?;
-        block_ops.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
+        for (font, bytes) in encode(line).ok_or_else(|| EditError::Invalid(format!("\"{line}\" can't be shown")))? {
+            if font != shown_font {
+                block_ops.push(Op::new("Tf", vec![Object::name(&font), n(size)]));
+                shown_font = font;
+            }
+            block_ops.push(Op::new("Tj", vec![Object::String(PdfString::literal(bytes))]));
+        }
         let w = (advance(line) + tw * spaces as f64 * o_state.scale * k) / k;
         underlines.push((dx, dx + w, -(i as f64) * lead - size * 0.12));
     }
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index bcf762fc..eecbb35c 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -18,6 +18,7 @@ pdfcraft-annot = { workspace = true }
 pdfcraft-forms = { workspace = true }
 pdfcraft-xfa = { workspace = true }
 pdfcraft-edit = { workspace = true }
+pdfcraft-audit = { workspace = true }
 pdfcraft-redact = { workspace = true }
 pdfcraft-print = { workspace = true }
 pdfcraft-xfdf = { workspace = true }
@@ -32,6 +33,7 @@ pdfcraft-export = { workspace = true }
 pdfcraft-fonts = { workspace = true }
 pdfcraft-create = { workspace = true }
 pdfcraft-model = { workspace = true }
+pdfcraft-geom = { workspace = true }
 thiserror = { workspace = true }
 png = "0.18"
 # Already in the graph (url and idna through webbrowser, icu_properties through boa): they show
diff --git a/crates/engine/src/camera.rs b/crates/engine/src/camera.rs
new file mode 100644
index 00000000..69318a80
--- /dev/null
+++ b/crates/engine/src/camera.rs
@@ -0,0 +1,280 @@
+//! Scan & OCR ▸ Enhance ▸ Camera image: straighten a photographed document. Four corners on the
+//! page (PDF user space) are warped to a rectangle, and the page's content becomes that picture
+//! (one undoable step, through Replace Pages, so the page's comments, links and bookmarks stay).
+
+use std::sync::Arc;
+
+use pdfcraft_geom::perspective::{Homography, Point, order_quad};
+use pdfcraft_render::{RenderConfig, RenderRequest};
+
+use crate::{DocId, Edit, EditError, ImageResolution, Session};
+
+/// The densest the page is read at: 600 dpi, as for OCR.
+const MAX_SCALE: f32 = 600.0 / 72.0;
+/// The resolution a page without a picture is read at.
+const DEFAULT_SCALE: f32 = 300.0 / 72.0;
+/// The most pixels the page is rendered with, and the straightened picture has.
+const MAX_PIXELS: f64 = 40_000_000.0;
+/// JPEG quality of the straightened picture.
+const QUALITY: u8 = 90;
+
+/// A straightened picture: RGB8, row-major.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Warped {
+    pub width: u32,
+    pub height: u32,
+    pub rgb: Vec<u8>,
+}
+
+/// Warp the quadrilateral `quad` (raster pixels, any corner order) of a premultiplied RGBA
+/// raster to an upright rectangle as large as the quadrilateral's longer sides, composited over
+/// white. Errors say what was wrong with the corners or the raster.
+pub fn warp(rgba: &[u8], width: u32, height: u32, quad: [Point; 4]) -> Result<Warped, String> {
+    let (w, h) = (width as usize, height as usize);
+    if w == 0 || h == 0 || w.checked_mul(h).and_then(|n| n.checked_mul(4)) != Some(rgba.len()) {
+        return Err("the page could not be read as a picture".into());
+    }
+    let [tl, tr, br, bl] = order_quad(quad).ok_or("the four corners must enclose an area (a convex quadrilateral)")?;
+    let dist = |a: Point, b: Point| (a[0] - b[0]).hypot(a[1] - b[1]);
+    let mut ow = dist(tl, tr).max(dist(bl, br));
+    let mut oh = dist(tl, bl).max(dist(tr, br));
+    let k = (MAX_PIXELS / (ow * oh).max(1.0)).sqrt().min(1.0);
+    ow = (ow * k).floor().max(1.0);
+    oh = (oh * k).floor().max(1.0);
+    if !(ow.is_finite() && oh.is_finite()) {
+        return Err("the corners are out of range".into());
+    }
+    // Both are at least 1 and their product is at most MAX_PIXELS, so the casts are exact.
+    let (ow, oh) = (ow as u32, oh as u32);
+    let rect = [[0.0, 0.0], [ow as f64, 0.0], [ow as f64, oh as f64], [0.0, oh as f64]];
+    let to_src = Homography::from_points(rect, [tl, tr, br, bl]).ok_or("the four corners must not be in a line")?;
+
+    let px = |x: usize, y: usize| -> [f64; 4] {
+        let i = (y * w + x) * 4;
+        match rgba.get(i..i + 4) {
+            Some(p) => [p[0] as f64, p[1] as f64, p[2] as f64, p[3] as f64],
+            None => [0.0; 4],
+        }
+    };
+    let mut rgb = Vec::with_capacity(ow as usize * oh as usize * 3);
+    for y in 0..oh {
+        for x in 0..ow {
+            // Sample at the pixel's centre; outside the page is white.
+            let mut c = [0.0f64; 4];
+            if let Some([sx, sy]) = to_src.apply([x as f64 + 0.5, y as f64 + 0.5]) {
+                let (fx, fy) = (sx - 0.5, sy - 0.5);
+                if fx > -1.0 && fy > -1.0 && fx < w as f64 && fy < h as f64 {
+                    let (x0, y0) = (fx.floor(), fy.floor());
+                    let (ax, ay) = (fx - x0, fy - y0);
+                    // Clamped to the raster, so every index below is in range.
+                    let clamp = |v: f64, n: usize| v.clamp(0.0, (n - 1) as f64) as usize;
+                    let (xa, xb) = (clamp(x0, w), clamp(x0 + 1.0, w));
+                    let (ya, yb) = (clamp(y0, h), clamp(y0 + 1.0, h));
+                    let (p00, p10, p01, p11) = (px(xa, ya), px(xb, ya), px(xa, yb), px(xb, yb));
+                    for (i, v) in c.iter_mut().enumerate() {
+                        let top = p00[i] * (1.0 - ax) + p10[i] * ax;
+                        let bottom = p01[i] * (1.0 - ax) + p11[i] * ax;
+                        *v = top * (1.0 - ay) + bottom * ay;
+                    }
+                }
+            }
+            // Premultiplied over white: colour + (1 - alpha) × white.
+            for v in &c[..3] {
+                rgb.push((v + 255.0 - c[3]).round().clamp(0.0, 255.0) as u8);
+            }
+        }
+    }
+    Ok(Warped { width: ow, height: oh, rgb })
+}
+
+/// The long side, in pixels, a page is rendered at to look for the document's edges.
+const DETECT_SIDE: f32 = 1200.0;
+
+impl Session {
+    /// Enhance ▸ Camera image: the corners of the photographed document on page `page`
+    /// (0-based) of document `id`, in PDF user space (top-left, top-right, bottom-right,
+    /// bottom-left as displayed), or `None` when its edges can't be found with confidence.
+    pub fn detect_camera_corners(&self, id: DocId, page: usize) -> Option<[Point; 4]> {
+        let doc = self.get(id)?;
+        let info = doc.info.pages.get(page)?;
+        let scale = (DETECT_SIDE / info.width.max(info.height).max(1.0)).clamp(0.05, MAX_SCALE);
+        let config = RenderConfig { password: doc.password.as_deref().map(Arc::from), ..Default::default() };
+        let shot = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), config).render(RenderRequest { page, scale, ..Default::default() });
+        if shot.error.is_some() {
+            return None;
+        }
+        let quad = crate::camera_edges::detect_document(&shot.rgba, shot.width, shot.height)?;
+        let k = shot.width as f64 / (info.width as f64).max(1e-3);
+        Some(quad.map(|[x, y]| {
+            let [u, v] = info.view_to_user((x / k) as f32, (y / k) as f32);
+            [u as f64, v as f64]
+        }))
+    }
+
+    /// Enhance ▸ Camera image: replace page `page` (0-based) of document `id` with the part of it
+    /// inside `corners` (PDF user space, any order), straightened to a rectangle. The page is
+    /// read at its picture's own resolution (at most 600 dpi) and keeps that physical size.
+    pub fn enhance_camera_page(&mut self, id: DocId, page: usize, corners: [Point; 4]) -> Result<(), EditError> {
+        self.enhance_camera_page_at(id, page, corners, crate::camera_clean::Look::Original, 0)
+    }
+
+    /// [`Session::enhance_camera_page`], then give the straightened photo a `look` at `level`
+    /// (0 = as photographed … 100 = white paper, strong contrast, no specks; for black and white
+    /// the threshold; see [`crate::camera_clean`]). Still one undoable step.
+    pub fn enhance_camera_page_at(
+        &mut self,
+        id: DocId,
+        page: usize,
+        corners: [Point; 4],
+        look: crate::camera_clean::Look,
+        level: u8,
+    ) -> Result<(), EditError> {
+        let doc = self.get(id).ok_or(EditError::NoDocument)?;
+        if let Some(why) = &doc.read_only_reason {
+            return Err(EditError::ReadOnly(why.clone()));
+        }
+        let info = doc.info.pages.get(page).ok_or_else(|| EditError::Invalid(format!("there is no page {}", page.saturating_add(1))))?;
+        let native = doc
+            .page_images(page)
+            .iter()
+            .filter(|i| i.width > 1 && i.height > 1)
+            .map(|i| {
+                let m = i.matrix;
+                let (w, h) = (m[0].hypot(m[1]), m[2].hypot(m[3]));
+                (i.width as f64 / w.max(1e-6)).max(i.height as f64 / h.max(1e-6)) as f32
+            })
+            .filter(|s| s.is_finite())
+            .reduce(f32::max);
+        let area = (info.width.max(1.0) as f64) * (info.height.max(1.0) as f64);
+        let cap = (MAX_PIXELS / area).sqrt() as f32;
+        let scale = native.unwrap_or(DEFAULT_SCALE).clamp(1.0, MAX_SCALE).min(cap).max(0.01);
+
+        let config = RenderConfig { password: doc.password.as_deref().map(Arc::from), ..Default::default() };
+        let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), config);
+        let shot = r.render(RenderRequest { page, scale, ..Default::default() });
+        if let Some(e) = shot.error {
+            return Err(EditError::Invalid(format!("page {} could not be rendered: {e}", page + 1)));
+        }
+        let k = shot.width as f64 / (info.width as f64).max(1e-3);
+        let quad = corners.map(|[x, y]| {
+            let [vx, vy] = info.user_to_view(x as f32, y as f32);
+            [vx as f64 * k, vy as f64 * k]
+        });
+        let out = warp(&shot.rgba, shot.width, shot.height, quad).map_err(EditError::Invalid)?;
+        let pixels = crate::camera_clean::apply(&out.rgb, out.width, out.height, look, level)
+            .ok_or_else(|| EditError::Invalid("the straightened page could not be cleaned up".into()))?;
+        // Black and white is lossless (PNG): JPEG would smear grey around every letter.
+        let mut encoded = Vec::new();
+        let (name, written) = match &pixels {
+            crate::camera_clean::Pixels::Rgb(rgb) => (
+                "camera.jpg",
+                image::ImageEncoder::write_image(
+                    image::codecs::jpeg::JpegEncoder::new_with_quality(&mut encoded, QUALITY),
+                    rgb,
+                    out.width,
+                    out.height,
+                    image::ExtendedColorType::Rgb8,
+                ),
+            ),
+            crate::camera_clean::Pixels::Grey(grey) if look == crate::camera_clean::Look::BlackWhite => (
+                "camera.png",
+                image::ImageEncoder::write_image(
+                    image::codecs::png::PngEncoder::new(&mut encoded),
+                    grey,
+                    out.width,
+                    out.height,
+                    image::ExtendedColorType::L8,
+                ),
+            ),
+            crate::camera_clean::Pixels::Grey(grey) => (
+                "camera.jpg",
+                image::ImageEncoder::write_image(
+                    image::codecs::jpeg::JpegEncoder::new_with_quality(&mut encoded, QUALITY),
+                    grey,
+                    out.width,
+                    out.height,
+                    image::ExtendedColorType::L8,
+                ),
+            ),
+        };
+        written.map_err(|e| EditError::Invalid(format!("the straightened page could not be encoded: {e}")))?;
+        // One device pixel per `k` points keeps the page's physical size.
+        let dpi = (k * 72.0).clamp(1.0, 1200.0);
+        let bytes = self.create_from_images_with_resolution(&[(name.into(), encoded)], ImageResolution::Dpi(dpi))?;
+        let replace = Edit::ReplacePages { pages: vec![page], name: "camera.pdf".into(), bytes, src_pages: vec![0] };
+        self.apply(id, Edit::Batch { label: "Enhance camera image".into(), edits: vec![replace] })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// An opaque premultiplied raster filled by `f(x, y) -> [r, g, b]`.
+    fn raster(w: u32, h: u32, f: impl Fn(u32, u32) -> [u8; 3]) -> Vec<u8> {
+        (0..h)
+            .flat_map(|y| (0..w).map(move |x| (x, y)))
+            .flat_map(|(x, y)| {
+                let [r, g, b] = f(x, y);
+                [r, g, b, 255]
+            })
+            .collect()
+    }
+
+    #[test]
+    fn a_tilted_quad_comes_out_upright() {
+        // A dark quadrilateral on white; warping exactly its corners leaves a dark picture.
+        let quad = [[20.0, 30.0], [170.0, 10.0], [180.0, 150.0], [10.0, 160.0]];
+        let inside = |x: f64, y: f64| {
+            let q = order_quad(quad).unwrap();
+            (0..4).all(|i| {
+                let (a, b) = (q[i], q[(i + 1) % 4]);
+                (b[0] - a[0]) * (y - a[1]) - (b[1] - a[1]) * (x - a[0]) >= 0.0
+            })
+        };
+        let src = raster(200, 180, |x, y| if inside(x as f64 + 0.5, y as f64 + 0.5) { [20, 20, 20] } else { [255, 255, 255] });
+        let out = warp(&src, 200, 180, quad).unwrap();
+        // The longer of each pair of opposite sides: 170 × 140.
+        assert_eq!((out.width, out.height), (170, 140));
+        // Away from the anti-aliased edges, everything is the dark fill.
+        let at = |x: u32, y: u32| out.rgb[((y * out.width + x) * 3) as usize];
+        for (x, y) in [(5, 5), (85, 70), (164, 134), (5, 134), (164, 5)] {
+            assert!(at(x, y) < 60, "({x}, {y}) = {}", at(x, y));
+        }
+    }
+
+    #[test]
+    fn the_corner_order_does_not_matter() {
+        let src = raster(64, 48, |x, y| [(x * 4) as u8, (y * 5) as u8, 128]);
+        let q = [[4.0, 3.0], [60.0, 6.0], [58.0, 44.0], [2.0, 40.0]];
+        let a = warp(&src, 64, 48, q).unwrap();
+        let b = warp(&src, 64, 48, [q[2], q[0], q[3], q[1]]).unwrap();
+        assert_eq!(a, b);
+        // Left to right the red channel grows, top to bottom the green one does.
+        let px = |x: u32, y: u32| &a.rgb[((y * a.width + x) * 3) as usize..][..3];
+        assert!(px(a.width - 3, 10)[0] > px(2, 10)[0] + 100);
+        assert!(px(10, a.height - 3)[1] > px(10, 2)[1] + 100);
+    }
+
+    #[test]
+    fn transparency_becomes_white() {
+        let src = vec![0u8; 8 * 8 * 4];
+        let out = warp(&src, 8, 8, [[0.0, 0.0], [8.0, 0.0], [8.0, 8.0], [0.0, 8.0]]).unwrap();
+        assert!(out.rgb.iter().all(|&v| v == 255));
+    }
+
+    #[test]
+    fn bad_corners_and_rasters_are_errors_not_panics() {
+        let src = raster(10, 10, |_, _| [0, 0, 0]);
+        let line = [[0.0, 0.0], [5.0, 5.0], [10.0, 10.0], [2.0, 2.0]];
+        assert!(warp(&src, 10, 10, line).is_err());
+        assert!(warp(&src, 10, 10, [[f64::NAN, 0.0], [1.0, 0.0], [1.0, 1.0], [0.0, 1.0]]).is_err());
+        let ok = [[0.0, 0.0], [10.0, 0.0], [10.0, 10.0], [0.0, 10.0]];
+        assert!(warp(&src, 11, 10, ok).is_err(), "size doesn't match the buffer");
+        assert!(warp(&[], 0, 0, ok).is_err());
+        // Corners far outside the raster: a capped, white picture, not a huge allocation.
+        let far = [[-1e9, -1e9], [1e9, -1e9], [1e9, 1e9], [-1e9, 1e9]];
+        let out = warp(&src, 10, 10, far).unwrap();
+        assert!((out.width as f64) * (out.height as f64) <= MAX_PIXELS);
+    }
+}
diff --git a/crates/engine/src/camera_clean.rs b/crates/engine/src/camera_clean.rs
new file mode 100644
index 00000000..9c4120be
--- /dev/null
+++ b/crates/engine/src/camera_clean.rs
@@ -0,0 +1,392 @@
+//! Clean up a straightened camera photo (Enhance ▸ Camera image ▸ enhancement level): even out
+//! the lighting so the paper turns white (room-light colour casts, a hand's shadow, darker
+//! edges go with it), then raise the contrast and drop isolated specks. Colour ink stays colour.
+//!
+//! The paper's illumination is estimated per channel on a coarse grid of blocks, from each
+//! block's bright end (the paper, not the ink), smoothed into a continuous map and divided out.
+//! Pure Rust and deterministic.
+
+/// The strongest a level can be.
+pub const MAX_LEVEL: u8 = 100;
+
+/// How an enhanced camera page looks.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Look {
+    /// The straightened photo as it was taken.
+    Original,
+    /// Cleaned up, colour ink kept.
+    #[default]
+    Colour,
+    /// Cleaned up, in shades of grey.
+    Greyscale,
+    /// Black ink on white paper only, each pixel one or the other.
+    BlackWhite,
+}
+
+impl Look {
+    pub const ALL: [Look; 4] = [Look::Original, Look::Colour, Look::Greyscale, Look::BlackWhite];
+
+    /// The name tools use.
+    pub fn name(self) -> &'static str {
+        match self {
+            Look::Original => "original",
+            Look::Colour => "colour",
+            Look::Greyscale => "greyscale",
+            Look::BlackWhite => "bw",
+        }
+    }
+
+    pub fn from_name(name: &str) -> Option<Look> {
+        Look::ALL.into_iter().find(|l| l.name() == name)
+    }
+}
+
+/// A page's pixels after [`apply`]: RGB8, or one grey byte per pixel.
+#[derive(Clone, Debug, PartialEq)]
+pub enum Pixels {
+    Rgb(Vec<u8>),
+    Grey(Vec<u8>),
+}
+
+/// Give a straightened photo (`rgb`, RGB8) the `look` at `level`. For black and white the level
+/// sets the threshold: higher keeps fainter strokes black. `None` when the buffer doesn't match
+/// the size.
+pub fn apply(rgb: &[u8], width: u32, height: u32, look: Look, level: u8) -> Option<Pixels> {
+    let (w, h) = (width as usize, height as usize);
+    if w == 0 || h == 0 || w.checked_mul(h)?.checked_mul(3)? != rgb.len() {
+        return None;
+    }
+    let lum = |p: &[u8; 3]| ((p[0] as u32 * 299 + p[1] as u32 * 587 + p[2] as u32 * 114) / 1000) as u8;
+    Some(match look {
+        Look::Original => Pixels::Rgb(rgb.to_vec()),
+        Look::Colour => Pixels::Rgb(clean(rgb, width, height, level)?),
+        Look::Greyscale => Pixels::Grey(clean(rgb, width, height, level)?.as_chunks::<3>().0.iter().map(lum).collect()),
+        Look::BlackWhite => {
+            // The lighting evened out fully, then one threshold for the whole page.
+            let even = clean(rgb, width, height, 50)?;
+            let t = 0.45 + 0.4 * level.min(MAX_LEVEL) as f32 / MAX_LEVEL as f32;
+            let mut grey: Vec<u8> = even.as_chunks::<3>().0.iter().map(|p| if (lum(p) as f32 / 255.0) < t { 0 } else { 255 }).collect();
+            despeckle_grey(&mut grey, w, h);
+            Pixels::Grey(grey)
+        }
+    })
+}
+
+/// Clean `rgb` (RGB8, `width` × `height`) at `level` (0 = unchanged … 100 = strongest).
+/// Returns `None` when the buffer doesn't match the size.
+pub fn clean(rgb: &[u8], width: u32, height: u32, level: u8) -> Option<Vec<u8>> {
+    let (w, h) = (width as usize, height as usize);
+    if w == 0 || h == 0 || w.checked_mul(h)?.checked_mul(3)? != rgb.len() {
+        return None;
+    }
+    let level = level.min(MAX_LEVEL);
+    if level == 0 {
+        return Some(rgb.to_vec());
+    }
+    let k = level as f32 / MAX_LEVEL as f32;
+    let background = background(rgb, w, h);
+    // Lighting is evened out fully from half strength on; contrast keeps growing to the top.
+    let flatten = (2.0 * k).min(1.0);
+    let white = 1.0 - 0.12 * k; // what reaches white
+    let black = 0.30 * k; // what reaches black
+    let mut out = Vec::with_capacity(rgb.len());
+    for (i, px) in rgb.as_chunks::<3>().0.iter().enumerate() {
+        let (x, y) = (i % w, i / w);
+        let bg = background.at(x, y);
+        for (c, &v) in px.iter().enumerate() {
+            let v = v as f32 / 255.0;
+            let b = bg.get(c).copied().unwrap_or(1.0).max(0.05);
+            let even = (v / b).min(1.0);
+            let flat = v + (even - v) * flatten;
+            let stretched = ((flat - black) / (white - black).max(0.05)).clamp(0.0, 1.0);
+            out.push((stretched * 255.0).round() as u8);
+        }
+    }
+    if level >= 60 {
+        despeckle(&mut out, w, h);
+    }
+    Some(out)
+}
+
+/// The paper's illumination: a grid of per-channel values, read back with bilinear
+/// interpolation.
+struct Background {
+    cols: usize,
+    rows: usize,
+    block: f32,
+    cells: Vec<[f32; 3]>,
+}
+
+impl Background {
+    fn cell(&self, cx: isize, cy: isize) -> [f32; 3] {
+        let cx = cx.clamp(0, self.cols as isize - 1) as usize;
+        let cy = cy.clamp(0, self.rows as isize - 1) as usize;
+        self.cells.get(cy * self.cols + cx).copied().unwrap_or([1.0; 3])
+    }
+
+    fn at(&self, x: usize, y: usize) -> [f32; 3] {
+        // Cell centres sit at (i + 0.5) × block.
+        let fx = (x as f32 + 0.5) / self.block - 0.5;
+        let fy = (y as f32 + 0.5) / self.block - 0.5;
+        let (x0, y0) = (fx.floor(), fy.floor());
+        let (ax, ay) = (fx - x0, fy - y0);
+        let (x0, y0) = (x0 as isize, y0 as isize);
+        let (a, b, c, d) = (self.cell(x0, y0), self.cell(x0 + 1, y0), self.cell(x0, y0 + 1), self.cell(x0 + 1, y0 + 1));
+        std::array::from_fn(|i| {
+            let top = a[i] * (1.0 - ax) + b[i] * ax;
+            let bottom = c[i] * (1.0 - ax) + d[i] * ax;
+            top * (1.0 - ay) + bottom * ay
+        })
+    }
+}
+
+/// Estimate the paper's illumination: per block, the 90th percentile of each channel (bright
+/// paper, not dark ink); blocks that are mostly ink borrow from their neighbours; then smoothed.
+fn background(rgb: &[u8], w: usize, h: usize) -> Background {
+    let block = (w.min(h) / 16).clamp(8, 128);
+    let (cols, rows) = (w.div_ceil(block), h.div_ceil(block));
+    let mut cells = Vec::with_capacity(cols * rows);
+    let mut hist = [[0u32; 256]; 3];
+    for by in 0..rows {
+        for bx in 0..cols {
+            hist.iter_mut().for_each(|hh| hh.fill(0));
+            let mut n = 0u32;
+            for y in by * block..((by + 1) * block).min(h) {
+                for x in bx * block..((bx + 1) * block).min(w) {
+                    if let Some(p) = rgb.get((y * w + x) * 3..(y * w + x) * 3 + 3) {
+                        for (c, &v) in p.iter().enumerate() {
+                            if let Some(slot) = hist.get_mut(c).and_then(|hh| hh.get_mut(v as usize)) {
+                                *slot += 1;
+                            }
+                        }
+                        n += 1;
+                    }
+                }
+            }
+            let want = (n as f32 * 0.9) as u32;
+            cells.push(std::array::from_fn(|c| {
+                let mut seen = 0;
+                let v = hist.get(c).and_then(|hh| {
+                    hh.iter().position(|&count| {
+                        seen += count;
+                        seen > want
+                    })
+                });
+                v.unwrap_or(255) as f32 / 255.0
+            }));
+        }
+    }
+    // A block darker than its neighbourhood's paper is mostly ink, a stamp or a picture: take
+    // the brighter of itself and the 75th percentile of the 5 × 5 blocks around it (so a
+    // coloured area up to about half that neighbourhood isn't taken for paper), then smooth.
+    let get = |cells: &Vec<[f32; 3]>, x: isize, y: isize| -> [f32; 3] {
+        let x = x.clamp(0, cols as isize - 1) as usize;
+        let y = y.clamp(0, rows as isize - 1) as usize;
+        cells.get(y * cols + x).copied().unwrap_or([1.0; 3])
+    };
+    let mut lifted = Vec::with_capacity(cells.len());
+    for y in 0..rows as isize {
+        for x in 0..cols as isize {
+            let own = get(&cells, x, y);
+            lifted.push(std::array::from_fn(|c| {
+                let mut around: Vec<f32> =
+                    (-2..=2).flat_map(|dy| (-2..=2).map(move |dx| (dx, dy))).map(|(dx, dy)| get(&cells, x + dx, y + dy)[c]).collect();
+                around.sort_by(f32::total_cmp);
+                let paper = around.get(18).copied().unwrap_or(1.0);
+                own[c].max(paper)
+            }));
+        }
+    }
+    let mut cells = lifted;
+    for _ in 0..2 {
+        let mut next = Vec::with_capacity(cells.len());
+        for y in 0..rows as isize {
+            for x in 0..cols as isize {
+                let mut sum = [0.0f32; 3];
+                for dy in -1..=1 {
+                    for dx in -1..=1 {
+                        let v = get(&cells, x + dx, y + dy);
+                        for c in 0..3 {
+                            sum[c] += v[c] / 9.0;
+                        }
+                    }
+                }
+                next.push(sum);
+            }
+        }
+        cells = next;
+    }
+    Background { cols, rows, block: block as f32, cells }
+}
+
+/// [`despeckle`] for one grey byte per pixel.
+fn despeckle_grey(grey: &mut [u8], w: usize, h: usize) {
+    let mut rgb: Vec<u8> = grey.iter().flat_map(|&v| [v, v, v]).collect();
+    despeckle(&mut rgb, w, h);
+    for (g, p) in grey.iter_mut().zip(rgb.as_chunks::<3>().0.iter()) {
+        *g = p[0];
+    }
+}
+
+/// Lighten dark pixels with at most one dark neighbour (specks), in place.
+fn despeckle(rgb: &mut [u8], w: usize, h: usize) {
+    let lum = |p: &[u8; 3]| (p[0] as u32 * 299 + p[1] as u32 * 587 + p[2] as u32 * 114) / 1000;
+    let dark: Vec<bool> = rgb.as_chunks::<3>().0.iter().map(|p| lum(p) < 128).collect();
+    let is_dark = |x: isize, y: isize| {
+        x >= 0 && y >= 0 && (x as usize) < w && (y as usize) < h && dark.get(y as usize * w + x as usize).copied().unwrap_or(false)
+    };
+    for y in 0..h as isize {
+        for x in 0..w as isize {
+            if !is_dark(x, y) {
+                continue;
+            }
+            let neighbours =
+                (-1..=1).flat_map(|dy| (-1..=1).map(move |dx| (dx, dy))).filter(|&(dx, dy)| (dx, dy) != (0, 0) && is_dark(x + dx, y + dy)).count();
+            if neighbours <= 1
+                && let Some(p) = rgb.get_mut((y as usize * w + x as usize) * 3..(y as usize * w + x as usize) * 3 + 3)
+            {
+                p.fill(255);
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A synthetic photo of a page: paper lit by `light(x, y)` (per channel, 0–1), with dark
+    /// text bars, a blue stamp and a few specks.
+    fn photo(w: usize, h: usize, light: impl Fn(usize, usize) -> [f32; 3]) -> Vec<u8> {
+        let mut out = Vec::with_capacity(w * h * 3);
+        for y in 0..h {
+            for x in 0..w {
+                let text = (y / 12) % 3 == 1 && x > w / 10 && x < 9 * w / 10 && (x / 9) % 6 != 0;
+                let stamp = (x as isize - (3 * w / 4) as isize).pow(2) + (y as isize - (3 * h / 4) as isize).pow(2) < (h as isize / 12).pow(2);
+                let speck = (x * 7919 + y * 104729) % 997 == 0;
+                let ink: [f32; 3] = if text || speck {
+                    [0.12, 0.12, 0.12]
+                } else if stamp {
+                    [0.15, 0.25, 0.75]
+                } else {
+                    [0.97, 0.97, 0.95]
+                };
+                let l = light(x, y);
+                for c in 0..3 {
+                    out.push((ink[c] * l[c] * 255.0).round().clamp(0.0, 255.0) as u8);
+                }
+            }
+        }
+        out
+    }
+
+    fn px(img: &[u8], w: usize, x: usize, y: usize) -> [u8; 3] {
+        let i = (y * w + x) * 3;
+        [img[i], img[i + 1], img[i + 2]]
+    }
+
+    /// A paper point (between text rows, away from the stamp).
+    fn paper_points(w: usize, h: usize) -> Vec<(usize, usize)> {
+        [(0.05, 0.03), (0.5, 0.03), (0.95, 0.03), (0.05, 0.53), (0.5, 0.53), (0.97, 0.98), (0.03, 0.98)]
+            .iter()
+            .map(|&(fx, fy)| ((fx * w as f64) as usize, (fy * h as f64) as usize))
+            .map(|(x, y)| (x.min(w - 1), (y - y % 36 + 4).min(h - 1)))
+            .collect()
+    }
+
+    #[test]
+    fn a_shadow_and_a_yellow_cast_become_white_paper() {
+        let (w, h) = (480, 640);
+        // Warm room light, falling off to a third towards the bottom right (a hand's shadow).
+        let light = |x: usize, y: usize| {
+            let f = 1.0 - 0.66 * ((x + y) as f32 / (w + h) as f32);
+            [0.95 * f, 0.85 * f, 0.6 * f]
+        };
+        let img = photo(w, h, light);
+        let out = clean(&img, w as u32, h as u32, 60).unwrap();
+        for (x, y) in paper_points(w, h) {
+            let before = px(&img, w, x, y);
+            let after = px(&out, w, x, y);
+            assert!(after.iter().all(|&v| v >= 235), "({x}, {y}) {before:?} → {after:?}");
+        }
+        // The text stays dark everywhere, also in the shadow.
+        for (x, y) in [(w / 2, 13), (w / 2, 3 * 12 + 13), (w * 8 / 10, h - 40 - (h - 40) % 36 + 13)] {
+            let after = px(&out, w, x, y);
+            if (x / 9) % 6 != 0 {
+                assert!(after.iter().all(|&v| v <= 90), "text at ({x}, {y}): {after:?}");
+            }
+        }
+    }
+
+    #[test]
+    fn a_blue_stamp_stays_blue() {
+        let (w, h) = (480, 640);
+        let img = photo(w, h, |_, _| [0.9, 0.85, 0.7]);
+        let out = clean(&img, w as u32, h as u32, 100).unwrap();
+        // The stamp's centre, on a row without text.
+        let [r, g, b] = px(&out, w, 3 * w / 4, 3 * h / 4 + 12);
+        assert!(b as i32 - r as i32 > 60 && b as i32 - g as i32 > 40, "{:?}", [r, g, b]);
+    }
+
+    #[test]
+    fn level_zero_changes_nothing_and_strength_grows_with_the_level() {
+        let (w, h) = (240, 320);
+        let img = photo(w, h, |x, _| [0.6 + 0.3 * x as f32 / w as f32; 3]);
+        assert_eq!(clean(&img, w as u32, h as u32, 0).unwrap(), img);
+        let mean = |v: &[u8]| v.iter().map(|&c| c as f64).sum::<f64>() / v.len() as f64;
+        let (a, b, c) = (mean(&img), mean(&clean(&img, w as u32, h as u32, 30).unwrap()), mean(&clean(&img, w as u32, h as u32, 100).unwrap()));
+        assert!(a < b && b < c, "{a} {b} {c}");
+    }
+
+    #[test]
+    fn specks_go_at_high_levels_but_text_stays() {
+        let (w, h) = (240, 320);
+        let img = photo(w, h, |_, _| [1.0; 3]);
+        let out = clean(&img, w as u32, h as u32, 100).unwrap();
+        let specks: Vec<(usize, usize)> = (0..h)
+            .flat_map(|y| (0..w).map(move |x| (x, y)))
+            // Specks away from the text rows (one touching a letter isn't isolated).
+            .filter(|&(x, y)| (x * 7919 + y * 104729) % 997 == 0 && (y / 12) % 3 == 0 && (2..10).contains(&(y % 12)))
+            .collect();
+        assert!(!specks.is_empty());
+        for (x, y) in specks {
+            assert!(px(&out, w, x, y).iter().all(|&v| v > 200), "speck at ({x}, {y})");
+        }
+        assert!(px(&out, w, w / 2 + 1, 13).iter().all(|&v| v < 60), "text");
+    }
+
+    #[test]
+    fn the_looks() {
+        let (w, h) = (240, 320);
+        let img = photo(w, h, |x, _| [0.95 - 0.4 * x as f32 / w as f32, 0.85 - 0.4 * x as f32 / w as f32, 0.65]);
+        assert_eq!(apply(&img, w as u32, h as u32, Look::Original, 80), Some(Pixels::Rgb(img.clone())));
+        let Some(Pixels::Rgb(colour)) = apply(&img, w as u32, h as u32, Look::Colour, 80) else { panic!("colour") };
+        assert_eq!(Some(colour), clean(&img, w as u32, h as u32, 80));
+        let Some(Pixels::Grey(grey)) = apply(&img, w as u32, h as u32, Look::Greyscale, 80) else { panic!("grey") };
+        assert_eq!(grey.len(), w * h);
+        let Some(Pixels::Grey(bw)) = apply(&img, w as u32, h as u32, Look::BlackWhite, 50) else { panic!("bw") };
+        assert!(bw.iter().all(|&v| v == 0 || v == 255), "only black and white");
+        // Paper (between rows, across the shadow) is white; text is black.
+        for x in [5, w / 2, w - 6] {
+            assert_eq!(bw[3 * w + x], 255, "paper at x {x}");
+        }
+        assert_eq!(bw[13 * w + w / 2 + 1], 0, "text");
+        // The level moves the threshold: more black at the top than at the bottom.
+        let black = |level| match apply(&img, w as u32, h as u32, Look::BlackWhite, level) {
+            Some(Pixels::Grey(g)) => g.iter().filter(|&&v| v == 0).count(),
+            _ => 0,
+        };
+        assert!(black(0) <= black(50) && black(50) <= black(100), "{} {} {}", black(0), black(50), black(100));
+        for look in Look::ALL {
+            assert_eq!(Look::from_name(look.name()), Some(look));
+        }
+        assert_eq!(apply(&[0; 5], 2, 1, Look::BlackWhite, 50), None);
+    }
+
+    #[test]
+    fn bad_sizes_are_none_not_a_panic() {
+        assert_eq!(clean(&[], 0, 0, 50), None);
+        assert_eq!(clean(&[0; 12], 2, 3, 50), None);
+        assert_eq!(clean(&[9; 3], 1, 1, 255).map(|v| v.len()), Some(3));
+    }
+}
diff --git a/crates/engine/src/camera_edges.rs b/crates/engine/src/camera_edges.rs
new file mode 100644
index 00000000..7084dd5e
--- /dev/null
+++ b/crates/engine/src/camera_edges.rs
@@ -0,0 +1,501 @@
+//! Find a photographed document's corners (Enhance ▸ Camera image): the edges of the sheet are
+//! the four strongest straight lines that enclose a large convex area, each backed by an edge
+//! along most of its length. Pure Rust and deterministic; `None` when nothing convinces, so the
+//! caller falls back to corners the user places.
+//!
+//! Steps: shrink the picture to [`WORK`] pixels on its long side, blur it, take Sobel gradients
+//! and keep thin, strong edges; vote for lines (a Hough transform that only votes along each
+//! edge's own gradient direction, give or take a few degrees); pair two near-horizontal with two near-vertical lines; keep
+//! the quadrilaterals whose four sides lie on edges, and choose the largest.
+
+use pdfcraft_geom::perspective::{Point, order_quad};
+
+/// The working size: the long side of the shrunken picture, in pixels.
+const WORK: usize = 400;
+/// The most lines tried (strongest first).
+const MAX_LINES: usize = 24;
+/// A side counts when at least this share of it lies on a matching edge.
+const MIN_SUPPORT: f64 = 0.55;
+/// A document fills at least this share of the picture.
+const MIN_AREA: f64 = 0.12;
+/// How far (share of the picture's size) a corner may lie outside the picture.
+const MARGIN: f64 = 0.02;
+
+/// A grey picture, row-major, read with bounds checks.
+struct Grey {
+    w: usize,
+    h: usize,
+    v: Vec<f32>,
+}
+
+impl Grey {
+    fn at(&self, x: isize, y: isize) -> f32 {
+        // Outside the picture repeats its border.
+        let x = x.clamp(0, self.w as isize - 1) as usize;
+        let y = y.clamp(0, self.h as isize - 1) as usize;
+        self.v.get(y * self.w + x).copied().unwrap_or(0.0)
+    }
+}
+
+/// An edge pixel: its gradient's strength and direction (radians, the normal of the edge).
+#[derive(Clone, Copy)]
+struct Edge {
+    mag: f32,
+    dir: f32,
+}
+
+/// The document's corners in `rgba` (premultiplied RGBA8, `width` × `height`), in pixels:
+/// top-left, top-right, bottom-right, bottom-left. `None` when no quadrilateral convinces.
+pub fn detect_document(rgba: &[u8], width: u32, height: u32) -> Option<[Point; 4]> {
+    let (w, h) = (width as usize, height as usize);
+    if w < 16 || h < 16 || w.checked_mul(h)?.checked_mul(4)? != rgba.len() {
+        return None;
+    }
+    let grey = shrink(rgba, w, h);
+    let k = w.max(h) as f64 / grey.w.max(grey.h) as f64;
+    let edges = edges(&blur(&blur(&grey)));
+    let lines = hough(&edges, grey.w, grey.h);
+    let quad = best_quad(&lines, &edges, grey.w, grey.h)?;
+    let quad = refine(quad, &edges, grey.w, grey.h).unwrap_or(quad);
+    // Back to the picture's pixels (pixel centres line up at k × (x + 0.5)).
+    Some(quad.map(|[x, y]| [(x + 0.5) * k, (y + 0.5) * k]))
+}
+
+/// Box-filter `rgba` (premultiplied, over white) down to at most [`WORK`] pixels on its long
+/// side, as luminance 0–255.
+fn shrink(rgba: &[u8], w: usize, h: usize) -> Grey {
+    let step = w.max(h).div_ceil(WORK).max(1);
+    let (sw, sh) = (w.div_ceil(step), h.div_ceil(step));
+    let mut v = Vec::with_capacity(sw * sh);
+    for sy in 0..sh {
+        for sx in 0..sw {
+            let (mut sum, mut n) = (0.0f32, 0.0f32);
+            for y in sy * step..((sy + 1) * step).min(h) {
+                for x in sx * step..((sx + 1) * step).min(w) {
+                    if let Some(p) = rgba.get((y * w + x) * 4..(y * w + x) * 4 + 4) {
+                        let white = 255.0 - p[3] as f32;
+                        let (r, g, b) = (p[0] as f32 + white, p[1] as f32 + white, p[2] as f32 + white);
+                        sum += 0.299 * r + 0.587 * g + 0.114 * b;
+                        n += 1.0;
+                    }
+                }
+            }
+            v.push(if n > 0.0 { sum / n } else { 255.0 });
+        }
+    }
+    Grey { w: sw, h: sh, v }
+}
+
+/// A 3×3 binomial blur.
+fn blur(g: &Grey) -> Grey {
+    let mut v = Vec::with_capacity(g.v.len());
+    for y in 0..g.h as isize {
+        for x in 0..g.w as isize {
+            let mut s = 0.0;
+            for (dy, wy) in [(-1, 1.0), (0, 2.0), (1, 1.0)] {
+                for (dx, wx) in [(-1, 1.0), (0, 2.0), (1, 1.0)] {
+                    s += wy * wx * g.at(x + dx, y + dy);
+                }
+            }
+            v.push(s / 16.0);
+        }
+    }
+    Grey { w: g.w, h: g.h, v }
+}
+
+/// Thin, strong edges: Sobel gradients, kept where they are a local maximum across the edge
+/// and above a threshold relative to the picture's strongest edges.
+fn edges(g: &Grey) -> Vec<Option<Edge>> {
+    let mut grad = Vec::with_capacity(g.v.len());
+    for y in 0..g.h as isize {
+        for x in 0..g.w as isize {
+            let p = |dx, dy| g.at(x + dx, y + dy);
+            let gx = (p(1, -1) + 2.0 * p(1, 0) + p(1, 1)) - (p(-1, -1) + 2.0 * p(-1, 0) + p(-1, 1));
+            let gy = (p(-1, 1) + 2.0 * p(0, 1) + p(1, 1)) - (p(-1, -1) + 2.0 * p(0, -1) + p(1, -1));
+            grad.push(Edge { mag: gx.hypot(gy), dir: gy.atan2(gx) });
+        }
+    }
+    // The threshold: a share of the 98th percentile, never below a faint-edge floor.
+    let mut mags: Vec<f32> = grad.iter().map(|e| e.mag).filter(|m| m.is_finite()).collect();
+    mags.sort_by(f32::total_cmp);
+    let p98 = mags.get(mags.len() * 98 / 100).copied().unwrap_or(0.0);
+    let threshold = (0.25 * p98).max(24.0);
+    let mag = |x: isize, y: isize| -> f32 {
+        if x < 0 || y < 0 || x >= g.w as isize || y >= g.h as isize {
+            return 0.0;
+        }
+        grad.get(y as usize * g.w + x as usize).map_or(0.0, |e| e.mag)
+    };
+    let mut out = Vec::with_capacity(grad.len());
+    for (i, e) in grad.iter().enumerate() {
+        let (x, y) = ((i % g.w) as isize, (i / g.w) as isize);
+        // Edges touching the picture's border are where blurring repeats it: no information.
+        let inside = x > 1 && y > 1 && x < g.w as isize - 2 && y < g.h as isize - 2;
+        let keep = inside && e.mag >= threshold && {
+            let (dx, dy) = (e.dir.cos().round() as isize, e.dir.sin().round() as isize);
+            e.mag >= mag(x + dx, y + dy) && e.mag >= mag(x - dx, y - dy)
+        };
+        out.push(keep.then_some(*e));
+    }
+    out
+}
+
+/// A line `x cos θ + y sin θ = ρ` and its votes.
+#[derive(Clone, Copy, Debug)]
+struct Line {
+    theta: f64,
+    rho: f64,
+}
+
+/// The strongest lines through the edges: each edge votes for the lines within 6° of its own
+/// normal, weighted by its strength; peaks are taken strongest first, clearing their
+/// neighbourhood.
+fn hough(edges: &[Option<Edge>], w: usize, h: usize) -> Vec<Line> {
+    const STEPS: usize = 180;
+    let diag = ((w * w + h * h) as f64).sqrt().ceil() as usize;
+    let rows = 2 * diag + 1;
+    let mut acc = vec![0.0f32; STEPS * rows];
+    let trig: Vec<(f64, f64)> = (0..STEPS).map(|t| (t as f64).to_radians()).map(|a| (a.cos(), a.sin())).collect();
+    for (i, e) in edges.iter().enumerate() {
+        let Some(e) = e else { continue };
+        let (x, y) = ((i % w) as f64, (i / w) as f64);
+        let normal = (e.dir as f64).to_degrees().rem_euclid(180.0).round() as isize;
+        // ±6°: a jagged (aliased) edge's local gradient leans towards the axes.
+        for t in normal - 6..=normal + 6 {
+            let t = t.rem_euclid(STEPS as isize) as usize;
+            let Some(&(c, s)) = trig.get(t) else { continue };
+            let r = (x * c + y * s).round() as isize + diag as isize;
+            if let Some(cell) = usize::try_from(r).ok().and_then(|r| acc.get_mut(t * rows + r)) {
+                *cell += e.mag;
+            }
+        }
+    }
+    let mut lines = Vec::new();
+    let first = acc.iter().copied().fold(0.0f32, f32::max);
+    while lines.len() < MAX_LINES {
+        let Some((best, &v)) = acc.iter().enumerate().max_by(|a, b| a.1.total_cmp(b.1)) else { break };
+        if v <= 0.0 || v < 0.08 * first {
+            break;
+        }
+        let (t, r) = (best / rows, best % rows);
+        lines.push(Line { theta: (t as f64).to_radians(), rho: r as f64 - diag as f64 });
+        // Clear ±6° and ±6 px around the peak (θ wraps, flipping ρ's sign).
+        for dt in -6isize..=6 {
+            let tt = t as isize + dt;
+            let (tt, flip) = if tt < 0 {
+                (tt + STEPS as isize, true)
+            } else if tt >= STEPS as isize {
+                (tt - STEPS as isize, true)
+            } else {
+                (tt, false)
+            };
+            let rr = if flip { 2 * diag as isize - r as isize } else { r as isize };
+            for dr in -6isize..=6 {
+                if let Some(cell) = usize::try_from(rr + dr).ok().filter(|&q| q < rows).and_then(|q| acc.get_mut(tt as usize * rows + q)) {
+                    *cell = 0.0;
+                }
+            }
+        }
+    }
+    lines
+}
+
+fn intersect(a: Line, b: Line) -> Option<Point> {
+    let (c1, s1, c2, s2) = (a.theta.cos(), a.theta.sin(), b.theta.cos(), b.theta.sin());
+    let det = c1 * s2 - s1 * c2;
+    if det.abs() < 1e-6 {
+        return None;
+    }
+    let p = [(a.rho * s2 - b.rho * s1) / det, (c1 * b.rho - c2 * a.rho) / det];
+    p.iter().all(|v| v.is_finite()).then_some(p)
+}
+
+/// The share of the side from `a` to `b` that lies on an edge facing across it.
+fn support(a: Point, b: Point, edges: &[Option<Edge>], w: usize, h: usize) -> f64 {
+    let len = (b[0] - a[0]).hypot(b[1] - a[1]);
+    if len < 1.0 {
+        return 0.0;
+    }
+    let (ux, uy) = ((b[0] - a[0]) / len, (b[1] - a[1]) / len);
+    // The side's normal, (-uy, ux), as an angle.
+    let normal = ux.atan2(-uy) as f32;
+    let n = (len / 2.0).clamp(8.0, 200.0) as usize;
+    let mut hits = 0;
+    for i in 0..n {
+        let t = 0.05 + 0.9 * (i as f64 + 0.5) / n as f64;
+        let (px, py) = (a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t);
+        let hit = (-2i32..=2).any(|o| {
+            let (x, y) = ((px - uy * o as f64).round(), (py + ux * o as f64).round());
+            if x < 0.0 || y < 0.0 || x >= w as f64 || y >= h as f64 {
+                return false;
+            }
+            edges.get(y as usize * w + x as usize).copied().flatten().is_some_and(|e| {
+                // Either way across: dark-to-light or light-to-dark.
+                let d = (e.dir - normal).rem_euclid(std::f32::consts::PI);
+                d < 0.35 || d > std::f32::consts::PI - 0.35
+            })
+        });
+        hits += hit as usize;
+    }
+    hits as f64 / n as f64
+}
+
+/// Sharpen the quadrilateral found on the coarse line grid: fit each side's line through the
+/// edge points along it (total least squares), then intersect neighbouring sides again.
+/// `None` when a side has too few points or the result is no longer convex.
+fn refine(q: [Point; 4], edges: &[Option<Edge>], w: usize, h: usize) -> Option<[Point; 4]> {
+    // Each side as (a point on it, its unit direction).
+    let mut sides = Vec::with_capacity(4);
+    for k in 0..4 {
+        let (a, b) = (q[k], q[(k + 1) % 4]);
+        let len = (b[0] - a[0]).hypot(b[1] - a[1]);
+        if len < 4.0 {
+            return None;
+        }
+        let (ux, uy) = ((b[0] - a[0]) / len, (b[1] - a[1]) / len);
+        let normal = ux.atan2(-uy) as f32;
+        let mut pts = Vec::new();
+        // Pixels near the side, between 5% and 95% of its length (away from the corners).
+        let (x0, x1) = (a[0].min(b[0]).floor() as isize - 3, a[0].max(b[0]).ceil() as isize + 3);
+        let (y0, y1) = (a[1].min(b[1]).floor() as isize - 3, a[1].max(b[1]).ceil() as isize + 3);
+        for y in y0.max(0)..=y1.min(h as isize - 1) {
+            for x in x0.max(0)..=x1.min(w as isize - 1) {
+                let Some(e) = edges.get(y as usize * w + x as usize).copied().flatten() else { continue };
+                let d = (e.dir - normal).rem_euclid(std::f32::consts::PI);
+                if d > 0.35 && d < std::f32::consts::PI - 0.35 {
+                    continue;
+                }
+                let (dx, dy) = (x as f64 - a[0], y as f64 - a[1]);
+                let t = (dx * ux + dy * uy) / len;
+                let off = -dx * uy + dy * ux;
+                if (0.05..=0.95).contains(&t) && off.abs() <= 3.0 {
+                    pts.push([x as f64, y as f64]);
+                }
+            }
+        }
+        if pts.len() < 10 {
+            return None;
+        }
+        let n = pts.len() as f64;
+        let (cx, cy) = (pts.iter().map(|p| p[0]).sum::<f64>() / n, pts.iter().map(|p| p[1]).sum::<f64>() / n);
+        let (mut sxx, mut sxy, mut syy) = (0.0, 0.0, 0.0);
+        for p in &pts {
+            let (dx, dy) = (p[0] - cx, p[1] - cy);
+            sxx += dx * dx;
+            sxy += dx * dy;
+            syy += dy * dy;
+        }
+        // The principal direction of the points.
+        let angle = 0.5 * (2.0 * sxy).atan2(sxx - syy);
+        sides.push(([cx, cy], [angle.cos(), angle.sin()]));
+    }
+    let meet = |(p, u): (Point, Point), (r, v): (Point, Point)| -> Option<Point> {
+        let det = u[0] * v[1] - u[1] * v[0];
+        if det.abs() < 1e-6 {
+            return None;
+        }
+        let t = ((r[0] - p[0]) * v[1] - (r[1] - p[1]) * v[0]) / det;
+        let out = [p[0] + t * u[0], p[1] + t * u[1]];
+        out.iter().all(|c| c.is_finite()).then_some(out)
+    };
+    let side = |k: usize| sides.get(k).copied();
+    // Corner k is where side k-1 (ending there) meets side k (starting there).
+    let corner = |k: usize| meet(side((k + 3) % 4)?, side(k)?);
+    let refined = [corner(0)?, corner(1)?, corner(2)?, corner(3)?];
+    // A fit that moved a corner far is not a refinement.
+    let moved = refined.iter().zip(q.iter()).any(|(r, o)| (r[0] - o[0]).hypot(r[1] - o[1]) > 6.0);
+    if moved {
+        return None;
+    }
+    order_quad(refined)
+}
+
+/// The convex quadrilateral of two near-horizontal and two near-vertical lines whose four sides
+/// all lie on edges, scored by its area times the square of its sides' mean support.
+fn best_quad(lines: &[Line], edges: &[Option<Edge>], w: usize, h: usize) -> Option<[Point; 4]> {
+    // A normal within 45° of vertical makes a near-horizontal line.
+    let flat = |l: &&Line| (l.theta.to_degrees() - 90.0).abs() <= 45.0;
+    let horizontal: Vec<&Line> = lines.iter().filter(flat).collect();
+    let vertical: Vec<&Line> = lines.iter().filter(|l| !flat(l)).collect();
+    let (fw, fh) = (w as f64, h as f64);
+    let (mx, my) = (MARGIN * fw, MARGIN * fh);
+    let mut best: Option<(f64, [Point; 4])> = None;
+    for (i, &h1) in horizontal.iter().enumerate() {
+        for &h2 in horizontal.iter().skip(i + 1) {
+            for (j, &v1) in vertical.iter().enumerate() {
+                for &v2 in vertical.iter().skip(j + 1) {
+                    let corners = [intersect(*h1, *v1), intersect(*h1, *v2), intersect(*h2, *v2), intersect(*h2, *v1)];
+                    let [Some(a), Some(b), Some(c), Some(d)] = corners else { continue };
+                    let Some(q) = order_quad([a, b, c, d]) else { continue };
+                    if q.iter().any(|p| p[0] < -mx || p[1] < -my || p[0] > fw + mx || p[1] > fh + my) {
+                        continue;
+                    }
+                    let area = (0..4)
+                        .map(|k| {
+                            let (p, n) = (q[k], q[(k + 1) % 4]);
+                            p[0] * n[1] - n[0] * p[1]
+                        })
+                        .sum::<f64>()
+                        .abs()
+                        / 2.0;
+                    if area < MIN_AREA * fw * fh {
+                        continue;
+                    }
+                    let sides: Vec<f64> = (0..4).map(|k| support(q[k], q[(k + 1) % 4], edges, w, h)).collect();
+                    if sides.iter().any(|&s| s < MIN_SUPPORT) {
+                        continue;
+                    }
+                    // Large, and with every side on its edge: a slightly larger quad with a side
+                    // off the sheet loses to the sheet itself.
+                    let mean = sides.iter().sum::<f64>() / 4.0;
+                    let score = area * mean * mean;
+                    if best.is_none_or(|(b, _)| score > b) {
+                        best = Some((score, q));
+                    }
+                }
+            }
+        }
+    }
+    best.map(|(_, q)| q)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A deterministic pseudo-random generator for noise.
+    struct Lcg(u64);
+    impl Lcg {
+        fn next(&mut self) -> f32 {
+            self.0 = self.0.wrapping_mul(6364136223846793005).wrapping_add(1442695040888963407);
+            ((self.0 >> 33) as f32) / (u32::MAX >> 1) as f32
+        }
+    }
+
+    fn inside(q: &[Point; 4], x: f64, y: f64) -> bool {
+        (0..4).all(|i| {
+            let (a, b) = (q[i], q[(i + 1) % 4]);
+            (b[0] - a[0]) * (y - a[1]) - (b[1] - a[1]) * (x - a[0]) >= 0.0
+        })
+    }
+
+    /// A synthetic photo: `sheet` (corners in reading order) in `paper` over `table(x, y)`, with
+    /// 2×2 supersampled edges, optional text lines on the sheet, and noise of ±`noise`.
+    fn photo(w: u32, h: u32, sheet: [Point; 4], paper: f32, table: impl Fn(f64, f64) -> f32, text: bool, noise: f32) -> Vec<u8> {
+        let mut rng = Lcg(7);
+        let at = |u: f64, v: f64| -> Point {
+            let top = [sheet[0][0] + (sheet[1][0] - sheet[0][0]) * u, sheet[0][1] + (sheet[1][1] - sheet[0][1]) * u];
+            let bot = [sheet[3][0] + (sheet[2][0] - sheet[3][0]) * u, sheet[3][1] + (sheet[2][1] - sheet[3][1]) * u];
+            [top[0] + (bot[0] - top[0]) * v, top[1] + (bot[1] - top[1]) * v]
+        };
+        let bars: Vec<[Point; 4]> = if text {
+            (0..12)
+                .map(|k| {
+                    let v = 0.12 + k as f64 * 0.065;
+                    let u1 = if k % 4 == 3 { 0.5 } else { 0.88 };
+                    [at(0.1, v), at(u1, v), at(u1, v + 0.022), at(0.1, v + 0.022)]
+                })
+                .collect()
+        } else {
+            Vec::new()
+        };
+        let mut out = Vec::with_capacity((w * h * 4) as usize);
+        for y in 0..h {
+            for x in 0..w {
+                let mut s = 0.0;
+                for (ox, oy) in [(0.25, 0.25), (0.75, 0.25), (0.25, 0.75), (0.75, 0.75)] {
+                    let (fx, fy) = (x as f64 + ox, y as f64 + oy);
+                    s += if bars.iter().any(|b| inside(b, fx, fy)) {
+                        40.0
+                    } else if inside(&sheet, fx, fy) {
+                        paper
+                    } else {
+                        table(fx, fy)
+                    };
+                }
+                let v = (s / 4.0 + (rng.next() - 0.5) * 2.0 * noise).clamp(0.0, 255.0) as u8;
+                out.extend_from_slice(&[v, v, v, 255]);
+            }
+        }
+        out
+    }
+
+    fn assert_near(found: Option<[Point; 4]>, want: [Point; 4], tol: f64) {
+        let found = found.expect("the sheet should be found");
+        for (f, w) in found.iter().zip(want.iter()) {
+            assert!((f[0] - w[0]).hypot(f[1] - w[1]) <= tol, "found {found:?}, want {want:?}");
+        }
+    }
+
+    const SHEET: [Point; 4] = [[150.0, 170.0], [760.0, 110.0], [820.0, 1050.0], [100.0, 1090.0]];
+
+    #[test]
+    fn finds_a_tilted_sheet_on_a_plain_table() {
+        let img = photo(900, 1200, SHEET, 245.0, |_, _| 95.0, false, 0.0);
+        assert_near(detect_document(&img, 900, 1200), SHEET, 6.0);
+    }
+
+    #[test]
+    fn text_on_the_sheet_does_not_shrink_the_quad() {
+        let img = photo(900, 1200, SHEET, 245.0, |_, _| 95.0, true, 6.0);
+        assert_near(detect_document(&img, 900, 1200), SHEET, 6.0);
+    }
+
+    #[test]
+    fn wood_grain_and_a_shadow_do_not_fool_it() {
+        // Horizontal grain stripes, darker towards the bottom right.
+        let table = |x: f64, y: f64| 110.0 + 18.0 * ((y / 23.0).sin() as f32) - (0.03 * (x + y)) as f32;
+        let img = photo(900, 1200, SHEET, 235.0, table, true, 8.0);
+        assert_near(detect_document(&img, 900, 1200), SHEET, 6.0);
+    }
+
+    #[test]
+    fn a_card_photographed_from_an_angle() {
+        // Strong perspective: the far edge much shorter than the near one.
+        let card = [[260.0, 300.0], [660.0, 290.0], [800.0, 700.0], [120.0, 720.0]];
+        let img = photo(900, 1000, card, 225.0, |_, _| 60.0, false, 5.0);
+        assert_near(detect_document(&img, 900, 1000), card, 6.0);
+    }
+
+    #[test]
+    fn a_sheet_turned_by_thirty_degrees() {
+        // A 500 × 650 sheet turned 30° about (450, 500), corners in reading order.
+        let (c, s) = (30f64.to_radians().cos(), 30f64.to_radians().sin());
+        let turn = |x: f64, y: f64| [450.0 + x * c - y * s, 500.0 + x * s + y * c];
+        let sheet = [turn(-250.0, -325.0), turn(250.0, -325.0), turn(250.0, 325.0), turn(-250.0, 325.0)];
+        let img = photo(900, 1000, sheet, 240.0, |_, _| 80.0, true, 5.0);
+        // Turned 30° clockwise on screen, the top-left corner is the one turned from (-250, -325).
+        assert_near(detect_document(&img, 900, 1000), sheet, 6.0);
+    }
+
+    #[test]
+    fn a_sheet_running_off_the_picture_is_not_invented() {
+        // The bottom edge is outside the picture: either nothing, or corners on the visible
+        // edges — never a quadrilateral that cuts the sheet in half.
+        let sheet = [[150.0, 170.0], [760.0, 110.0], [830.0, 1400.0], [90.0, 1450.0]];
+        let img = photo(900, 1200, sheet, 245.0, |_, _| 95.0, true, 4.0);
+        if let Some(q) = detect_document(&img, 900, 1200) {
+            let top = (q[0][1] + q[1][1]) / 2.0;
+            let bottom = (q[2][1] + q[3][1]) / 2.0;
+            assert!(top < 200.0 && bottom > 1150.0, "{q:?}");
+        }
+    }
+
+    #[test]
+    fn gives_up_without_a_document() {
+        let table = |x: f64, y: f64| 110.0 + 18.0 * ((y / 23.0).sin() as f32) - (0.03 * (x + y)) as f32;
+        let img = photo(900, 1200, [[0.0; 2]; 4], 0.0, table, false, 8.0);
+        assert_eq!(detect_document(&img, 900, 1200), None);
+        // White paper on a white desk: no edge to find.
+        let img = photo(900, 1200, SHEET, 246.0, |_, _| 244.0, false, 2.0);
+        assert_eq!(detect_document(&img, 900, 1200), None);
+    }
+
+    #[test]
+    fn bad_input_is_none_not_a_panic() {
+        assert_eq!(detect_document(&[], 0, 0), None);
+        assert_eq!(detect_document(&[0; 40], 10, 1), None);
+        assert_eq!(detect_document(&[0; 64 * 64 * 4], 64, 63), None);
+        assert_eq!(detect_document(&vec![255; 64 * 64 * 4], 64, 64), None);
+    }
+}
diff --git a/crates/engine/src/catalog.rs b/crates/engine/src/catalog.rs
index c553675c..5f2c52bc 100644
--- a/crates/engine/src/catalog.rs
+++ b/crates/engine/src/catalog.rs
@@ -250,6 +250,7 @@ pub static TOOL_GROUPS: &[ToolGroup] = &[
                 item("In this file", "scan-text", "ocr.recognize", Ready),
                 item("In multiple files", "files", "ocr.recognize_batch", Ready),
                 item("Enhance scanned file", "sparkles", "ocr.enhance", Planned("M10")),
+                item("Enhance camera image", "camera", "ocr.enhance_camera", Ready),
                 item("Correct recognized text", "text-select", "ocr.correct", Planned("M10")),
             ],
         }],
diff --git a/crates/engine/src/commands.rs b/crates/engine/src/commands.rs
index 1f68eeb1..9760ee42 100644
--- a/crates/engine/src/commands.rs
+++ b/crates/engine/src/commands.rs
@@ -24,6 +24,8 @@ pub enum Needs {
     Modification,
     /// The open document's security allows adding and changing comments.
     Annotate,
+    /// The open document's security allows copying text and images out of it.
+    Copying,
     /// The document has form fields and its security allows filling them in.
     FillForms,
     /// The document has comments and allows changes.
@@ -34,10 +36,14 @@ pub enum Needs {
     HasRedactions,
     /// The document has page marks of this kind and allows changes.
     Marks(crate::MarkKind),
-    /// The document's security may be changed (owner, or nothing restricted).
+    /// The document's security may be changed (owner, or nothing restricted), or would be
+    /// once its permissions password is entered.
     Security,
-    /// The document is protected and its security may be removed.
+    /// The document is protected and its security may be removed (perhaps after entering
+    /// its permissions password).
     ProtectedSecurity,
+    /// The document's restrictions can be lifted with its permissions password.
+    Unlock,
     /// There is something to undo.
     Undo,
     /// There is something to redo.
@@ -188,11 +194,12 @@ pub const COMMANDS: &[CommandSpec] = &[
     c("edit.find", "Find…", EDIT, Some(Shortcut::cmd("F")), Document, "search"),
     c("edit.advanced_search", "Advanced search…", EDIT, Some(Shortcut::cmd_shift("F")), Document, "search"),
     c("view.palette", "Find tools and commands…", VIEW, Some(Shortcut::cmd("K")), Nothing, "search"),
-    // Page display: View ▸ Page display and the rail's button list these as radios, so
-    // `menu = None` keeps them out of the generated menus. The palette still runs them.
-    c("view.layout.continuous", "Continuous scrolling", None, None, Document, "arrow-up-down"),
+    // Page display: View ▸ Page display and the rail's button list the base layouts as radios and
+    // continuous scrolling as a checkbox, so `menu = None` keeps them out of the generated menus.
+    // The palette still runs them.
     c("view.layout.single", "Single page", None, None, Document, "file-text"),
     c("view.layout.two_up", "Two-page view", None, None, Document, "columns-2"),
+    c("view.continuous", "Continuous scrolling", None, None, Document, "arrow-up-down"),
     c("view.layout.cover", "Show cover page in two-page view", None, None, TwoPageView, "bookmark"),
     // Acrobat's view modes, a page display and a zoom at once (the rail's Page display menu).
     c("view.fit_width_scrolling", "Fit to width scrolling", None, None, Document, "arrow-left-right"),
@@ -205,7 +212,7 @@ pub const COMMANDS: &[CommandSpec] = &[
     // drag with the Select tool does the same; this is the way in where the desktop takes
     // Alt-drag for moving windows (several Linux window managers).
     c("edit.column_select", "Column select", EDIT, None, Document, "text-select"),
-    c("edit.snapshot", "Take a snapshot", EDIT, None, Document, "camera"),
+    c("edit.snapshot", "Take a snapshot", EDIT, None, Copying, "camera"),
     c("view.full_screen", "Full screen mode", VIEW, Some(Shortcut::cmd("L")), Document, "maximize"),
     c("view.read_mode", "Read mode", VIEW, Some(Shortcut { command: true, shift: false, mac_ctrl: true, key: "H" }), Document, "book-open"),
     c("view.focus_page_input", "Go to page…", VIEW, Some(Shortcut::cmd_shift("N")), Document, "text-cursor-input"),
@@ -298,23 +305,24 @@ pub const COMMANDS: &[CommandSpec] = &[
     c("sign.fill.signature.remove", "Fill & Sign: remove saved signature", None, None, Nothing, "x"),
     c("sign.fill.initials.remove", "Fill & Sign: remove saved initials", None, None, Nothing, "x"),
     c("sign.fill.initials.change", "Fill & Sign: change initials", None, None, Nothing, "signature"),
-    c("export.image", "Export to image…", FILE, None, Document, "image"),
+    c("export.image", "Export to image…", FILE, None, Copying, "image"),
     c("optimize.reduce", "Reduce file size…", FILE, None, Document, "file-down"),
     c("optimize.advanced", "Optimize PDF…", FILE, None, Document, "settings-2"),
-    c("export.text", "Export to text…", FILE, None, Document, "type"),
-    c("export.docx", "Export to Word…", FILE, None, Document, "file-text"),
-    c("export.html", "Export to HTML…", FILE, None, Document, "file-symlink"),
-    c("export.rtf", "Export to RTF…", FILE, None, Document, "file-text"),
+    c("export.text", "Export to text…", FILE, None, Copying, "type"),
+    c("export.docx", "Export to Word…", FILE, None, Copying, "file-text"),
+    c("export.html", "Export to HTML…", FILE, None, Copying, "file-symlink"),
+    c("export.rtf", "Export to RTF…", FILE, None, Copying, "file-text"),
     c("app.preferences", "Preferences…", EDIT, Some(Shortcut::cmd(",")), Nothing, "settings"),
     c("tools.js_console", "JavaScript console…", None, Some(Shortcut::cmd("J")), Document, "square-terminal"),
     c("tools.document_js", "Document JavaScripts…", None, None, Modification, "file-code"),
     c("ocr.recognize", "Recognize text…", None, None, Modification, "scan-text"),
+    c("ocr.enhance_camera", "Enhance camera image", None, None, Modification, "camera"),
     c("ocr.recognize_batch", "Recognize text in multiple files…", None, None, Nothing, "files"),
     c("a11y.check", "Check for accessibility…", None, None, Document, "accessibility"),
     c("a11y.report", "Open accessibility report", None, None, Document, "file-text"),
     c("a11y.reading_options", "Change reading options…", None, None, Document, "book-open"),
     c("a11y.alt_text", "Add alternate text…", None, None, Modification, "image"),
-    c("export.all_images", "Export all images…", FILE, None, Document, "image"),
+    c("export.all_images", "Export all images…", FILE, None, Copying, "image"),
     c("edit.header_footer", "Add header & footer…", None, None, Modification, "heading"),
     c("edit.header_footer.update", "Update header & footer…", None, None, Marks(crate::MarkKind::HeaderFooter), "heading"),
     c("edit.header_footer.remove", "Remove header & footer", None, None, Marks(crate::MarkKind::HeaderFooter), "heading"),
@@ -326,6 +334,7 @@ pub const COMMANDS: &[CommandSpec] = &[
     c("edit.background.remove", "Remove background", None, None, Marks(crate::MarkKind::Background), "palette"),
     c("protect.password", "Protect using password…", FILE, None, Security, "lock"),
     c("protect.remove", "Remove security", FILE, None, ProtectedSecurity, "lock-open"),
+    c("protect.unlock", "Enter permissions password…", None, None, Unlock, "lock-open"),
     c("protect.properties", "Security properties…", FILE, None, Document, "shield-check"),
     c("page.organize", "Organize pages", PAGES, None, Document, "layout-grid"),
     c("bookmark.add", "New bookmark", PAGES, Some(Shortcut::cmd("B")), Assembly, "bookmark-plus"),
@@ -370,25 +379,36 @@ pub fn is_enabled(spec: &CommandSpec, session: &Session, active: Option<DocId>)
         Assembly => doc.is_some_and(|d| d.allows_assembly()),
         Modification => doc.is_some_and(|d| d.allows_modification()),
         Annotate => doc.is_some_and(|d| d.allows_annotation()),
+        Copying => doc.is_some_and(|d| d.allows_copying()),
         FillForms => doc.is_some_and(|d| d.allows_form_filling() && !d.form.is_empty()),
         Marks(k) => doc.is_some_and(|d| d.allows_modification() && d.marks.contains(&k)),
         HasComments => doc.is_some_and(|d| d.allows_modification() && !d.info.annotations.is_empty()),
         HasFields => doc.is_some_and(|d| d.allows_modification() && !d.form.is_empty()),
         HasRedactions => doc.is_some_and(|d| d.allows_modification() && d.redaction_marks() > 0),
-        Security => doc.is_some_and(|d| d.allows_security_change()),
-        ProtectedSecurity => doc.is_some_and(|d| d.allows_security_change() && d.security_summary().is_some()),
+        Security => doc.is_some_and(|d| d.allows_security_change() || d.can_unlock()),
+        ProtectedSecurity => doc.is_some_and(|d| (d.allows_security_change() || d.can_unlock()) && d.security_summary().is_some()),
+        Unlock => doc.is_some_and(|d| d.can_unlock()),
         Undo => doc.is_some_and(|d| d.can_undo().is_some()),
         Redo => doc.is_some_and(|d| d.can_redo().is_some()),
     }
 }
 
+/// The edit `spec` names now, with the wording that names it ("Undo {}"), so an interface can say
+/// each part in its own language. `None` for every other command, and when there is nothing to undo.
+pub fn current_edit<'a>(spec: &CommandSpec, session: &'a Session, active: Option<DocId>) -> Option<(&'static str, &'a crate::Label)> {
+    let doc = active.and_then(|id| session.get(id))?;
+    match spec.id {
+        "edit.undo" => doc.undo_label().map(|l| ("Undo {}", l)),
+        "edit.redo" => doc.redo_label().map(|l| ("Redo {}", l)),
+        _ => None,
+    }
+}
+
 /// The label to show for `spec` now ("Undo Rotate page" rather than "Undo").
 pub fn current_label(spec: &CommandSpec, session: &Session, active: Option<DocId>) -> String {
-    let doc = active.and_then(|id| session.get(id));
-    match (spec.id, doc) {
-        ("edit.undo", Some(d)) => d.can_undo().map(|l| format!("Undo {l}")).unwrap_or_else(|| spec.label.into()),
-        ("edit.redo", Some(d)) => d.can_redo().map(|l| format!("Redo {l}")).unwrap_or_else(|| spec.label.into()),
-        _ => spec.label.into(),
+    match current_edit(spec, session, active) {
+        Some((wording, label)) => wording.replacen("{}", label.as_str(), 1),
+        None => spec.label.into(),
     }
 }
 
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
index 1c059a22..cb602e13 100644
--- a/crates/engine/src/lib.rs
+++ b/crates/engine/src/lib.rs
@@ -13,6 +13,9 @@
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
 pub mod actions;
+pub mod camera;
+pub mod camera_clean;
+pub mod camera_edges;
 pub mod catalog;
 pub mod commands;
 pub mod compare;
@@ -46,7 +49,7 @@ pub use pdfcraft_forms::{
 };
 
 pub use pdfcraft_a11y as a11y;
-pub use pdfcraft_edit::{BlockStyle, PageImage, TextBlock, TextLine, first_undrawable};
+pub use pdfcraft_edit::{BlockStyle, PageImage, TextBlock, TextLine, first_undrawable, first_undrawable_plain, undrawable_message};
 pub use pdfcraft_measure as measure;
 pub use pdfcraft_xfa::Report as XfaLayout;
 
@@ -94,6 +97,13 @@ pub fn typed_signature_shape(at: [f64; 2], text: &str, height: f64, rotation: i6
     let contours = o.contours.iter().map(|c| c.iter().map(|p| to_user((p[0] - left) / width, (p[1] - bottom) / span)).collect()).collect();
     Some(Shape::TypedSignature { rect, contours })
 }
+/// `text` in the script font as the graphic of a visible digital signature, as Fill & Sign types
+/// it. `None` for text with no outlines.
+pub fn typed_signature_graphic(text: &str) -> Option<pdfcraft_sign::Graphic> {
+    let o = script_outline(text);
+    o.contours.iter().any(|c| c.len() > 2).then_some(pdfcraft_sign::Graphic::Outlines(o.contours))
+}
+
 /// Comment geometry helpers (text-box line breaking) for frontends.
 pub use pdfcraft_annot::appearance as annot_text;
 pub use pdfcraft_annot::links::{Highlight as LinkHighlight, LinkAction, LinkItem, LinkStyle};
@@ -199,7 +209,7 @@ fn scope_of(edit: &Edit) -> Scope {
 }
 
 /// One undo/redo step: its label, the document state, its passwords, and what it changed.
-type Snapshot = (String, pdfcraft_cos::Document, Keys, Scope);
+type Snapshot = (Label, pdfcraft_cos::Document, Keys, Scope);
 
 /// Editing state of a document (absent when the document cannot be edited yet, e.g. encrypted).
 #[derive(Clone)]
@@ -303,6 +313,7 @@ impl Document {
 
     /// Save image as: image `index` on `page` as a file (extension, bytes).
     pub fn page_image_file(&self, page: usize, index: usize) -> Result<(&'static str, Vec<u8>), String> {
+        self.check_copying().map_err(|e| e.to_string())?;
         let editor = self.editor.as_ref().ok_or("the document can't be read")?;
         let img = self.page_images(page).into_iter().nth(index).ok_or_else(|| format!("page {} has no image {}", page + 1, index + 1))?;
         if img.is_form {
@@ -326,6 +337,12 @@ impl Document {
         let e = self.editor.as_ref().ok_or("the document can't be read")?;
         measure::scale_at(&e.cos, page, at).map_err(|e| e.to_string())
     }
+    /// [`Self::measurement_scale`], measuring true size in `unit` (`per_point` of them in a
+    /// point) where the page sets no scale.
+    pub fn measurement_scale_or(&self, page: usize, at: measure::Point, per_point: f64, unit: &str) -> Result<measure::Scale, String> {
+        let e = self.editor.as_ref().ok_or("the document can't be read")?;
+        measure::scale_at_or(&e.cos, page, at, per_point, unit).map_err(|e| e.to_string())
+    }
     pub fn measurement_to_user(&self, page: usize, point: measure::Point) -> Result<measure::Point, String> {
         let e = self.editor.as_ref().ok_or("the document can't be read")?;
         measure::view_to_user(&e.cos, page, point).map_err(|e| e.to_string())
@@ -397,11 +414,21 @@ impl Document {
     }
 
     pub fn can_undo(&self) -> Option<&str> {
-        self.editor.as_ref().and_then(|e| e.undo.last()).map(|(l, ..)| l.as_str())
+        self.undo_label().map(Label::as_str)
     }
 
     pub fn can_redo(&self) -> Option<&str> {
-        self.editor.as_ref().and_then(|e| e.redo.last()).map(|(l, ..)| l.as_str())
+        self.redo_label().map(Label::as_str)
+    }
+
+    /// What Undo would undo, in parts, for an interface that says it in another language.
+    pub fn undo_label(&self) -> Option<&Label> {
+        self.editor.as_ref().and_then(|e| e.undo.last()).map(|(l, ..)| l)
+    }
+
+    /// What Redo would redo, in parts.
+    pub fn redo_label(&self) -> Option<&Label> {
+        self.editor.as_ref().and_then(|e| e.redo.last()).map(|(l, ..)| l)
     }
 
     pub fn editable(&self) -> bool {
@@ -418,6 +445,18 @@ impl Document {
         self.permissions().is_none_or(|p| p.print())
     }
 
+    /// Copying or otherwise extracting text and images is allowed (Table 22, bit 5): copying
+    /// selected text, snapshots, Save Image As, exporting. Assistive technology may read the
+    /// content regardless (§7.6.4.2), so reading aloud and accessibility tools don't ask.
+    pub fn allows_copying(&self) -> bool {
+        self.permissions().is_none_or(|p| p.copy())
+    }
+
+    /// [`Self::allows_copying`], as the error to report when it isn't.
+    pub fn check_copying(&self) -> Result<(), EditError> {
+        if self.allows_copying() { Ok(()) } else { Err(EditError::NotPermitted("copying text and images")) }
+    }
+
     /// Page changes (insert, delete, rotate, move, extract) are allowed.
     pub fn allows_assembly(&self) -> bool {
         self.editable() && self.permissions().is_none_or(|p| p.assemble())
@@ -449,6 +488,12 @@ impl Document {
         self.editable() && self.permissions().is_none_or(|p| unrestricted(&p))
     }
 
+    /// A password restricts the document and it wasn't opened with the owner password: entering
+    /// that password ([`Session::unlock`]) lifts the restrictions.
+    pub fn can_unlock(&self) -> bool {
+        self.editable() && self.permissions().is_some_and(|p| !unrestricted(&p))
+    }
+
     /// A summary of the document's security for Document Properties ▸ Security, including
     /// protection applied in this session (written by the next save).
     pub fn security_summary(&self) -> Option<SecuritySummary> {
@@ -492,6 +537,14 @@ impl Document {
         self.editor.as_ref().map(|e| pdfcraft_redact::sanitize::scan(&e.cos)).unwrap_or_default()
     }
 
+    /// Verification: faux redactions (opaque covers over extractable text) and redaction
+    /// marks that were never applied. Fails closed: any read error is returned, never an
+    /// empty list.
+    pub fn audit_redactions(&self) -> Result<Vec<pdfcraft_audit::AuditFinding>, String> {
+        let editor = self.editor.as_ref().ok_or("the document can't be read")?;
+        pdfcraft_audit::audit_redactions(&editor.cos).map_err(|e| e.to_string())
+    }
+
     /// Every page's media, crop, bleed, trim and art boxes (user space), for Set Page Boxes.
     pub fn page_boxes(&self) -> Vec<[[f64; 4]; 5]> {
         self.editor.as_ref().and_then(|e| pdfcraft_organize::page_boxes(&e.cos).ok()).unwrap_or_default()
@@ -1206,134 +1259,354 @@ pub enum Edit {
     },
 }
 
+/// What an edit is called in the Edit menu and in the history ("Undo Rotate pages"), in two parts:
+/// a whole English wording, and the one value the document itself supplies for the wording's hole
+/// (a file name, a field name). An interface in another language looks the wording up and says the
+/// label with [`said`](Self::said); [`as_str`](Self::as_str) is the English, said the same way, so
+/// the two cannot drift apart.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Label {
+    /// The wording, with one named hole (`{name}`) where `value` goes. Listed in [`EDIT_LABELS`].
+    pub wording: &'static str,
+    /// What the document supplies, when the wording has a hole for it.
+    pub value: Option<String>,
+    text: String,
+}
+
+impl Label {
+    /// A wording with nothing to fill in.
+    pub fn of(wording: &'static str) -> Self {
+        Self { wording, value: None, text: wording.to_string() }
+    }
+
+    /// A wording whose hole the document fills in.
+    pub fn with(wording: &'static str, value: impl Into<String>) -> Self {
+        let mut label = Self { wording, value: Some(value.into()), text: String::new() };
+        label.text = label.said(wording);
+        label
+    }
+
+    /// The label read with this wording: the interface's translation of [`wording`](Self::wording),
+    /// or the English wording itself. What the document supplies goes in as it stands and is not
+    /// read again, so a name with braces in it stays whole.
+    pub fn said(&self, wording: &str) -> String {
+        let Some(value) = &self.value else { return wording.to_owned() };
+        // `{` and `}` are ASCII, so these are char boundaries.
+        match (wording.find('{'), wording.find('}')) {
+            (Some(open), Some(close)) if open < close => {
+                let mut said = String::with_capacity(wording.len() + value.len());
+                said.push_str(&wording[..open]);
+                said.push_str(value);
+                said.push_str(&wording[close + 1..]);
+                said
+            }
+            // A translation that lost its hole is said as it stands rather than losing the value.
+            _ => wording.to_owned(),
+        }
+    }
+
+    /// The label as English reads it.
+    pub fn as_str(&self) -> &str {
+        &self.text
+    }
+}
+
+impl std::fmt::Display for Label {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.text)
+    }
+}
+
+/// Every wording [`Edit::label`] can produce, for an interface to translate. `Edit::Batch` is not
+/// here: its wording is only the hole, because a batch carries its name as text (see
+/// [`BATCH_LABELS`]).
+pub const EDIT_LABELS: &[&str] = &[
+    "Rotate page",
+    "Rotate pages",
+    "Delete page",
+    "Delete pages",
+    "Move page",
+    "Move pages",
+    "Insert blank page",
+    "Duplicate page",
+    "Duplicate pages",
+    "Replace page",
+    "Replace pages",
+    "Crop page",
+    "Crop pages",
+    "Set page boxes",
+    "Change Title",
+    "Change Author",
+    "Change Subject",
+    "Change Keywords",
+    "Change {key}",
+    "Insert pages from {name}",
+    "Add bookmark",
+    "Rename bookmark",
+    "Delete bookmark",
+    "Move bookmark",
+    "Set bookmark destination",
+    "New bookmarks from structure",
+    "Number pages",
+    "Measure distance",
+    "Measure perimeter",
+    "Measure area",
+    "Set measurement scale",
+    "Add sticky note",
+    "Add highlight",
+    "Add underline",
+    "Add strikethrough",
+    "Add squiggly underline",
+    "Add rectangle",
+    "Add oval",
+    "Add arrow",
+    "Add line",
+    "Add drawing",
+    "Add text box",
+    "Add checkmark",
+    "Add cross",
+    "Add dot",
+    "Add signature",
+    "Add redaction mark",
+    "Add cloud",
+    "Add polygon",
+    "Add connected lines",
+    "Add callout",
+    "Add inserted text",
+    "Add file attachment",
+    "Add stamp",
+    "Delete comment",
+    "Edit comment",
+    "Reply",
+    "Set status None",
+    "Set status Accepted",
+    "Set status Rejected",
+    "Set status Cancelled",
+    "Set status Completed",
+    "Replace text",
+    "Erase",
+    "Mark with checkmark",
+    "Remove checkmark",
+    "Lock comment",
+    "Unlock comment",
+    "Move comment",
+    "Resize comment",
+    "Change comment properties",
+    "Fill in {name}",
+    "Set the image of {name}",
+    "Clear form",
+    "Add field",
+    "Change field properties",
+    "Delete field",
+    "Duplicate field",
+    "Set tab order",
+    "Change initial view",
+    "Set alternate text",
+    "Mark figure as decorative",
+    "Recognize text",
+    "Run JavaScript",
+    "Run form script",
+    "Save as {level}",
+    "Edit script of {name}",
+    "Delete document JavaScript",
+    "Edit document JavaScript",
+    "Edit text",
+    "Move object",
+    "Move objects",
+    "Move image",
+    "Rotate image",
+    "Flip image",
+    "Replace image",
+    "Delete image",
+    "Add header & footer",
+    "Update header & footer",
+    "Add watermark",
+    "Update watermark",
+    "Add background",
+    "Update background",
+    "Remove header & footer",
+    "Remove watermark",
+    "Remove background",
+    "Add text",
+    "Add image",
+    "Edit content",
+    "Delete content",
+    "Apply redactions",
+    "Remove redaction marks",
+    "Remove hidden information",
+    "Import {name}",
+    "Add link",
+    "Change link properties",
+    "Delete link",
+    "Remove all links",
+    "Create link",
+    "Create links",
+    "Sanitize document",
+    "Flatten comments",
+    "Flatten form fields",
+    "Flatten",
+    "Flatten Fill & Sign",
+    "Protect with password",
+    "Remove security",
+];
+
+/// The names of the batches built below L7, which an interface shows in the same places as
+/// [`EDIT_LABELS`] and so translates the same way. A batch built in the interface itself arrives
+/// already worded in the interface's language.
+pub const BATCH_LABELS: &[&str] = &["Set document title", "Mark differences", "Detect form fields", "Run JavaScript", "Recognize text"];
+
 impl Edit {
     /// Label for the Edit menu and history ("Undo Rotate pages").
-    pub fn label(&self) -> String {
+    pub fn label(&self) -> Label {
         match self {
-            Edit::RotatePages { pages, .. } => plural("Rotate page", pages.len()),
-            Edit::DeletePages { pages } => plural("Delete page", pages.len()),
-            Edit::MovePages { pages, .. } => plural("Move page", pages.len()),
-            Edit::InsertBlankPage { .. } => "Insert blank page".into(),
-            Edit::DuplicatePages { pages } => plural("Duplicate page", pages.len()),
-            Edit::ReplacePages { pages, .. } => plural("Replace page", pages.len()),
-            Edit::SetPageBox { pages, which: PageBox::Crop, .. } => plural("Crop page", pages.len()),
-            Edit::SetPageBox { .. } => "Set page boxes".into(),
-            Edit::SetInfo { key, .. } => format!("Change {key}"),
-            Edit::InsertPagesFrom { name, .. } => format!("Insert pages from {name}"),
-            Edit::AddBookmark { .. } => "Add bookmark".into(),
-            Edit::RenameBookmark { .. } => "Rename bookmark".into(),
-            Edit::DeleteBookmark { .. } => "Delete bookmark".into(),
-            Edit::MoveBookmark { .. } => "Move bookmark".into(),
-            Edit::SetBookmarkPage { .. } => "Set bookmark destination".into(),
-            Edit::BookmarksFromStructure => "New bookmarks from structure".into(),
-            Edit::NumberPages { .. } => "Number pages".into(),
-            Edit::AddMeasurement(m) => format!("Measure {}", m.kind.name()),
-            Edit::SetMeasurementScale { .. } => "Set measurement scale".into(),
-            Edit::AddAnnotation(a) => format!("Add {}", annotation_noun(&a.shape)),
-            Edit::AddCustomStamp { .. } => "Add stamp".into(),
-            Edit::DeleteAnnotation { .. } => "Delete comment".into(),
-            Edit::SetAnnotationContents { .. } => "Edit comment".into(),
-            Edit::ReplyToAnnotation { .. } => "Reply".into(),
-            Edit::SetAnnotationStatus { state, .. } => format!("Set status {}", state.name()),
-            Edit::ReplaceText { .. } => "Replace text".into(),
-            Edit::EraseInk { .. } => "Erase".into(),
-            Edit::MarkAnnotation { marked: true, .. } => "Mark with checkmark".into(),
-            Edit::MarkAnnotation { .. } => "Remove checkmark".into(),
-            Edit::LockAnnotation { locked: true, .. } => "Lock comment".into(),
-            Edit::LockAnnotation { .. } => "Unlock comment".into(),
-            Edit::MoveAnnotation { .. } => "Move comment".into(),
-            Edit::ResizeAnnotation { .. } => "Resize comment".into(),
-            Edit::StyleAnnotation { .. } | Edit::FillAnnotation { .. } | Edit::SetAnnotationInfo { .. } => "Change comment properties".into(),
-            Edit::SetFieldValue { name, .. } => format!("Fill in {name}"),
-            Edit::SetFieldImage { name, .. } => format!("Set the image of {name}"),
-            Edit::ResetForm { .. } => "Clear form".into(),
-            Edit::AddField { .. } => "Add field".into(),
-            Edit::SetFieldProps { .. } => "Change field properties".into(),
-            Edit::DeleteField { .. } => "Delete field".into(),
-            Edit::DuplicateField { .. } => "Duplicate field".into(),
-            Edit::SetTabOrder { .. } | Edit::MoveInTabOrder { .. } => "Set tab order".into(),
-            Edit::SetInitialView(_) => "Change initial view".into(),
-            Edit::SetAltText { .. } => "Set alternate text".into(),
-            Edit::MarkDecorative { .. } => "Mark figure as decorative".into(),
-            Edit::AddOcrText { .. } => "Recognize text".into(),
-            Edit::ApplyScriptChanges { .. } => "Run JavaScript".into(),
-            Edit::XfaEvent { .. } => "Run form script".into(),
-            Edit::ConvertPdfA { level } => format!("Save as {}", level.label()),
-            Edit::SetFieldScript { name, .. } => format!("Edit script of {name}"),
-            Edit::SetDocumentScript { script: None, .. } => "Delete document JavaScript".into(),
-            Edit::SetDocumentScript { .. } => "Edit document JavaScript".into(),
-            Edit::EditTextLine { .. } | Edit::EditTextBlock { .. } => "Edit text".into(),
-            Edit::MoveObjects { objects, .. } => plural("Move object", objects.len()),
-            Edit::EditPageImage { change, .. } => match change {
-                ImageEdit::Move(_) => "Move image".into(),
-                ImageEdit::Rotate(_) => "Rotate image".into(),
-                ImageEdit::Flip { .. } => "Flip image".into(),
-                ImageEdit::Replace { .. } => "Replace image".into(),
-                ImageEdit::Delete => "Delete image".into(),
+            Edit::RotatePages { pages, .. } => plural("Rotate page", "Rotate pages", pages.len()),
+            Edit::DeletePages { pages } => plural("Delete page", "Delete pages", pages.len()),
+            Edit::MovePages { pages, .. } => plural("Move page", "Move pages", pages.len()),
+            Edit::InsertBlankPage { .. } => Label::of("Insert blank page"),
+            Edit::DuplicatePages { pages } => plural("Duplicate page", "Duplicate pages", pages.len()),
+            Edit::ReplacePages { pages, .. } => plural("Replace page", "Replace pages", pages.len()),
+            Edit::SetPageBox { pages, which: PageBox::Crop, .. } => plural("Crop page", "Crop pages", pages.len()),
+            Edit::SetPageBox { .. } => Label::of("Set page boxes"),
+            // The four `/Info` keys PdfCraft itself offers get a wording of their own, so each can
+            // be said in another language; any other key is the document's and goes in as it stands.
+            Edit::SetInfo { key, .. } => match key.as_str() {
+                "Title" => Label::of("Change Title"),
+                "Author" => Label::of("Change Author"),
+                "Subject" => Label::of("Change Subject"),
+                "Keywords" => Label::of("Change Keywords"),
+                _ => Label::with("Change {key}", key.as_str()),
             },
-            Edit::AddHeaderFooter { replace: false, .. } => "Add header & footer".into(),
-            Edit::AddHeaderFooter { .. } => "Update header & footer".into(),
-            Edit::AddWatermark { replace: false, .. } => "Add watermark".into(),
-            Edit::AddWatermark { .. } => "Update watermark".into(),
-            Edit::AddBackground { replace: false, .. } => "Add background".into(),
-            Edit::AddBackground { .. } => "Update background".into(),
-            Edit::RemoveMarks { kind: MarkKind::HeaderFooter } => "Remove header & footer".into(),
-            Edit::RemoveMarks { kind: MarkKind::Watermark } => "Remove watermark".into(),
-            Edit::RemoveMarks { kind: MarkKind::Background } => "Remove background".into(),
-            Edit::AddText { .. } => "Add text".into(),
-            Edit::AddImage { .. } => "Add image".into(),
-            Edit::UpdateContent { .. } => "Edit content".into(),
-            Edit::DeleteContent { .. } => "Delete content".into(),
-            Edit::ReplaceImage { .. } => "Replace image".into(),
-            Edit::ApplyRedactions { .. } => "Apply redactions".into(),
-            Edit::ClearRedactions => "Remove redaction marks".into(),
-            Edit::RemoveHidden { .. } => "Remove hidden information".into(),
-            Edit::ImportData { name, .. } => format!("Import {name}"),
-            Edit::AddLink { .. } => "Add link".into(),
-            Edit::SetLink { .. } => "Change link properties".into(),
-            Edit::DeleteLink { .. } => "Delete link".into(),
-            Edit::RemoveLinks { .. } => "Remove all links".into(),
-            Edit::AddLinks { links, .. } => plural("Create link", links.len()),
-            Edit::Sanitize => "Sanitize document".into(),
-            Edit::Flatten { comments: true, fields: false } => "Flatten comments".into(),
-            Edit::Flatten { comments: false, fields: true } => "Flatten form fields".into(),
-            Edit::Flatten { .. } => "Flatten".into(),
-            Edit::FlattenFillSign => "Flatten Fill & Sign".into(),
-            Edit::Protect(_) => "Protect with password".into(),
-            Edit::RemoveProtection => "Remove security".into(),
-            Edit::Batch { label, .. } => label.clone(),
+            Edit::InsertPagesFrom { name, .. } => Label::with("Insert pages from {name}", name.as_str()),
+            Edit::AddBookmark { .. } => Label::of("Add bookmark"),
+            Edit::RenameBookmark { .. } => Label::of("Rename bookmark"),
+            Edit::DeleteBookmark { .. } => Label::of("Delete bookmark"),
+            Edit::MoveBookmark { .. } => Label::of("Move bookmark"),
+            Edit::SetBookmarkPage { .. } => Label::of("Set bookmark destination"),
+            Edit::BookmarksFromStructure => Label::of("New bookmarks from structure"),
+            Edit::NumberPages { .. } => Label::of("Number pages"),
+            // What was measured is part of the wording too, for the same reason.
+            Edit::AddMeasurement(m) => Label::of(match m.kind {
+                pdfcraft_measure::Kind::Distance => "Measure distance",
+                pdfcraft_measure::Kind::Perimeter => "Measure perimeter",
+                pdfcraft_measure::Kind::Area => "Measure area",
+            }),
+            Edit::SetMeasurementScale { .. } => Label::of("Set measurement scale"),
+            Edit::AddAnnotation(a) => Label::of(add_annotation(&a.shape)),
+            Edit::AddCustomStamp { .. } => Label::of("Add stamp"),
+            Edit::DeleteAnnotation { .. } => Label::of("Delete comment"),
+            Edit::SetAnnotationContents { .. } => Label::of("Edit comment"),
+            Edit::ReplyToAnnotation { .. } => Label::of("Reply"),
+            // The state's name is part of the wording: a language may need to agree it with the rest.
+            Edit::SetAnnotationStatus { state, .. } => Label::of(match state {
+                ReviewState::None => "Set status None",
+                ReviewState::Accepted => "Set status Accepted",
+                ReviewState::Rejected => "Set status Rejected",
+                ReviewState::Cancelled => "Set status Cancelled",
+                ReviewState::Completed => "Set status Completed",
+            }),
+            Edit::ReplaceText { .. } => Label::of("Replace text"),
+            Edit::EraseInk { .. } => Label::of("Erase"),
+            Edit::MarkAnnotation { marked: true, .. } => Label::of("Mark with checkmark"),
+            Edit::MarkAnnotation { .. } => Label::of("Remove checkmark"),
+            Edit::LockAnnotation { locked: true, .. } => Label::of("Lock comment"),
+            Edit::LockAnnotation { .. } => Label::of("Unlock comment"),
+            Edit::MoveAnnotation { .. } => Label::of("Move comment"),
+            Edit::ResizeAnnotation { .. } => Label::of("Resize comment"),
+            Edit::StyleAnnotation { .. } | Edit::FillAnnotation { .. } | Edit::SetAnnotationInfo { .. } => Label::of("Change comment properties"),
+            Edit::SetFieldValue { name, .. } => Label::with("Fill in {name}", name.as_str()),
+            Edit::SetFieldImage { name, .. } => Label::with("Set the image of {name}", name.as_str()),
+            Edit::ResetForm { .. } => Label::of("Clear form"),
+            Edit::AddField { .. } => Label::of("Add field"),
+            Edit::SetFieldProps { .. } => Label::of("Change field properties"),
+            Edit::DeleteField { .. } => Label::of("Delete field"),
+            Edit::DuplicateField { .. } => Label::of("Duplicate field"),
+            Edit::SetTabOrder { .. } | Edit::MoveInTabOrder { .. } => Label::of("Set tab order"),
+            Edit::SetInitialView(_) => Label::of("Change initial view"),
+            Edit::SetAltText { .. } => Label::of("Set alternate text"),
+            Edit::MarkDecorative { .. } => Label::of("Mark figure as decorative"),
+            Edit::AddOcrText { .. } => Label::of("Recognize text"),
+            Edit::ApplyScriptChanges { .. } => Label::of("Run JavaScript"),
+            Edit::XfaEvent { .. } => Label::of("Run form script"),
+            // The level is the standard's own name ("PDF/A-2b"), so it goes in as it stands.
+            Edit::ConvertPdfA { level } => Label::with("Save as {level}", level.label()),
+            Edit::SetFieldScript { name, .. } => Label::with("Edit script of {name}", name.as_str()),
+            Edit::SetDocumentScript { script: None, .. } => Label::of("Delete document JavaScript"),
+            Edit::SetDocumentScript { .. } => Label::of("Edit document JavaScript"),
+            Edit::EditTextLine { .. } | Edit::EditTextBlock { .. } => Label::of("Edit text"),
+            Edit::MoveObjects { objects, .. } => plural("Move object", "Move objects", objects.len()),
+            Edit::EditPageImage { change, .. } => Label::of(match change {
+                ImageEdit::Move(_) => "Move image",
+                ImageEdit::Rotate(_) => "Rotate image",
+                ImageEdit::Flip { .. } => "Flip image",
+                ImageEdit::Replace { .. } => "Replace image",
+                ImageEdit::Delete => "Delete image",
+            }),
+            Edit::AddHeaderFooter { replace: false, .. } => Label::of("Add header & footer"),
+            Edit::AddHeaderFooter { .. } => Label::of("Update header & footer"),
+            Edit::AddWatermark { replace: false, .. } => Label::of("Add watermark"),
+            Edit::AddWatermark { .. } => Label::of("Update watermark"),
+            Edit::AddBackground { replace: false, .. } => Label::of("Add background"),
+            Edit::AddBackground { .. } => Label::of("Update background"),
+            Edit::RemoveMarks { kind: MarkKind::HeaderFooter } => Label::of("Remove header & footer"),
+            Edit::RemoveMarks { kind: MarkKind::Watermark } => Label::of("Remove watermark"),
+            Edit::RemoveMarks { kind: MarkKind::Background } => Label::of("Remove background"),
+            Edit::AddText { .. } => Label::of("Add text"),
+            Edit::AddImage { .. } => Label::of("Add image"),
+            Edit::UpdateContent { .. } => Label::of("Edit content"),
+            Edit::DeleteContent { .. } => Label::of("Delete content"),
+            Edit::ReplaceImage { .. } => Label::of("Replace image"),
+            Edit::ApplyRedactions { .. } => Label::of("Apply redactions"),
+            Edit::ClearRedactions => Label::of("Remove redaction marks"),
+            Edit::RemoveHidden { .. } => Label::of("Remove hidden information"),
+            Edit::ImportData { name, .. } => Label::with("Import {name}", name.as_str()),
+            Edit::AddLink { .. } => Label::of("Add link"),
+            Edit::SetLink { .. } => Label::of("Change link properties"),
+            Edit::DeleteLink { .. } => Label::of("Delete link"),
+            Edit::RemoveLinks { .. } => Label::of("Remove all links"),
+            Edit::AddLinks { links, .. } => plural("Create link", "Create links", links.len()),
+            Edit::Sanitize => Label::of("Sanitize document"),
+            Edit::Flatten { comments: true, fields: false } => Label::of("Flatten comments"),
+            Edit::Flatten { comments: false, fields: true } => Label::of("Flatten form fields"),
+            Edit::Flatten { .. } => Label::of("Flatten"),
+            Edit::FlattenFillSign => Label::of("Flatten Fill & Sign"),
+            Edit::Protect(_) => Label::of("Protect with password"),
+            Edit::RemoveProtection => Label::of("Remove security"),
+            // A batch carries its own name, already worded by whoever built it.
+            // A batch carries its name as text, so the wording is only the hole (see `BATCH_LABELS`).
+            Edit::Batch { label, .. } => Label::with("{batch}", label.as_str()),
         }
     }
 }
 
-/// What the Edit menu calls a new comment ("Undo Add highlight").
-fn annotation_noun(s: &Shape) -> &'static str {
+/// What the Edit menu calls a new comment ("Undo Add highlight"). A whole wording for each kind,
+/// so a language can give the noun the article and the gender its own grammar asks for.
+fn add_annotation(s: &Shape) -> &'static str {
     match s {
-        Shape::Note { .. } => "sticky note",
-        Shape::TextMarkup { kind: Markup::Highlight, .. } => "highlight",
-        Shape::TextMarkup { kind: Markup::Underline, .. } => "underline",
-        Shape::TextMarkup { kind: Markup::StrikeOut, .. } => "strikethrough",
-        Shape::TextMarkup { kind: Markup::Squiggly, .. } => "squiggly underline",
-        Shape::Rectangle { .. } => "rectangle",
-        Shape::Oval { .. } => "oval",
-        Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "arrow",
-        Shape::Line { .. } => "line",
-        Shape::Ink { .. } => "drawing",
-        Shape::TextBox { .. } => "text box",
-        Shape::Typewriter { .. } => "text",
-        Shape::Mark { mark: FillMark::Check, .. } => "checkmark",
-        Shape::Mark { mark: FillMark::Cross, .. } => "cross",
-        Shape::Mark { mark: FillMark::Dot, .. } => "dot",
-        Shape::Mark { mark: FillMark::Line, .. } => "line",
-        Shape::Signature { .. } | Shape::TypedSignature { .. } => "signature",
-        Shape::Redact { .. } => "redaction mark",
-        Shape::Stamp { .. } | Shape::CustomStamp { .. } => "stamp",
-        Shape::Polygon { cloud: true, .. } => "cloud",
-        Shape::Polygon { .. } => "polygon",
-        Shape::PolyLine { .. } => "connected lines",
-        Shape::Callout { .. } => "callout",
-        Shape::Caret { .. } => "inserted text",
-        Shape::Attachment { .. } => "file attachment",
+        Shape::Note { .. } => "Add sticky note",
+        Shape::TextMarkup { kind: Markup::Highlight, .. } => "Add highlight",
+        Shape::TextMarkup { kind: Markup::Underline, .. } => "Add underline",
+        Shape::TextMarkup { kind: Markup::StrikeOut, .. } => "Add strikethrough",
+        Shape::TextMarkup { kind: Markup::Squiggly, .. } => "Add squiggly underline",
+        Shape::Rectangle { .. } => "Add rectangle",
+        Shape::Oval { .. } => "Add oval",
+        Shape::Line { start: LineEnding::None, end: LineEnding::OpenArrow, .. } => "Add arrow",
+        Shape::Line { .. } => "Add line",
+        Shape::Ink { .. } => "Add drawing",
+        Shape::TextBox { .. } => "Add text box",
+        Shape::Typewriter { .. } => "Add text",
+        Shape::Mark { mark: FillMark::Check, .. } => "Add checkmark",
+        Shape::Mark { mark: FillMark::Cross, .. } => "Add cross",
+        Shape::Mark { mark: FillMark::Dot, .. } => "Add dot",
+        Shape::Mark { mark: FillMark::Line, .. } => "Add line",
+        Shape::Signature { .. } | Shape::TypedSignature { .. } => "Add signature",
+        Shape::Redact { .. } => "Add redaction mark",
+        Shape::Stamp { .. } | Shape::CustomStamp { .. } => "Add stamp",
+        Shape::Polygon { cloud: true, .. } => "Add cloud",
+        Shape::Polygon { .. } => "Add polygon",
+        Shape::PolyLine { .. } => "Add connected lines",
+        Shape::Callout { .. } => "Add callout",
+        Shape::Caret { .. } => "Add inserted text",
+        Shape::Attachment { .. } => "Add file attachment",
     }
 }
 
@@ -1915,9 +2188,6 @@ pub fn guard<T>(f: impl FnOnce() -> T) -> Result<T, String> {
     })
 }
 
-/// The most files Create ▸ Multiple files takes in one run.
-pub const MAX_CREATE_FILES: usize = 1000;
-
 /// Parse another PDF to copy pages from.
 fn open_source(name: &str, bytes: &Arc<Vec<u8>>) -> Result<pdfcraft_cos::Document, EditError> {
     open_source_with(name, bytes, None)
@@ -1966,8 +2236,10 @@ pub fn source_page_count(bytes: &Arc<Vec<u8>>, password: Option<&str>) -> Option
     pdfcraft_organize::page_count(&doc).ok()
 }
 
-fn plural(s: &str, n: usize) -> String {
-    if n == 1 { s.to_string() } else { format!("{s}s") }
+/// The singular or the plural wording, by count. Both are written out: a language forms its plural
+/// its own way, and `one` and `many` may differ in more than an "s".
+fn plural(one: &'static str, many: &'static str, n: usize) -> Label {
+    Label::of(if n == 1 { one } else { many })
 }
 
 #[derive(Debug, thiserror::Error, PartialEq)]
@@ -1988,6 +2260,8 @@ pub enum EditError {
     Measure(#[from] measure::MeasureError),
     #[error("{0}")]
     Protection(String),
+    #[error("the password is incorrect")]
+    WrongPassword,
     #[error("{0}")]
     Form(#[from] pdfcraft_forms::FormError),
     #[error(transparent)]
@@ -2051,10 +2325,20 @@ pub struct Session {
 /// Lay a dynamic XFA form out (pages and fields) and give its widgets appearances.
 fn xfa_layout(doc: &mut pdfcraft_cos::Document) -> Result<XfaLayout, String> {
     let report = pdfcraft_xfa::render_into(doc).map_err(|e| e.to_string())?;
+    xfa_redraw(doc)?;
+    Ok(report)
+}
+
+/// Give the fields of a laid-out XFA form their appearances. A signed signature box keeps the
+/// picture its signer's application drew.
+pub(crate) fn xfa_redraw(doc: &mut pdfcraft_cos::Document) -> Result<(), String> {
     for f in pdfcraft_forms::fields(doc) {
+        if f.kind == pdfcraft_forms::FieldKind::Signature && doc.get(f.obj).as_dict().is_some_and(|d| d.contains(b"V")) {
+            continue;
+        }
         pdfcraft_forms::redraw_field(doc, &f.name).map_err(|e| format!("{}: {e}", f.name))?;
     }
-    Ok(report)
+    Ok(())
 }
 
 /// The form's fields as the XFA data layer wants them.
@@ -2380,12 +2664,14 @@ impl Session {
         };
         let display = display_bytes(editor.as_ref(), &bytes);
         let renderer = RenderPool::new(display.clone(), render_threads(), config.clone());
-        let mut form = editor.as_ref().map(|e| pdfcraft_forms::fields(&e.cos)).unwrap_or_default();
-        let mut adopted = 0;
-        if let Some(e) = editor.as_ref() {
-            xfa::mark_script_buttons(&e.cos, &mut form);
-            adopted = pdfcraft_forms::adopted_page_fields(&e.cos);
-        }
+        let (form, adopted) = editor
+            .as_ref()
+            .map(|e| {
+                let mut fields = pdfcraft_forms::fields_with_adopted(&e.cos);
+                xfa::mark_script_buttons(&e.cos, &mut fields.items);
+                (fields.items, fields.adopted_page_fields)
+            })
+            .unwrap_or_default();
         // Fields the file lists only as page widgets are adopted leniently; the file says so.
         if adopted > 0
             && let Some(e) = &mut editor
@@ -2397,8 +2683,13 @@ impl Session {
             };
             e.cos.note_repair(line);
         }
-        let marks = editor.as_ref().map(|e| pdfcraft_edit::marks_present(&e.cos)).unwrap_or_default();
-        let added = editor.as_ref().map(|e| pdfcraft_edit::list_added(&e.cos)).unwrap_or_default();
+        let (marks, added) = editor
+            .as_ref()
+            .map(|e| {
+                let scan = pdfcraft_edit::scan_markers(&e.cos);
+                (scan.marks, scan.added)
+            })
+            .unwrap_or_default();
         let links = editor.as_ref().map(|e| pdfcraft_annot::links::list(&e.cos)).unwrap_or_default();
         let sig_cache = Arc::new(pdfcraft_sign::DigestCache::default());
         let signatures = editor.as_ref().map(|e| signatures_of(&e.cos, &bytes, &self.trust, &sig_cache)).unwrap_or_default();
@@ -2516,7 +2807,7 @@ impl Session {
         // (applying redactions, changing security, sanitizing) would invalidate the signatures.
         let rewrites = |c: &pdfcraft_cos::Document| c.full_save_required() || c.encryption_changed();
         if signed && rewrites(&next) && !rewrites(&editor.cos) {
-            return Err(EditError::SignedRewrite(edit.label()));
+            return Err(EditError::SignedRewrite(edit.label().to_string()));
         }
         let previous = std::mem::replace(&mut editor.cos, next);
         let keys = keys_after(&edit).unwrap_or_else(|| editor.keys.clone());
@@ -2557,7 +2848,7 @@ impl Session {
         Ok(())
     }
 
-    pub fn undo(&mut self, id: DocId) -> Result<String, EditError> {
+    pub fn undo(&mut self, id: DocId) -> Result<Label, EditError> {
         let doc = self.doc_mut(id)?;
         let editor = doc.editor.as_mut().ok_or(EditError::NothingToUndo)?;
         let (label, prev, keys, scope) = editor.undo.pop().ok_or(EditError::NothingToUndo)?;
@@ -2571,7 +2862,7 @@ impl Session {
         Ok(label)
     }
 
-    pub fn redo(&mut self, id: DocId) -> Result<String, EditError> {
+    pub fn redo(&mut self, id: DocId) -> Result<Label, EditError> {
         let doc = self.doc_mut(id)?;
         let editor = doc.editor.as_mut().ok_or(EditError::NothingToRedo)?;
         let (label, next, keys, scope) = editor.redo.pop().ok_or(EditError::NothingToRedo)?;
@@ -2631,8 +2922,15 @@ impl Session {
             Scope::Metadata => return Ok(()),
             Scope::Comments => doc.info.annotations = comment_list(&editor.cos),
             Scope::Form => {
+                // PERF: keystroke path, index once. A linear find per field is O(F^2);
+                // forms reach 10k fields.
+                let mut by_name = std::collections::HashMap::with_capacity(form.len());
+                for x in form.iter() {
+                    // First match wins (do not simplify to collect: it keeps the last).
+                    by_name.entry(x.name.as_str()).or_insert(x);
+                }
                 for f in &mut doc.info.fields {
-                    if let Some(ff) = form.iter().find(|x| x.name == f.name) {
+                    if let Some(ff) = by_name.get(f.name.as_str()) {
                         f.value = match ff.kind {
                             pdfcraft_forms::FieldKind::CheckBox | pdfcraft_forms::FieldKind::Radio => {
                                 Some(ff.value.first().cloned().unwrap_or_else(|| "Off".into()))
@@ -2684,8 +2982,9 @@ impl Session {
         let mut form = pdfcraft_forms::fields(&editor.cos);
         xfa::mark_script_buttons(&editor.cos, &mut form);
         doc.form = Arc::new(form);
-        doc.marks = pdfcraft_edit::marks_present(&editor.cos);
-        doc.added = pdfcraft_edit::list_added(&editor.cos);
+        let marker_scan = pdfcraft_edit::scan_markers(&editor.cos);
+        doc.marks = marker_scan.marks;
+        doc.added = marker_scan.added;
         doc.links = pdfcraft_annot::links::list(&editor.cos);
         doc.signatures = signatures_of(&editor.cos, &bytes, &doc.trust, &doc.sig_cache);
         doc.display = display_bytes(Some(editor), &bytes);
@@ -2736,6 +3035,39 @@ impl Session {
         Self::refresh(doc)
     }
 
+    /// Enter the permissions (owner) password of a document opened with its user password,
+    /// lifting its restrictions for this session (Acrobat asks for it before changing security).
+    /// Not an edit: nothing is marked unsaved and there is no undo step. Undo and redo states
+    /// are unlocked as well, and saving keeps the rights. Unencrypted documents and documents
+    /// opened by the owner need nothing.
+    pub fn unlock(&mut self, id: DocId, password: &str) -> Result<(), EditError> {
+        let doc = self.doc_mut(id)?;
+        let editor = doc.editor.as_mut().ok_or_else(|| EditError::ReadOnly(doc.read_only_reason.clone().unwrap_or_default()))?;
+        if editor.cos.permissions().is_none_or(|p| p.owner) {
+            return Ok(());
+        }
+        editor.cos.unlock(password).map_err(|e| match e {
+            pdfcraft_cos::CosError::WrongPassword => EditError::WrongPassword,
+            other => EditError::Protection(other.to_string()),
+        })?;
+        // Saving a state that keeps the security it was opened with reopens it with the same
+        // passwords, so it reopens as owner.
+        let reopen_as_owner = |cos: &pdfcraft_cos::Document, keys: &mut Keys| {
+            if !cos.encryption_changed() {
+                keys.reopen = Some(password.to_owned());
+            }
+        };
+        reopen_as_owner(&editor.cos, &mut editor.keys);
+        // Other states with the same restricted access are unlocked too; states opened with
+        // other passwords (protection changed and saved since) stay as they are.
+        for (_, cos, keys, _) in editor.undo.iter_mut().chain(editor.redo.iter_mut()) {
+            if cos.permissions().is_some_and(|p| !p.owner) && cos.unlock(password).is_ok() {
+                reopen_as_owner(cos, keys);
+            }
+        }
+        Ok(())
+    }
+
     /// File ▸ Revert: back to the last saved version (or the file as opened). Undo history is
     /// cleared, as in Acrobat.
     pub fn revert(&mut self, id: DocId) -> Result<(), EditError> {
@@ -2761,6 +3093,29 @@ impl Session {
         Self::refresh(doc)
     }
 
+    /// The document's file changed on disk (a LaTeX or Typst build rewrote it, #431): open
+    /// `bytes`, the file as it is now, in its place. Everything opening does runs again (XFA
+    /// layout and scripts, signatures, repairs), but the document keeps its id, name and path,
+    /// so its tab and view stay with it. Undo history goes, as with Revert. The password it was
+    /// opened with is tried; on any failure the document is left as it was.
+    pub fn reload(&mut self, id: DocId, bytes: Arc<Vec<u8>>) -> Result<(), OpenError> {
+        let old = self.docs.iter().position(|d| d.id == id).ok_or_else(|| OpenError::Invalid("the document is not open".into()))?;
+        let doc = &self.docs[old];
+        let (name, path, generation) = (doc.name.clone(), doc.path.clone(), doc.generation);
+        let password = doc.editor.as_ref().and_then(|e| e.keys.reopen.clone()).or_else(|| doc.password.clone());
+        let new_id = self.open(name, path, bytes, password.as_deref())?;
+        let at = self.docs.iter().position(|d| d.id == new_id).ok_or_else(|| OpenError::Invalid("the new version was not kept".into()))?;
+        let mut doc = self.docs.remove(at);
+        doc.id = id;
+        // Caches keyed by the edit generation (edit lines, images, measurements) must see a new
+        // one; there is nothing new to autosave.
+        doc.generation = generation + 1;
+        doc.snapshot_generation = doc.generation;
+        // `open` pushed the new version last, so the old one is still at `old`.
+        *self.docs.get_mut(old).ok_or_else(|| OpenError::Invalid("the document is not open".into()))? = doc;
+        Ok(())
+    }
+
     /// The page count of another PDF (Replace Pages, Insert Pages dialogs).
     pub fn page_count_of(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<usize, EditError> {
         Ok(pdfcraft_organize::page_count(&open_source(name, bytes)?)?)
@@ -2803,6 +3158,18 @@ impl Session {
         Ok((kind, created?))
     }
 
+    /// A file for Combine as PDF bytes: an image or text file is converted; a PDF is returned as
+    /// it is, unchecked (Combine reads it itself, with its password), as is a file named .pdf
+    /// without a `%PDF-` header, which the reader may still open.
+    pub fn as_pdf(&self, name: &str, bytes: &Arc<Vec<u8>>) -> Result<Arc<Vec<u8>>, EditError> {
+        let pdf = match source_kind(name, bytes) {
+            Some(SourceKind::Pdf) => true,
+            Some(SourceKind::Image | SourceKind::Text) => false,
+            None => name.to_ascii_lowercase().ends_with(".pdf"),
+        };
+        if pdf { Ok(bytes.clone()) } else { self.convert_to_pdf(name, bytes).map(|(_, pdf)| pdf) }
+    }
+
     /// Reduce File Size: Acrobat's defaults (images above 225 ppi to 150 ppi, JPEG medium
     /// quality; thumbnails dropped), identical resources merged, unused objects dropped, objects
     /// packed into compressed object streams. Returns the bytes and how many objects were
@@ -2866,6 +3233,43 @@ impl Session {
         self.combine_unlocked(sources, &[])
     }
 
+    /// Combine sources one at a time, in order (Create ▸ Multiple files), to the same result as
+    /// [`Self::combine_ranges`]. Each item is a source's bookmark title, its PDF bytes (see
+    /// [`Self::convert_to_pdf`]) and its page range (`None` for all pages). Items are pulled one at a
+    /// time: a source is opened, its pages are copied into the result, and its bytes are released
+    /// before the next item is read. So the number of sources is not limited, and one source's
+    /// document is held at a time. An item's error stops the combine and is returned as it is.
+    /// `Ok(None)` when there are no sources.
+    pub fn combine_each<I, E>(&self, sources: I) -> Result<Option<Arc<Vec<u8>>>, E>
+    where
+        I: IntoIterator<Item = Result<CombineSource, E>>,
+        E: From<EditError>,
+    {
+        let mut combiner = pdfcraft_organize::Combiner::new();
+        let mut added = false;
+        for source in sources {
+            let (title, bytes, range) = source?;
+            let doc = open_source(&title, &bytes)?;
+            let range = range.as_deref().map(str::trim).filter(|r| !r.is_empty());
+            let pages = match range {
+                Some(r) => {
+                    let n = pdfcraft_organize::page_count(&doc).map_err(EditError::from)?;
+                    let p = pdfcraft_print::select_pages(n, Some(r), &[], pdfcraft_print::Subset::All, false)
+                        .map_err(|e| EditError::Print(format!("{title}: {e}")))?;
+                    Some(p)
+                }
+                None => None,
+            };
+            combiner.add(&title, &doc, pages.as_deref()).map_err(EditError::from)?;
+            added = true;
+        }
+        if !added {
+            return Ok(None);
+        }
+        let out = combiner.finish().map_err(EditError::from)?;
+        Ok(Some(self.write_new(&out)?))
+    }
+
     /// [`Self::combine_ranges`] with the password each encrypted source is opened with, by
     /// position (missing or `None`: no password). The result is not encrypted.
     pub fn combine_unlocked(&self, sources: &[CombineSource], passwords: &[Option<&str>]) -> Result<Arc<Vec<u8>>, EditError> {
diff --git a/crates/engine/src/signature_image.rs b/crates/engine/src/signature_image.rs
index 88919541..3e1d621d 100644
--- a/crates/engine/src/signature_image.rs
+++ b/crates/engine/src/signature_image.rs
@@ -52,8 +52,8 @@ impl Document {
             let obj = editor.cos.get(picture);
             let pdfcraft_cos::Object::Stream(s) = &*obj else { return Err("the signature image is damaged".into()) };
             let (w, h) = (s.dict.int(b"Width").unwrap_or(0), s.dict.int(b"Height").unwrap_or(0));
-            if w <= 0 || h <= 0 || w > 4096 || h > 4096 || w.saturating_mul(h) > MAX_PIXELS as i64 {
-                return Err(SignatureImageError::Size.to_string());
+            if w <= 0 || h <= 0 || w > i64::from(MAX_SIDE) || h > i64::from(MAX_SIDE) || w.saturating_mul(h) > MAX_PIXELS as i64 {
+                return Err(SignatureImageError::PlacedSize.to_string());
             }
             let (_, bytes) = pdfcraft_create::image_file(&editor.cos, picture)?;
             let image = SignatureImage::from_bytes(&bytes).map_err(|e| e.to_string())?;
@@ -90,13 +90,20 @@ pub fn upright_box(rotation: i64, at: [f64; 2], width: f64, height: f64) -> Opti
 /// Saved signatures live in settings, so both source and normalized PNG are bounded.
 pub const MAX_SIGNATURE_IMAGE_BYTES: usize = 4 << 20;
 const MAX_PIXELS: u64 = 4 << 20;
+const MAX_SIDE: u32 = 4096;
+/// Larger sources (scans, phone photos) are decoded within these bounds, then scaled down.
+const MAX_SOURCE_SIDE: u32 = 8192;
+const MAX_SOURCE_PIXELS: u64 = 32 << 20;
 
 #[derive(Debug, thiserror::Error)]
 pub enum SignatureImageError {
     #[error("Choose a PNG or JPEG image.")]
     Format,
-    #[error("Choose an image smaller than 4 MiB and 4 megapixels (at most 4096 pixels per side).")]
+    #[error("Choose an image smaller than 4 MiB and 32 megapixels (at most 8192 pixels per side).")]
     Size,
+    /// An image already in the document, which was stored at 4 megapixels or less when placed.
+    #[error("This signature image is larger than 4 megapixels (or 4096 pixels per side), so it can't be previewed.")]
+    PlacedSize,
     #[error("Couldn't read the signature image: {0}")]
     Read(#[from] std::io::Error),
     #[error("Couldn't decode the signature image: {0}")]
@@ -129,18 +136,27 @@ impl SignatureImage {
         }
         let mut reader = ImageReader::with_format(Cursor::new(bytes), format);
         let mut limits = Limits::default();
-        limits.max_image_width = Some(4096);
-        limits.max_image_height = Some(4096);
-        limits.max_alloc = Some(32 << 20);
+        limits.max_image_width = Some(MAX_SOURCE_SIDE);
+        limits.max_image_height = Some(MAX_SOURCE_SIDE);
+        // 8-bit RGBA at the pixel cap; 16-bit sources that large hit this and report Size.
+        limits.max_alloc = Some(MAX_SOURCE_PIXELS * 4);
         reader.limits(limits);
-        let mut decoder = reader.into_decoder()?;
+        let too_big = |e: image::ImageError| if matches!(e, image::ImageError::Limits(_)) { SignatureImageError::Size } else { e.into() };
+        let mut decoder = reader.into_decoder().map_err(too_big)?;
         let (w, h) = decoder.dimensions();
-        if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_PIXELS {
+        if w == 0 || h == 0 || u64::from(w) * u64::from(h) > MAX_SOURCE_PIXELS {
             return Err(SignatureImageError::Size);
         }
         let orientation = decoder.orientation()?;
-        let mut image = DynamicImage::from_decoder(decoder)?;
+        let mut image = DynamicImage::from_decoder(decoder).map_err(too_big)?;
         image.apply_orientation(orientation);
+        let (w, h) = (f64::from(image.width()), f64::from(image.height()));
+        let scale = (f64::from(MAX_SIDE) / w.max(h)).min((MAX_PIXELS as f64 / (w * h)).sqrt());
+        if scale < 1.0 {
+            let (nw, nh) = (((w * scale) as u32).max(1), ((h * scale) as u32).max(1));
+            // `thumbnail` resamples in one integer pass, without the large float buffers `resize` keeps.
+            image = image.thumbnail(nw, nh);
+        }
         let rgba = image.into_rgba8();
         let size = [rgba.width() as usize, rgba.height() as usize];
         let mut png = Cursor::new(Vec::new());
@@ -164,6 +180,13 @@ impl SignatureImage {
         self.size
     }
 
+    /// This image as the graphic of a visible digital signature.
+    pub fn graphic(&self) -> pdfcraft_sign::Graphic {
+        // Sides are at most 4096 pixels; 0 would be refused by the signer, never drawn.
+        let side = |v: usize| u32::try_from(v).unwrap_or(0);
+        pdfcraft_sign::Graphic::Image { width: side(self.size[0]), height: side(self.size[1]), rgba: self.rgba.clone() }
+    }
+
     /// Make near-white paper transparent, keeping darker ink.
     pub fn remove_white_background(&self, cutoff: u8, feather: u8) -> Result<Self, SignatureImageError> {
         let [w, h] = self.size;
@@ -243,12 +266,23 @@ mod tests {
         assert!(SignatureImage::from_bytes(b"not an image").is_err());
         assert!(SignatureImage::from_bytes(b"\x89PNG\r\n\x1a\ntruncated").is_err());
         assert!(SignatureImage::from_bytes(&vec![0; MAX_SIGNATURE_IMAGE_BYTES + 1]).is_err());
-        assert!(SignatureImage::from_bytes(&png(4097, 1)).is_err());
-        assert!(SignatureImage::from_bytes(&png(4096, 1025)).is_err());
+        assert!(matches!(SignatureImage::from_bytes(&png(8193, 1)), Err(SignatureImageError::Size)));
+        assert!(matches!(SignatureImage::from_bytes(&png(8192, 4097)), Err(SignatureImageError::Size)));
         assert!(SignatureImage::read(std::io::repeat(0)).is_err());
         assert!(matches!(SignatureImage::from_bytes(b"GIF89a\x02\0\x02\0"), Err(SignatureImageError::Format)));
     }
 
+    /// #1075: a 6025 x 2506 scan is scaled down to fit 4096 per side and 4 megapixels.
+    #[test]
+    fn large_signature_images_are_scaled_down() {
+        let image = SignatureImage::from_bytes(&png(6025, 2506)).unwrap();
+        let [w, h] = image.size();
+        assert!(w <= 4096 && (w * h) as u64 <= MAX_PIXELS, "{w} x {h}");
+        assert!((w as f64 / h as f64 - 6025.0 / 2506.0).abs() < 0.01, "{w} x {h}");
+        assert_eq!(SignatureImage::from_bytes(&png(4096, 1)).unwrap().size(), [4096, 1]);
+        assert_eq!(SignatureImage::from_bytes(&png(8192, 1)).unwrap().size(), [4096, 1]);
+    }
+
     #[test]
     fn jpeg_signatures_are_normalized_to_png() {
         let mut jpeg = Cursor::new(Vec::new());
@@ -323,7 +357,7 @@ mod tests {
         stream.dict.set(b"Width".to_vec(), pdfcraft_cos::Object::Int(i64::MAX));
         cos.set(picture, pdfcraft_cos::Object::Stream(stream));
         let error = doc.image_signature_preview(0, 0).err().unwrap();
-        assert!(error.contains("4 megapixels"), "{error}");
+        assert_eq!(error, SignatureImageError::PlacedSize.to_string());
     }
 
     /// "Left edge at the point, centered vertically" is as displayed: on a turned page the box
diff --git a/crates/engine/src/tests.rs b/crates/engine/src/tests.rs
index eee3f7ca..68cdc0c8 100644
--- a/crates/engine/src/tests.rs
+++ b/crates/engine/src/tests.rs
@@ -218,12 +218,12 @@ fn undo_and_redo_restore_exact_states() {
     s.apply(id, Edit::MovePages { pages: vec![2], to: 0 }).unwrap();
     s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
     assert_eq!(s.get(id).unwrap().info.pages[0].rotation, 90);
-    assert_eq!(s.undo(id).unwrap(), "Rotate page");
+    assert_eq!(s.undo(id).unwrap().as_str(), "Rotate page");
     assert_eq!(s.get(id).unwrap().info.pages[0].rotation, 0);
-    assert_eq!(s.undo(id).unwrap(), "Move page");
+    assert_eq!(s.undo(id).unwrap().as_str(), "Move page");
     assert_eq!(s.get(id).unwrap().bytes, original, "undoing everything returns the original bytes");
     assert_eq!(s.undo(id), Err(EditError::NothingToUndo));
-    assert_eq!(s.redo(id).unwrap(), "Move page");
+    assert_eq!(s.redo(id).unwrap().as_str(), "Move page");
     assert_eq!(page_texts(&s, id), ["Page 3", "Page 1", "Page 2"]);
     // A new edit clears the redo stack.
     s.apply(id, Edit::InsertBlankPage { at: 0, width: 612.0, height: 792.0 }).unwrap();
@@ -396,7 +396,7 @@ fn batch_is_one_undo_step_and_all_or_nothing() {
     };
     s.apply(id, batch).unwrap();
     assert_eq!(s.get(id).unwrap().info_value("Author").as_deref(), Some("A"));
-    assert_eq!(s.undo(id).unwrap(), "Change properties");
+    assert_eq!(s.undo(id).unwrap().as_str(), "Change properties");
     assert_eq!(s.get(id).unwrap().info_value("Title"), None);
     assert_eq!(s.get(id).unwrap().can_undo(), None, "one step");
     // A failing member rolls back the whole batch.
@@ -432,7 +432,7 @@ fn combine_extract_split_and_insert_from_file() {
     // Insert pages from a file, undoably, into the open document.
     s.apply(id, Edit::InsertPagesFrom { name: "b.pdf".into(), bytes: other, pages: Some(vec![1]), at: 1 }).unwrap();
     assert_eq!(page_texts(&s, id), ["Page 1", "Page 2", "Page 2", "Page 3"]);
-    assert_eq!(s.undo(id).unwrap(), "Insert pages from b.pdf");
+    assert_eq!(s.undo(id).unwrap().as_str(), "Insert pages from b.pdf");
     assert_eq!(page_texts(&s, id).len(), 3);
     // Garbage sources fail cleanly.
     let bad = s.apply(id, Edit::InsertPagesFrom { name: "junk.pdf".into(), bytes: Arc::new(b"nope".to_vec()), pages: None, at: 0 });
@@ -504,6 +504,43 @@ fn a_file_split_around_another_combines_in_order_with_one_bookmark() {
     assert!(matches!(s.combine_grouped(&bad, &[1], &[]), Err(EditError::Print(e)) if e.starts_with("a:")));
 }
 
+#[test]
+fn create_multiple_reads_each_source_only_after_the_previous_one_is_released() {
+    let mut s = Session::new();
+    let mut earlier: Vec<std::sync::Weak<Vec<u8>>> = Vec::new();
+    let texts = ["Alpha", "Beta", "Gamma"];
+    let sources = texts.iter().map(|text| {
+        // The combine has finished with every earlier source, so their bytes are gone by now.
+        assert!(earlier.iter().all(|w| w.upgrade().is_none()), "a source is released before the next is read");
+        let (_, pdf) = s.convert_to_pdf(&format!("{text}.txt"), &Arc::new(text.as_bytes().to_vec())).unwrap();
+        earlier.push(Arc::downgrade(&pdf));
+        Ok::<CombineSource, EditError>((text.to_string(), pdf, None))
+    });
+    let combined = s.combine_each(sources).unwrap().unwrap();
+    assert!(earlier.iter().all(|w| w.upgrade().is_none()));
+    let id = s.open_new("Combined.pdf", combined).unwrap();
+    assert_eq!(page_texts(&s, id), ["Alpha", "Beta", "Gamma"]);
+    assert_eq!(outline_titles(&s.get(id).unwrap().info.outline), ["Alpha→1", "Beta→2", "Gamma→3"]);
+}
+
+#[test]
+fn create_multiple_gives_the_bytes_of_combine_ranges_and_refuses_a_bad_source() {
+    let s = Session::new();
+    let (a, b) = (Arc::new(fixture(3)), Arc::new(fixture(2)));
+    let sources: Vec<CombineSource> =
+        vec![("a".into(), a.clone(), Some("1-2".into())), ("b".into(), b, None), ("a".into(), a.clone(), Some("3".into()))];
+    let by_ranges = s.combine_ranges(&sources).unwrap();
+    let streamed = s.combine_each(sources.into_iter().map(Ok::<_, EditError>)).unwrap().unwrap();
+    assert_eq!(*streamed, *by_ranges);
+    // A bad range, or a file that isn't a PDF, stops the combine with an error naming that source.
+    let bad_range: Vec<Result<CombineSource, EditError>> = vec![Ok(("a".into(), a.clone(), None)), Ok(("c".into(), a.clone(), Some("9".into())))];
+    assert!(matches!(s.combine_each(bad_range), Err(EditError::Print(e)) if e.starts_with("c:")));
+    let junk: Vec<Result<CombineSource, EditError>> = vec![Ok(("junk".into(), Arc::new(b"not a pdf".to_vec()), None))];
+    assert!(matches!(s.combine_each(junk), Err(EditError::Source(m)) if m.starts_with("junk:")));
+    // Nothing to combine is `None`, not an empty document.
+    assert!(matches!(s.combine_each(Vec::<Result<CombineSource, EditError>>::new()), Ok(None)));
+}
+
 #[test]
 fn a_page_with_a_form_field_shown_twice_keeps_one_field() {
     // Regression (found by review): the repeated page copied the whole field again, so the
@@ -578,6 +615,21 @@ fn files_that_cannot_be_converted_are_refused_clearly() {
     assert_eq!(err, EditError::Source("locked.pdf: it is password-protected".into()));
 }
 
+/// Combine files (#569): images and text become PDFs; PDFs pass through unread, even protected
+/// ones (Combine asks for their password) and ones named .pdf without a header.
+#[test]
+fn files_for_combine_are_made_into_pdfs_and_pdfs_pass_through() {
+    let s = Session::new();
+    let locked = protected("pw", "o", -1);
+    assert!(Arc::ptr_eq(&s.as_pdf("locked.pdf", &locked).unwrap(), &locked));
+    let headless = Arc::new(b"1 0 obj << >> endobj".to_vec());
+    assert!(Arc::ptr_eq(&s.as_pdf("old.PDF", &headless).unwrap(), &headless));
+    assert!(s.as_pdf("scan.jpg", &Arc::new(jpeg_bytes())).unwrap().starts_with(b"%PDF-"));
+    assert!(s.as_pdf("notes.txt", &Arc::new(b"hello".to_vec())).unwrap().starts_with(b"%PDF-"));
+    let err = s.as_pdf("report.docx", &Arc::new(b"PK\x03\x04".to_vec())).unwrap_err();
+    assert!(matches!(err, EditError::Source(m) if m.starts_with("report.docx: this file type can't be converted")));
+}
+
 fn protected(user: &str, owner: &str, permissions: i32) -> Arc<Vec<u8>> {
     let mut doc = pdfcraft_cos::Document::open(Arc::new(fixture(2))).unwrap();
     doc.set_encryption(&pdfcraft_cos::NewEncryption {
@@ -629,6 +681,78 @@ fn restricted_documents_refuse_changes_unless_opened_by_the_owner() {
     s.apply(oid, Edit::DeletePages { pages: vec![0] }).unwrap();
 }
 
+/// Table 22, bit 5: "Copy or otherwise extract text and graphics" (#568). Snapshots, exports and
+/// Save Image As are refused, other permissions are untouched, and the owner password lifts it.
+#[test]
+fn copy_restricted_documents_refuse_extraction_unless_opened_by_the_owner() {
+    let bytes = protected("", "owner", -1 ^ 0b1_0000); // everything but copying, no password to open
+    let mut s = Session::new();
+    let id = s.open("r.pdf", None, bytes.clone(), None).unwrap();
+    let d = s.get(id).unwrap();
+    assert!(!d.allows_copying());
+    assert!(d.allows_printing() && d.allows_modification() && d.allows_assembly(), "only copying is withheld");
+    assert_eq!(d.check_copying(), Err(EditError::NotPermitted("copying text and images")));
+    assert!(d.page_image_file(0, 0).unwrap_err().contains("don't allow copying"));
+    let extracting = ["edit.snapshot", "export.image", "export.text", "export.docx", "export.html", "export.rtf", "export.all_images"];
+    let enabled = |s: &Session, id, c| commands::is_enabled(commands::command(c).unwrap(), s, Some(id));
+    for c in extracting {
+        assert!(!enabled(&s, id, c), "{c} is disabled");
+    }
+    assert!(enabled(&s, id, "edit.find") && enabled(&s, id, "a11y.check"), "searching and accessibility don't copy");
+    let oid = s.open("r.pdf", None, bytes, Some("owner")).unwrap();
+    assert!(s.get(oid).unwrap().allows_copying());
+    assert!(extracting.iter().all(|c| enabled(&s, oid, c)));
+    // Unencrypted documents allow everything.
+    let (s, plain) = session_with(1);
+    assert!(s.get(plain).unwrap().check_copying().is_ok() && extracting.iter().all(|c| enabled(&s, plain, c)));
+}
+
+#[test]
+fn the_permissions_password_unlocks_an_open_document() {
+    // Only a permissions password (#995, #1077): opens without asking. Changes are allowed,
+    // security changes aren't.
+    let bytes = protected("", "owner", 0b1100);
+    let mut s = Session::new();
+    let id = s.open("r.pdf", None, bytes, None).unwrap();
+    s.apply(id, Edit::SetInfo { key: "Title".into(), value: "Before".into() }).unwrap();
+    assert!(!s.get(id).unwrap().allows_security_change());
+    assert!(matches!(s.apply(id, Edit::RemoveProtection), Err(EditError::NotPermitted(_))));
+    for wrong in ["", "nope"] {
+        assert_eq!(s.unlock(id, wrong), Err(EditError::WrongPassword), "{wrong:?}");
+    }
+    assert!(!s.get(id).unwrap().allows_security_change());
+    s.unlock(id, "owner").unwrap();
+    let d = s.get(id).unwrap();
+    assert!(d.allows_security_change() && d.security_summary().unwrap().owner);
+    assert!(d.dirty, "unlocking leaves the unsaved edit alone");
+    assert_eq!(d.can_undo(), Some("Change Title"), "and adds no undo step");
+    // Undo and redo don't bring the restrictions back.
+    s.undo(id).unwrap();
+    assert!(s.get(id).unwrap().allows_security_change(), "after undo");
+    s.redo(id).unwrap();
+    assert!(s.get(id).unwrap().allows_security_change(), "after redo");
+    // Neither does saving.
+    let saved = s.save_bytes(id).unwrap();
+    s.mark_saved(id, saved, None).unwrap();
+    assert!(s.get(id).unwrap().allows_security_change(), "after saving");
+    s.apply(id, Edit::RemoveProtection).unwrap();
+    let plain = s.save_bytes(id).unwrap();
+    assert!(pdfcraft_cos::Document::open(plain).unwrap().security().is_none(), "security removed");
+}
+
+#[test]
+fn unlocking_needs_the_permissions_password_not_the_open_password() {
+    let mut s = Session::new();
+    let id = s.open("r.pdf", None, protected("open", "perms", 0b0100), Some("open")).unwrap();
+    assert_eq!(s.unlock(id, "open"), Err(EditError::WrongPassword));
+    s.unlock(id, "perms").unwrap();
+    assert!(s.get(id).unwrap().allows_security_change());
+    // Nothing to unlock: opened by the owner already, or not encrypted.
+    s.unlock(id, "anything").unwrap();
+    let plain = s.open("p.pdf", None, Arc::new(fixture(1)), None).unwrap();
+    s.unlock(plain, "anything").unwrap();
+}
+
 #[test]
 fn combining_protected_files_is_refused_clearly() {
     let s = Session::new();
@@ -1115,6 +1239,37 @@ fn form_edits_refresh_field_values_without_a_full_inspection() {
     assert_eq!(values(&d.info.fields), [("name".to_string(), Some("Ada".to_string())), ("ok".to_string(), Some("Yes".to_string()))]);
 }
 
+#[test]
+fn form_refresh_keeps_first_value_when_field_names_repeat() {
+    // Two widgets share one name; the refresh reads the first.
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R 5 0 R 6 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 7 0 R >> >> >> >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>",
+        "<< /Type /Page /Parent 2 0 R /Annots [4 0 R 5 0 R 6 0 R] >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (dup) /V (first) /Rect [20 250 180 270] /P 3 0 R >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (dup) /V (second) /Rect [20 220 180 240] /P 3 0 R >>",
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (other) /Rect [20 190 180 210] /P 3 0 R >>",
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>",
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        bytes.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    let mut s = Session::new();
+    let id = s.open("dup.pdf", None, Arc::new(bytes), None).unwrap();
+    s.apply(id, Edit::SetFieldValue { name: "other".into(), value: FieldValue::Text("x".into()) }).unwrap();
+    let dup = s.get(id).unwrap().info.fields.iter().find(|f| f.name == "dup").unwrap().value.clone();
+    assert_eq!(dup.as_deref(), Some("first"));
+}
+
 #[test]
 fn preparing_a_form_adds_renames_and_deletes_fields() {
     let (mut s, id) = session_with(1);
@@ -1249,6 +1404,56 @@ fn headers_footers_watermarks_and_backgrounds_show_update_and_remove() {
     assert_eq!(s.get(id).unwrap().can_undo(), Some("Remove background"));
 }
 
+#[test]
+fn open_populates_marks_and_added_from_the_combined_marker_scan() {
+    let (mut source, source_id) = session_with(1);
+    let mut header = HeaderFooter::default();
+    header.text[0] = "Header".into();
+    source.apply(source_id, Edit::AddHeaderFooter { pages: vec![0], settings: header, replace: false }).unwrap();
+    source
+        .apply(
+            source_id,
+            Edit::AddWatermark { pages: vec![0], settings: Watermark { text: "Draft".into(), ..Watermark::default() }, file: None, replace: false },
+        )
+        .unwrap();
+    source
+        .apply(
+            source_id,
+            Edit::AddBackground {
+                pages: vec![0],
+                settings: Background { color: [0.9, 0.9, 1.0], opacity: 1.0, ..Background::default() },
+                replace: false,
+                file: None,
+            },
+        )
+        .unwrap();
+    source
+        .apply(
+            source_id,
+            Edit::AddText { page: 0, text: AddedText { rect: [20.0, 250.0, 180.0, 280.0], text: "Added note".into(), ..Default::default() } },
+        )
+        .unwrap();
+
+    let bytes = source.save_bytes(source_id).unwrap();
+    let reference = pdfcraft_cos::Document::open(bytes.clone()).unwrap();
+    let expected_marks = pdfcraft_edit::marks_present(&reference);
+    let expected_added = pdfcraft_edit::list_added(&reference);
+    source.mark_saved(source_id, bytes.clone(), None).unwrap();
+    let refreshed = source.get(source_id).unwrap();
+    assert_eq!(refreshed.marks, expected_marks);
+    assert_eq!(refreshed.added, expected_added);
+    let mut reopened = Session::new();
+    let reopened_id = reopened.open("marked.pdf", None, bytes, None).unwrap();
+    let opened = reopened.get(reopened_id).unwrap();
+    assert_eq!(opened.marks, expected_marks);
+    assert_eq!(opened.added, expected_added);
+    assert_eq!(opened.marks.len(), 3);
+    assert!(opened.marks.contains(&MarkKind::HeaderFooter));
+    assert!(opened.marks.contains(&MarkKind::Watermark));
+    assert!(opened.marks.contains(&MarkKind::Background));
+    assert_eq!(opened.added.len(), 1);
+}
+
 #[test]
 fn export_images_and_text_follow_the_working_file() {
     let (mut s, id) = session_with(2);
@@ -1534,6 +1739,25 @@ fn added_images_rotate_flip_and_crop_as_drawn() {
     assert!(red(colour_at(&s, 130, 150)), "the right half cropped away: red fills the box");
 }
 
+#[test]
+fn reload_reads_the_new_file_into_the_same_document() {
+    let (mut s, id) = session_with(2);
+    let other = s.open("other.pdf", None, Arc::new(fixture(1)), None).unwrap();
+    s.apply(id, Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    let before = s.get(id).unwrap().edit_generation();
+    s.reload(id, Arc::new(fixture(3))).unwrap();
+    let d = s.get(id).unwrap();
+    assert_eq!((d.id, d.name.as_str()), (id, "fixture.pdf"), "same document, same name");
+    assert_eq!(page_texts(&s, id), ["Page 1", "Page 2", "Page 3"], "the new version");
+    assert!(!d.dirty && d.can_undo().is_none(), "nothing unsaved, nothing to undo");
+    assert!(d.edit_generation() > before, "caches keyed by the generation see a change");
+    assert_eq!(s.docs().iter().map(|d| d.id).collect::<Vec<_>>(), [id, other], "no new tab, same order");
+    // A file that isn't a PDF (yet) leaves the document as it was.
+    assert!(s.reload(id, Arc::new(b"%PDF-1.7 half written".to_vec())).is_err());
+    assert_eq!(page_texts(&s, id).len(), 3);
+    assert_eq!(s.docs().len(), 2);
+}
+
 #[test]
 fn revert_goes_back_to_the_saved_version() {
     let (mut s, id) = session_with(2);
@@ -1687,7 +1911,8 @@ fn signing_saving_trusting_and_commenting_afterwards() {
     assert_eq!(s.get(id).unwrap().signatures[0].status, SignatureStatus::Valid);
     s.apply(id, rect_comment(0, [80.0, 80.0, 120.0, 120.0])).unwrap();
     let sig = &s.get(id).unwrap().signatures[0];
-    assert_eq!((sig.status, sig.modification.clone()), (SignatureStatus::Valid, sign::Modification::Allowed(vec!["comments".into()])));
+    let comments = sign::Modification::Allowed(vec![sign::kind::COMMENTS]);
+    assert_eq!((sig.status, sig.modification.clone()), (SignatureStatus::Valid, comments));
     // Saving keeps the signature (incremental).
     let saved = s.save_bytes(id).unwrap();
     s.mark_saved(id, saved, None).unwrap();
@@ -2211,6 +2436,25 @@ fn dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally() {
     assert_eq!(d2.form.iter().find(|f| f.name == "answer").unwrap().value, vec!["N".to_string()]);
 }
 
+#[test]
+fn a_signed_xfa_signature_box_shows_the_picture_the_file_holds() {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("signed.pdf", None, Arc::new(pdfcraft_xfa::fixtures::signed_shell()), None).expect("opens");
+    let doc = s.get(id).unwrap();
+    assert_eq!(doc.xfa.as_ref().map(|x| (x.pages, x.fields)), Some((1, 2)));
+    let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), doc.config.clone());
+    let out = r.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    assert!(out.error.is_none(), "{:?}", out.error);
+    let at = |x: u32, y: u32| -> [u8; 4] {
+        let i = ((y * out.width + x) * 4) as usize;
+        out.rgba[i..i + 4].try_into().unwrap()
+    };
+    // The signed box (3in by 1in from half an inch in) is filled with the signature's blue
+    // picture; the unsigned one below it is not.
+    assert_eq!(at(36 + 108, 36 + 36), [0, 0, 255, 255]);
+    assert_ne!(at(36 + 108, 36 + 72 + 36), [0, 0, 255, 255]);
+}
+
 #[test]
 fn an_xfa_form_without_a_template_opens_with_its_placeholder_and_a_warning() {
     let bytes = Arc::new(pdfcraft_xfa::fixtures::shell("<xdp:xdp xmlns:xdp=\"http://ns.adobe.com/xdp/\"></xdp:xdp>"));
@@ -2366,6 +2610,8 @@ fn xfa_scripts_initialize_calculate_validate_toggle_and_add_rows() {
     let bytes = Arc::new(pdfcraft_xfa::fixtures::shell(&pdfcraft_xfa::fixtures::scripted_template()));
     let mut s = Session::new().with_clock(|| 1_700_000_000);
     let id = s.open("scripted.pdf", None, bytes, None).expect("opens");
+    let add_row = s.get(id).unwrap().form.iter().find(|f| f.name == "addRow").expect("the XFA button is in the form snapshot");
+    assert!(matches!(add_row.button.as_ref(), Some(pdfcraft_forms::af::ButtonAction::Script(_))));
     let value = |s: &Session, n: &str| {
         s.get(id).unwrap().form.iter().find(|f| f.name == n).map(|f| f.value.clone()).unwrap_or_else(|| panic!("no field {n}"))
     };
@@ -2794,7 +3040,7 @@ fn adopting_page_only_fields_is_noted_as_a_repair() {
     let doc = s.get(id).unwrap();
     let names: Vec<&str> = doc.form.iter().map(|f| f.name.as_str()).collect();
     assert_eq!(names, ["alpha", "beta"]);
-    assert!(doc.repair_log().iter().any(|l| l.contains("2 fields") && l.contains("page annotations")), "{:?}", doc.repair_log());
+    assert_eq!(doc.repair_log(), vec!["the form's /Fields list omits 2 fields; they were read from the page annotations".to_string()]);
 }
 
 /// A page too large for the renderer at the asked resolution exports at the most it allows (and
@@ -2849,7 +3095,7 @@ fn mixed_object_moves_are_one_undo_step_and_survive_save_reopen() {
     let mut again = Session::new();
     let other = again.open("moved.pdf", None, moved.clone(), None).unwrap();
     assert_eq!(again.get(other).unwrap().editable_objects(0).unwrap(), after);
-    assert_eq!(s.undo(id).unwrap(), "Move objects");
+    assert_eq!(s.undo(id).unwrap().as_str(), "Move objects");
     assert_eq!(s.get(id).unwrap().editable_objects(0).unwrap(), before);
     assert_eq!(s.get(id).unwrap().can_undo(), Some("Add image"), "one undo restores all three objects");
     s.redo(id).unwrap();
@@ -2990,3 +3236,128 @@ fn recovered_user_passwords_reach_the_renderer_byte_for_byte() {
     assert_eq!(crate::renderer_password(&[0x9A, b'l', 0x9A, b'k', 0xA0]), "ılık€");
     assert_eq!(crate::renderer_password(&[0xC7, b'o', b'k']), "Çok");
 }
+
+/// A synthetic phone photo, 400 × 300 px: a white sheet, tilted, on a grey table, with a black
+/// mark in the sheet's top-left corner. Returns the PNG and the sheet's corners in pixels.
+fn camera_photo() -> (Vec<u8>, [[f64; 2]; 4]) {
+    let sheet = [[60.0, 40.0], [330.0, 20.0], [350.0, 270.0], [40.0, 250.0]];
+    let inside = |x: f64, y: f64| {
+        (0..4).all(|i| {
+            let (a, b) = (sheet[i], sheet[(i + 1) % 4]);
+            (b[0] - a[0]) * (y - a[1]) - (b[1] - a[1]) * (x - a[0]) >= 0.0
+        })
+    };
+    let img = image::RgbImage::from_fn(400, 300, |x, y| {
+        let (fx, fy) = (x as f64 + 0.5, y as f64 + 0.5);
+        if (75.0..95.0).contains(&fx) && (55.0..75.0).contains(&fy) {
+            image::Rgb([0, 0, 0])
+        } else if inside(fx, fy) {
+            image::Rgb([255, 255, 255])
+        } else {
+            image::Rgb([110, 110, 110])
+        }
+    });
+    let mut png = Vec::new();
+    img.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    (png, sheet)
+}
+
+#[test]
+fn enhance_camera_page_straightens_the_sheet() {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let (png, sheet) = camera_photo();
+    // 72 dpi: one point per pixel, so the page is 400 × 300 pt and y flips to user space.
+    let bytes = s.create_from_images_with_resolution(&[("photo.png".into(), png)], ImageResolution::Dpi(72.0)).unwrap();
+    let id = s.open("photo.pdf", None, bytes, None).unwrap();
+    let corners = sheet.map(|[x, y]| [x, 300.0 - y]);
+    // Corners in any order.
+    s.enhance_camera_page(id, 0, [corners[2], corners[0], corners[3], corners[1]]).unwrap();
+
+    let doc = s.get(id).unwrap();
+    assert_eq!(doc.info.pages.len(), 1);
+    assert_eq!(doc.can_undo(), Some("Enhance camera image"));
+    // The longer of each pair of opposite sides: 310 × 250 pt at the photo's own resolution.
+    let p = &doc.info.pages[0];
+    assert!((p.width - 310.0).abs() <= 1.0 && (p.height - 250.0).abs() <= 1.0, "{} × {}", p.width, p.height);
+
+    let mut r = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), doc.config.clone());
+    let shot = r.render(pdfcraft_render::RenderRequest { page: 0, scale: 1.0, ..Default::default() });
+    assert!(shot.error.is_none(), "{:?}", shot.error);
+    let at = |x: u32, y: u32| {
+        let i = ((y * shot.width + x) * 4) as usize;
+        shot.rgba[i..i + 3].to_vec()
+    };
+    // No table left in the corners: the sheet fills the page, and its mark is top left.
+    for (x, y) in [(4, 4), (shot.width - 5, 4), (shot.width - 5, shot.height - 5), (4, shot.height - 5), (shot.width / 2, shot.height / 2)] {
+        assert!(at(x, y).iter().all(|&v| v > 235), "({x}, {y}) = {:?}", at(x, y));
+    }
+    assert!(at(30, 30).iter().all(|&v| v < 40), "the mark: {:?}", at(30, 30));
+
+    s.undo(id).unwrap();
+    let p = &s.get(id).unwrap().info.pages[0];
+    assert_eq!((p.width, p.height), (400.0, 300.0));
+}
+
+#[test]
+fn detect_camera_corners_finds_the_sheet_in_user_space() {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let (png, sheet) = camera_photo();
+    let bytes = s.create_from_images_with_resolution(&[("photo.png".into(), png)], ImageResolution::Dpi(72.0)).unwrap();
+    let id = s.open("photo.pdf", None, bytes, None).unwrap();
+    let found = s.detect_camera_corners(id, 0).expect("the sheet's edges");
+    // One point per pixel, y flipped: the sheet's corners in reading order.
+    for (f, p) in found.iter().zip(sheet.iter()) {
+        let want = [p[0], 300.0 - p[1]];
+        assert!((f[0] - want[0]).hypot(f[1] - want[1]) < 4.0, "{found:?} vs {sheet:?}");
+    }
+    // A page with no photo on it: nothing to find.
+    let id = s.open("doc.pdf", None, Arc::new(fixture(1)), None).unwrap();
+    assert_eq!(s.detect_camera_corners(id, 0), None);
+    assert_eq!(s.detect_camera_corners(id, 7), None);
+}
+
+#[test]
+fn enhance_camera_page_at_a_level_whitens_a_shadowed_sheet() {
+    // A sheet lit unevenly: full light at the left, a third of it at the right.
+    let img = image::RgbImage::from_fn(400, 300, |x, y| {
+        let light = 1.0 - 0.66 * x as f32 / 400.0;
+        let ink = if (y / 10) % 3 == 1 && (40..360).contains(&x) { 0.12 } else { 0.96 };
+        let v = (ink * light * 255.0) as u8;
+        image::Rgb([v, v, (v as f32 * 0.85) as u8])
+    });
+    let mut png = Vec::new();
+    img.write_to(&mut std::io::Cursor::new(&mut png), image::ImageFormat::Png).unwrap();
+    let whole = [[0.0, 0.0], [400.0, 0.0], [400.0, 300.0], [0.0, 300.0]];
+    let paper_at_right = |level: u8| {
+        let mut s = Session::new().with_clock(|| 1_700_000_000);
+        let bytes = s.create_from_images_with_resolution(&[("photo.png".into(), png.clone())], ImageResolution::Dpi(72.0)).unwrap();
+        let id = s.open("photo.pdf", None, bytes, None).unwrap();
+        s.enhance_camera_page_at(id, 0, whole, camera_clean::Look::Colour, level).unwrap();
+        assert_eq!(s.get(id).unwrap().can_undo(), Some("Enhance camera image"), "one step at level {level}");
+        let doc = s.get(id).unwrap();
+        let shot = pdfcraft_render::PageRenderer::new(doc.bytes.clone(), doc.config.clone()).render(pdfcraft_render::RenderRequest {
+            page: 0,
+            scale: 1.0,
+            ..Default::default()
+        });
+        // A paper pixel near the right edge, between text rows.
+        let i = ((5 * shot.width + shot.width - 12) * 4) as usize;
+        shot.rgba[i..i + 3].to_vec()
+    };
+    let (before, after) = (paper_at_right(0), paper_at_right(80));
+    assert!(before.iter().all(|&v| v < 140), "the shadow: {before:?}");
+    assert!(after.iter().all(|&v| v > 235), "white paper: {after:?}");
+}
+
+#[test]
+fn enhance_camera_page_refuses_bad_corners_and_pages() {
+    let mut s = Session::new().with_clock(|| 1_700_000_000);
+    let id = s.open("doc.pdf", None, Arc::new(fixture(1)), None).unwrap();
+    let line = [[0.0, 0.0], [50.0, 50.0], [100.0, 100.0], [150.0, 150.0]];
+    let e = s.enhance_camera_page(id, 0, line).unwrap_err().to_string();
+    assert!(e.contains("corners"), "{e}");
+    let ok = [[0.0, 0.0], [200.0, 0.0], [200.0, 300.0], [0.0, 300.0]];
+    assert!(s.enhance_camera_page(id, 5, ok).unwrap_err().to_string().contains("no page 6"));
+    assert!(matches!(s.enhance_camera_page(DocId(999), 0, ok), Err(EditError::NoDocument)));
+    assert_eq!(s.get(id).unwrap().can_undo(), None, "nothing changed");
+}
diff --git a/crates/engine/src/xfa.rs b/crates/engine/src/xfa.rs
index 029fcb70..b0f4c0b3 100644
--- a/crates/engine/src/xfa.rs
+++ b/crates/engine/src/xfa.rs
@@ -452,9 +452,7 @@ impl<'a, 'b> Runner<'a, 'b> {
         self.flush()?;
         let report = pdfcraft_xfa::rerender(self.doc, self.tpl).map_err(|e| e.to_string())?;
         self.console(report.warnings);
-        for f in pdfcraft_forms::fields(self.doc) {
-            pdfcraft_forms::redraw_field(self.doc, &f.name).map_err(|e| format!("{}: {e}", f.name))?;
-        }
+        crate::xfa_redraw(self.doc)?;
         self.by_som = None;
         self.fields = None;
         self.cached = None;
diff --git a/crates/fonts/src/lib.rs b/crates/fonts/src/lib.rs
index ee94566d..75ebe6d3 100644
--- a/crates/fonts/src/lib.rs
+++ b/crates/fonts/src/lib.rs
@@ -15,7 +15,7 @@ pub use craft::{
     CRAFT_FONTS, CraftFont, SHIPPORI_MINCHO, document_arabic_font, document_japanese_font, document_japanese_font_for_style,
     document_japanese_fonts_for_style, ui_arabic_fonts, ui_chinese_fonts, ui_cjk_fonts, ui_japanese_fonts, ui_telugu_fonts,
 };
-pub use script::{GlyphError, GlyphOutline, MAX_SIGNATURE_CHARS, ScriptOutline, japanese_glyph, japanese_glyph_from, script_outline};
+pub use script::{GlyphError, GlyphOutline, INTER_REGULAR, MAX_SIGNATURE_CHARS, ScriptOutline, japanese_glyph, japanese_glyph_from, script_outline};
 
 /// Approximate advance of `s` in Helvetica (or Arial) at `size` points.
 pub fn helvetica_width(s: &str, size: f64) -> f64 {
diff --git a/crates/fonts/src/script.rs b/crates/fonts/src/script.rs
index 04695ebe..5fee1009 100644
--- a/crates/fonts/src/script.rs
+++ b/crates/fonts/src/script.rs
@@ -6,6 +6,13 @@ use skrifa::{FontRef, GlyphId, MetadataProvider};
 
 static FONT: &[u8] = include_bytes!("../../../assets/fonts/DancingScript.ttf");
 
+/// Inter Regular, the interface font. Typed signatures fall back to it, slanted, for characters
+/// the script font lacks (Dancing Script is Latin and Vietnamese only: no Cyrillic or Greek).
+pub static INTER_REGULAR: &[u8] = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
+
+/// Forward slant of fallback glyphs in a typed signature (about 12°), so they lean like the script.
+const FALLBACK_SLANT: f64 = 0.21;
+
 /// Bound signature work while allowing long personal names.
 pub const MAX_SIGNATURE_CHARS: usize = 256;
 
@@ -51,6 +58,8 @@ struct Flatten {
     contours: Vec<Vec<[f64; 2]>>,
     cur: Vec<[f64; 2]>,
     scale: f64,
+    /// Horizontal shear applied to every point (x += slant × y), for slanted fallback glyphs.
+    slant: f64,
     dx: f64,
     points: usize,
     too_complex: bool,
@@ -59,11 +68,12 @@ struct Flatten {
 
 impl Flatten {
     fn new(scale: f64) -> Self {
-        Self { contours: Vec::new(), cur: Vec::new(), scale, dx: 0.0, points: 0, too_complex: false, max_points: 4096 }
+        Self { contours: Vec::new(), cur: Vec::new(), scale, slant: 0.0, dx: 0.0, points: 0, too_complex: false, max_points: 4096 }
     }
 
     fn pt(&self, x: f32, y: f32) -> [f64; 2] {
-        [self.dx + x as f64 * self.scale, y as f64 * self.scale]
+        let (x, y) = (x as f64 * self.scale, y as f64 * self.scale);
+        [self.dx + x + self.slant * y, y]
     }
 
     fn last(&self) -> [f64; 2] {
@@ -178,8 +188,9 @@ pub(crate) fn bounded_outline(font: &FontRef, gid: GlyphId, width: f64) -> Resul
     Ok(GlyphOutline { contours: pen.contours, width, bbox })
 }
 
-/// The outlines of `text` in the script font (characters it lacks are skipped).
-/// Over-limit input returns an empty outline instead of a silently truncated signature.
+/// The outlines of `text` in the script font. Characters it lacks (Cyrillic, Greek, …) are drawn
+/// from Inter, slanted and scaled to the script's capital height; characters neither font has are
+/// skipped. Over-limit input returns an empty outline instead of a silently truncated signature.
 pub fn script_outline(text: &str) -> ScriptOutline {
     if text.chars().take(MAX_SIGNATURE_CHARS + 1).count() > MAX_SIGNATURE_CHARS {
         return ScriptOutline::default();
@@ -191,17 +202,39 @@ pub fn script_outline(text: &str) -> ScriptOutline {
     let charmap = font.charmap();
     let glyphs = font.outline_glyphs();
     let advances = font.glyph_metrics(Size::unscaled(), loc);
+    // The fallback face, scaled so its capitals are as tall as the script's.
+    let fallback = FontRef::new(INTER_REGULAR).ok().map(|f| {
+        let m = f.metrics(Size::unscaled(), loc);
+        let em = 1.0 / m.units_per_em.max(1) as f64;
+        let ratio = match (metrics.cap_height, m.cap_height) {
+            (Some(ours), Some(theirs)) if ours > 0.0 && theirs > 0.0 => (ours as f64 * scale) / (theirs as f64 * em),
+            _ => 1.0,
+        };
+        let ratio = if ratio.is_finite() { ratio.clamp(0.5, 2.0) } else { 1.0 };
+        (f.charmap(), f.outline_glyphs(), f.glyph_metrics(Size::unscaled(), loc), em * ratio)
+    });
     let mut pen = Flatten::new(scale);
     // The 4096-point budget is for one untrusted document glyph (japanese_glyph), not a
     // whole signature in our bundled font. Keep a separate bounded budget for the line.
     pen.max_points = 262_144;
     for ch in text.chars() {
-        let Some(gid) = charmap.map(ch) else { continue };
-        if let Some(g) = glyphs.get(gid) {
-            let _ = g.draw(DrawSettings::unhinted(Size::unscaled(), loc), &mut pen);
-            pen.close();
+        if let Some(gid) = charmap.map(ch) {
+            (pen.scale, pen.slant) = (scale, 0.0);
+            if let Some(g) = glyphs.get(gid) {
+                let _ = g.draw(DrawSettings::unhinted(Size::unscaled(), loc), &mut pen);
+                pen.close();
+            }
+            pen.dx += advances.advance_width(gid).unwrap_or(0.0) as f64 * scale;
+        } else if let Some((map, outlines, adv, em)) = &fallback
+            && let Some(gid) = map.map(ch)
+        {
+            (pen.scale, pen.slant) = (*em, FALLBACK_SLANT);
+            if let Some(g) = outlines.get(gid) {
+                let _ = g.draw(DrawSettings::unhinted(Size::unscaled(), loc), &mut pen);
+                pen.close();
+            }
+            pen.dx += adv.advance_width(gid).unwrap_or(0.0) as f64 * em;
         }
-        pen.dx += advances.advance_width(gid).unwrap_or(0.0) as f64 * scale;
     }
     pen.close();
     if pen.too_complex {
@@ -224,6 +257,30 @@ mod tests {
         assert!(super::script_outline(&"W".repeat(super::MAX_SIGNATURE_CHARS + 1)).contours.is_empty());
     }
 
+    /// Issue #846: Cyrillic (and Greek) names come out of the fallback face instead of vanishing.
+    #[test]
+    fn cyrillic_and_greek_names_are_drawn_from_the_fallback_face() {
+        for name in ["Саша Дермановић", "Љубица Ђорђевић", "Ђурђа Џаковић", "Νίκος"] {
+            let o = super::script_outline(name);
+            let letters = name.chars().filter(|c| !c.is_whitespace()).count();
+            assert!(o.contours.len() >= letters, "{name}: {} contours for {letters} letters", o.contours.len());
+            for ch in name.chars().filter(|c| !c.is_whitespace()) {
+                let one = super::script_outline(&ch.to_string());
+                assert!(!one.contours.is_empty() && one.width > 0.0, "{name}: {ch} has no outline");
+            }
+            let [_, bottom, right, top] = o.bounds();
+            assert!(right <= o.width + 0.5 && top <= o.ascent + 0.2 && bottom >= o.descent - 0.2, "{name}: {:?}", o.bounds());
+        }
+        // Capitals from the fallback are about as tall as the script's.
+        let cap = |c: &str| super::script_outline(c).contours.iter().flatten().map(|p| p[1]).fold(0.0, f64::max);
+        let (latin, cyrillic) = (cap("H"), cap("Н"));
+        assert!((cyrillic / latin - 1.0).abs() < 0.2, "Н {cyrillic} vs H {latin}");
+        // Mixed names keep every letter, in order: the Cyrillic follows the Latin.
+        let mixed = super::script_outline("Ana Ана");
+        let latin_only = super::script_outline("Ana ");
+        assert!(mixed.width > latin_only.width + 0.5, "{} vs {}", mixed.width, latin_only.width);
+    }
+
     #[test]
     fn a_name_becomes_outlines() {
         let o = super::script_outline("Ada L.");
diff --git a/crates/forms/README.md b/crates/forms/README.md
index fa475fa7..9af549ad 100644
--- a/crates/forms/README.md
+++ b/crates/forms/README.md
@@ -7,6 +7,9 @@ Interactive forms (AcroForm, ISO 32000-2 §12.7). Layer L3; depends on `pdfcraft
 
 ```rust
 let all: Vec<Field> = fields(&doc);                         // terminal fields with widgets, options, flags, /DA
+let snapshot = fields_with_adopted(&doc);                     // fields and page-only adoption count in one pass
+let all = snapshot.items;
+let adopted = snapshot.adopted_page_fields;
 set_value(&mut doc, "name", &FieldValue::Text("Ada".into()))?;
 set_value(&mut doc, "agree", &FieldValue::Check(true))?;
 set_value(&mut doc, "size", &FieldValue::Radio(Some("L".into())))?;
diff --git a/crates/forms/src/appearance.rs b/crates/forms/src/appearance.rs
index ea88f675..8478cc26 100644
--- a/crates/forms/src/appearance.rs
+++ b/crates/forms/src/appearance.rs
@@ -5,17 +5,19 @@
 //! marked-content block as viewers expect. Supported: single-line, multiline (wrapped), comb,
 //! password, quadding, auto font size (`0 Tf`), combo boxes and list boxes (selection shown).
 //!
-//! The `/DA` font is used when the form's `/DR` defines it as a simple font (text encoded in
-//! WinAnsi) or as a composite font with a predefined Unicode CMap such as `UniJIS-UTF16-H`, as
-//! Japanese forms use (text encoded in that CMap). Otherwise (other composite fonts, missing
-//! resources) Helvetica is used, so text is always visible. Widths use the approximate metrics
-//! of `pdfcraft-fonts` (Helvetica, or one em per full-width character in composite fonts).
+//! The `/DA` font is used when the form's `/DR` defines it as a simple font that can encode the
+//! displayed text (using its own encoding and Differences), or as a composite font with a
+//! predefined Unicode CMap such as `UniJIS-UTF16-H`, as Japanese forms use. Otherwise (unsupported
+//! characters, other composite fonts, missing resources) Helvetica is used. Widths use the
+//! approximate metrics of `pdfcraft-fonts` (Helvetica, or one em per full-width character in
+//! composite fonts).
 //!
 //! `/MK /R` (0, 90, 180, 270, counterclockwise) lays the content out in the upright box and sets
 //! the appearance `/Matrix` so that box lands on the widget rectangle. Any other value is 0, and
 //! rotation 0 leaves `/Matrix` off.
 
 use pdfcraft_cos::{Dict, Document, Object, Stream};
+use pdfcraft_fonts::pdf::Metrics;
 use pdfcraft_fonts::{UnicodeCMap, cjk_width, helvetica_width, literal, win_ansi, wrap_with};
 
 use crate::{Field, FieldKind, Widget, acroform, flags};
@@ -111,24 +113,35 @@ pub fn parse_da(da: &str) -> Da {
 }
 
 /// How a field font's text is encoded and measured.
-#[derive(Clone, Copy, Debug, PartialEq)]
+#[derive(Clone, Debug, PartialEq)]
 enum FontText {
     WinAnsi,
+    /// A reused simple font's encoding, including indirect dictionaries and Differences.
+    Simple(Box<Metrics>),
     /// A composite font with a predefined Unicode CMap.
     Unicode(UnicodeCMap),
 }
 
 impl FontText {
-    fn encode(self, s: &str) -> Vec<u8> {
+    fn encode(&self, s: &str) -> Vec<u8> {
         match self {
             Self::WinAnsi => win_ansi(s),
+            // Selection checks every displayed string first; wrapping only removes line breaks.
+            Self::Simple(metrics) => metrics.encode(&s.replace('\t', " ")).unwrap_or_default(),
             Self::Unicode(cmap) => cmap.encode(s),
         }
     }
 
-    fn width(self, s: &str, size: f64) -> f64 {
+    fn can_encode(&self, s: &str) -> bool {
         match self {
-            Self::WinAnsi => helvetica_width(s, size),
+            Self::Simple(metrics) => metrics.encode(&s.replace('\t', " ")).is_some(),
+            _ => true,
+        }
+    }
+
+    fn width(&self, s: &str, size: f64) -> f64 {
+        match self {
+            Self::WinAnsi | Self::Simple(_) => helvetica_width(s, size),
             Self::Unicode(_) => cjk_width(s, size),
         }
     }
@@ -154,7 +167,7 @@ fn dr_font(doc: &Document, name: &str) -> Option<(Object, FontText)> {
     if matches!(fd.name(b"BaseFont"), Some(b"ZapfDingbats" | b"Symbol")) {
         return None;
     }
-    Some((entry, FontText::WinAnsi))
+    Some((entry, FontText::Simple(Box::new(Metrics::from_dict(doc, fd)))))
 }
 
 fn helvetica() -> Object {
@@ -281,7 +294,22 @@ pub fn field_appearance_as(doc: &Document, f: &Field, w: &Widget, values: &[Stri
     let place = placement(mk_rotation(doc, &wd), page_w, page_h);
     let (width, height) = (place.layout_w, place.layout_h);
     let da = parse_da(wd.get(b"DA").and_then(|o| doc.resolve(o).as_string().map(|s| s.to_text())).as_deref().unwrap_or(&f.da));
-    let (font_name, font_obj, enc) = match dr_font(doc, &da.font) {
+    let text: String = if f.kind == FieldKind::Combo {
+        values.iter().map(|v| f.options.iter().find(|(e, _)| e == v).map_or(v.clone(), |(_, d)| d.clone())).collect::<Vec<_>>().join(", ")
+    } else {
+        values.first().cloned().unwrap_or_default()
+    };
+    let text = if f.has(flags::PASSWORD) { "*".repeat(text.chars().count()) } else { text };
+    let can_show = |enc: &FontText| {
+        if f.kind == FieldKind::List {
+            f.options.iter().all(|(_, display)| enc.can_encode(display))
+        } else if f.kind == FieldKind::Text && f.has(flags::MULTILINE) {
+            text.split(['\n', '\r']).all(|line| enc.can_encode(line))
+        } else {
+            enc.can_encode(&text)
+        }
+    };
+    let (font_name, font_obj, enc) = match dr_font(doc, &da.font).filter(|(_, enc)| can_show(enc)) {
         Some((o, enc)) => (da.font.clone(), o, enc),
         None => ("Helv".to_string(), helvetica(), FontText::WinAnsi),
     };
@@ -326,12 +354,6 @@ pub fn field_appearance_as(doc: &Document, f: &Field, w: &Widget, values: &[Stri
             }
         }
         _ => {
-            let text: String = if f.kind == FieldKind::Combo {
-                values.iter().map(|v| f.options.iter().find(|(e, _)| e == v).map_or(v.clone(), |(_, d)| d.clone())).collect::<Vec<_>>().join(", ")
-            } else {
-                values.first().cloned().unwrap_or_default()
-            };
-            let text = if f.has(flags::PASSWORD) { "*".repeat(text.chars().count()) } else { text };
             let comb = f.has(flags::COMB) && !f.has(flags::MULTILINE) && !f.has(flags::PASSWORD) && f.max_len.is_some_and(|m| m > 0);
             if f.kind == FieldKind::Text && f.has(flags::MULTILINE) {
                 if size == 0.0 {
diff --git a/crates/forms/src/lib.rs b/crates/forms/src/lib.rs
index 4735474e..5d889559 100644
--- a/crates/forms/src/lib.rs
+++ b/crates/forms/src/lib.rs
@@ -487,13 +487,28 @@ struct Inherited {
 /// Every terminal field: the `/Fields` tree in order, then the fields reachable only through the
 /// page annotations (see [`adopt_page_fields`]).
 pub fn fields(doc: &Document) -> Vec<Field> {
-    enumerate(doc).0
+    fields_with_adopted(doc).items
 }
 
 /// How many of [`fields`] were reachable only through the page annotations: the form's `/Fields`
 /// list names none or only some of them, so the leniency that adopts them is worth recording.
 pub fn adopted_page_fields(doc: &Document) -> usize {
-    enumerate(doc).1
+    fields_with_adopted(doc).adopted_page_fields
+}
+
+/// The terminal fields and page-only fields adopted while reading a form.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Fields {
+    /// Terminal fields in tree order, followed by adopted page-only fields.
+    pub items: Vec<Field>,
+    /// How many fields were reachable only through page annotations.
+    pub adopted_page_fields: usize,
+}
+
+/// Read all terminal fields and the page-only adoption count in one enumeration.
+pub fn fields_with_adopted(doc: &Document) -> Fields {
+    let (items, adopted_page_fields) = enumerate(doc);
+    Fields { items, adopted_page_fields }
 }
 
 fn enumerate(doc: &Document) -> (Vec<Field>, usize) {
@@ -846,7 +861,7 @@ pub fn recalculate(doc: &mut Document) -> Result<usize, FormError> {
 
 /// [`recalculate`], running custom Calculate (and Format) scripts through `scripts`.
 pub fn recalculate_with(doc: &mut Document, scripts: &mut dyn Scripts) -> Result<usize, FormError> {
-    let all = fields(doc);
+    let mut all = fields(doc);
     let calculated = |f: &Field| f.actions.calculate != af::Calculate::None || f.actions.scripts.calculate.is_some();
     if !all.iter().any(calculated) {
         return Ok(0);
@@ -865,17 +880,18 @@ pub fn recalculate_with(doc: &mut Document, scripts: &mut dyn Scripts) -> Result
     }
     let mut changed = 0;
     for name in order {
-        let now = fields(doc);
-        let Some(f) = now.iter().find(|f| f.name == name) else { continue };
+        let Some(f) = all.iter().find(|f| f.name == name).cloned() else { continue };
         let lookup = |n: &str| -> Vec<String> {
             let prefix = format!("{n}.");
-            now.iter().filter(|x| x.name == n || x.name.starts_with(&prefix)).flat_map(|x| x.value.first().cloned()).collect()
+            all.iter().filter(|x| x.name == n || x.name.starts_with(&prefix)).flat_map(|x| x.value.first().cloned()).collect()
         };
         let current = f.value.first().cloned().unwrap_or_default();
         let v = if let Some(js) = &f.actions.scripts.calculate {
-            let f = f.clone();
-            let r = scripts.run(FieldEvent::Calculate, js, &f, &current, &now);
+            let r = scripts.run(FieldEvent::Calculate, js, &f, &current, &all);
             scripting::apply_changes(doc, &r.changes, &f.name)?;
+            if !r.changes.is_empty() {
+                all = fields(doc);
+            }
             if !r.rc {
                 continue;
             }
@@ -884,12 +900,12 @@ pub fn recalculate_with(doc: &mut Document, scripts: &mut dyn Scripts) -> Result
             let Some(v) = af::calculate(&f.actions.calculate, &lookup) else { continue };
             v
         };
-        let now = fields(doc);
-        let Some(f) = now.iter().find(|f| f.name == name) else { continue };
         if current != v && matches!(f.kind, FieldKind::Text | FieldKind::Combo) {
-            let f = f.clone();
             doc.update_dict(f.obj, |d| d.set(b"V".to_vec(), PdfString::text(&v)))?;
             redraw(doc, &f, std::slice::from_ref(&v), scripts)?;
+            if let Some(target) = all.iter_mut().find(|x| x.name == name) {
+                target.value = vec![v];
+            }
             changed += 1;
         }
     }
diff --git a/crates/forms/src/scripting.rs b/crates/forms/src/scripting.rs
index 9e9a36f2..012dbb83 100644
--- a/crates/forms/src/scripting.rs
+++ b/crates/forms/src/scripting.rs
@@ -100,8 +100,11 @@ pub(crate) fn formatted(doc: &Document, f: &Field, value: &str, scripts: &mut dy
 /// read-only, required and visibility as flags). `except` is the event's own field, whose value
 /// the event sets.
 pub(crate) fn apply_changes(doc: &mut Document, changes: &[FieldChange], except: &str) -> Result<(), FormError> {
+    if changes.is_empty() {
+        return Ok(());
+    }
+    let all = fields(doc);
     for c in changes {
-        let all = fields(doc);
         let Some(f) = all.iter().find(|f| f.name == c.name) else { continue };
         if let Some(v) = &c.value
             && c.name != except
diff --git a/crates/forms/src/tests.rs b/crates/forms/src/tests.rs
index 8a40c366..aa98dd7c 100644
--- a/crates/forms/src/tests.rs
+++ b/crates/forms/src/tests.rs
@@ -62,6 +62,20 @@ fn reopen(doc: &Document) -> Document {
     Document::open(Arc::new(bytes)).expect("reopens")
 }
 
+fn legacy_two_call_enumeration(doc: &Document) -> (Vec<Field>, usize) {
+    (enumerate(doc).0, enumerate(doc).1)
+}
+
+fn assert_combined_matches_legacy(doc: &Document, adopted: usize) {
+    let (old_fields, old_adopted) = legacy_two_call_enumeration(doc);
+    let combined = fields_with_adopted(doc);
+    assert_eq!(combined.items, old_fields);
+    assert_eq!(combined.adopted_page_fields, old_adopted);
+    assert_eq!(combined.adopted_page_fields, adopted);
+    assert_eq!(fields(doc), old_fields, "the compatibility wrapper keeps the old fields");
+    assert_eq!(adopted_page_fields(doc), old_adopted, "the compatibility wrapper keeps the old count");
+}
+
 fn field<'a>(all: &'a [Field], name: &str) -> &'a Field {
     all.iter().find(|f| f.name == name).unwrap_or_else(|| panic!("no field {name}"))
 }
@@ -73,9 +87,28 @@ fn ap(doc: &Document, w: &Widget) -> String {
     String::from_utf8_lossy(&s.decoded().unwrap()).into_owned()
 }
 
+/// Read the drawn strings together with the appearance's actual font after saving and reopening.
+fn appearance_text(doc: &Document, w: &Widget, font_name: &[u8]) -> (Object, Vec<Vec<u8>>) {
+    let widget = doc.get(w.obj);
+    let normal = widget.as_dict().unwrap().get(b"AP").unwrap().as_dict().unwrap().reference(b"N").unwrap();
+    let appearance = doc.get(normal);
+    let Object::Stream(stream) = appearance.as_ref() else { panic!("appearance stream") };
+    let resources = doc.resolve(stream.dict.get(b"Resources").unwrap());
+    let fonts = doc.resolve(resources.as_dict().unwrap().get(b"Font").unwrap());
+    let font = doc.resolve(fonts.as_dict().unwrap().get(font_name).unwrap());
+    let shown = pdfcraft_content::parse(&stream.decoded().unwrap())
+        .ops
+        .into_iter()
+        .filter(|op| op.is("Tj"))
+        .map(|op| op.operands[0].as_string().unwrap().bytes.clone())
+        .collect();
+    (font.as_ref().clone(), shown)
+}
+
 #[test]
 fn the_field_tree_is_read_with_inheritance() {
     let doc = fixture();
+    assert_combined_matches_legacy(&doc, 0);
     let all = fields(&doc);
     let names: Vec<&str> = all.iter().map(|f| f.name.as_str()).collect();
     assert_eq!(names, ["name", "notes", "zip", "pin", "id", "address.city", "agree", "size", "country", "toppings", "go", "bare"]);
@@ -140,6 +173,7 @@ fn fields_listed_only_on_the_pages_are_adopted() {
         "<< /Type /Annot /Subtype /Widget /Rect [400 700 415 715] /P 3 0 R >>".into(), // 15 no /FT, /T or /Parent: not a field
     ];
     let mut doc = document(&objs);
+    assert_combined_matches_legacy(&doc, 3);
     let all = fields(&doc);
     let names: Vec<&str> = all.iter().map(|f| f.name.as_str()).collect();
     assert_eq!(names, ["listed", "alpha", "beta", "pair"]);
@@ -157,6 +191,7 @@ fn fields_listed_only_on_the_pages_are_adopted() {
     let mut objs = objs;
     objs[3] = "<< /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 6 0 R >> >> >>".into();
     let doc = document(&objs);
+    assert_combined_matches_legacy(&doc, 4);
     let all = fields(&doc);
     let names: Vec<&str> = all.iter().map(|f| f.name.as_str()).collect();
     assert_eq!(names, ["listed", "alpha", "beta", "pair"]);
@@ -227,6 +262,93 @@ fn text_fields_get_new_appearances() {
     assert!(raw.windows(8).any(|x| x == b"(Z\xfcrich)"));
 }
 
+#[test]
+fn existing_field_font_encoding_keeps_italian_punctuation_visible() {
+    // ReportLab-style Helvetica: an indirect encoding dictionary with PDFDoc-like Differences.
+    // WinAnsi 0x92/0x97 would show trademark/Scaron in this font, not quoteright/emdash.
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [6 0 R] >>".into(),
+        "<< /Fields [6 0 R] /DA (/Helv 12 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding 7 0 R >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (localita) /Rect [50 700 450 730] /P 3 0 R >>".into(),
+        "<< /Type /Encoding /Differences [39 /quotesingle 96 /grave 132 /emdash 144 /quoteright 146 /trademark 151 /Scaron 224 /agrave] >>".into(),
+    ];
+    let mut doc = document(&objs);
+    let original_font = doc.get(ObjRef::new(5, 0)).as_ref().clone();
+    let value = "Città Sant’Angelo — qualità";
+    set_value(&mut doc, "localita", &FieldValue::Text(value.into())).unwrap();
+    let doc = reopen(&doc);
+    let all = fields(&doc);
+    let f = field(&all, "localita");
+    assert_eq!(f.value, [value], "the stored value and the drawn text must agree");
+    let (font, lines) = appearance_text(&doc, &f.widgets[0], b"Helv");
+    assert_eq!(font, original_font, "keep the existing field's font and encoding");
+    let metrics = pdfcraft_fonts::pdf::Metrics::from_dict(&doc, font.as_dict().unwrap());
+    let shown = lines.concat();
+    assert_eq!(metrics.decode(&shown), value, "decode the appearance with its actual font");
+    assert_eq!(shown, b"Citt\xe0 Sant\x90Angelo \x84 qualit\xe0");
+}
+
+#[test]
+fn unavailable_glyph_uses_an_appearance_font_without_changing_the_source_font() {
+    // A subset font with only A cannot draw the newly entered accented text. Replacing its
+    // encoding would corrupt every existing use of that font, so only the appearance falls back.
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [6 0 R] >>".into(),
+        "<< /Fields [6 0 R] /DA (/Original 12 Tf 0 g) /DR << /Font << /Original 5 0 R >> >> >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /ABCDEF+Custom /FirstChar 65 /LastChar 65 /Widths [600] /Encoding /WinAnsiEncoding >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (localita) /Rect [50 700 450 730] /P 3 0 R >>".into(),
+    ];
+    let mut doc = document(&objs);
+    let original_font = doc.get(ObjRef::new(5, 0)).as_ref().clone();
+    let value = "Città Sant’Angelo — qualità";
+    set_value(&mut doc, "localita", &FieldValue::Text(value.into())).unwrap();
+    let doc = reopen(&doc);
+    assert_eq!(doc.get(ObjRef::new(5, 0)).as_ref(), &original_font);
+    let all = fields(&doc);
+    let f = field(&all, "localita");
+    assert_eq!(f.value, [value]);
+    let (font, lines) = appearance_text(&doc, &f.widgets[0], b"Helv");
+    let font = font.as_dict().unwrap();
+    assert_eq!(font.name(b"BaseFont"), Some(&b"Helvetica"[..]));
+    assert_eq!(font.name(b"Encoding"), Some(&b"WinAnsiEncoding"[..]));
+    let metrics = pdfcraft_fonts::pdf::Metrics::from_dict(&doc, font);
+    let shown = lines.concat();
+    assert_eq!(metrics.decode(&shown), value);
+    assert_eq!(shown, b"Citt\xe0 Sant\x92Angelo \x97 qualit\xe0");
+}
+
+#[test]
+fn multiline_wrapping_keeps_encodable_text_without_requiring_ascii_space() {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [6 0 R] >>".into(),
+        "<< /Fields [6 0 R] /DA (/Helv 12 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >>".into(),
+        "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding 7 0 R >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (localita) /Ff 4096 /Rect [50 500 130 550] /P 3 0 R >>".into(),
+        "<< /Type /Encoding /Differences [32 /.notdef 144 /quoteright 160 /nbspace 224 /agrave] >>".into(),
+    ];
+    let mut doc = document(&objs);
+    let original_font = doc.get(ObjRef::new(5, 0)).as_ref().clone();
+    // NBSP remains part of the word; wrapping splits it by character without adding spaces.
+    let value = "Città\u{a0}Sant’Angelo\nqualità";
+    set_value(&mut doc, "localita", &FieldValue::Text(value.into())).unwrap();
+    let doc = reopen(&doc);
+    let all = fields(&doc);
+    let f = field(&all, "localita");
+    assert_eq!(f.value, [value]);
+    let (font, lines) = appearance_text(&doc, &f.widgets[0], b"Helv");
+    assert_eq!(font, original_font);
+    assert!(lines.len() >= 3 && lines.iter().all(|line| !line.is_empty()));
+    let metrics = pdfcraft_fonts::pdf::Metrics::from_dict(&doc, font.as_dict().unwrap());
+    assert_eq!(metrics.decode(&lines.concat()), value.replace('\n', ""));
+}
+
 #[test]
 fn japanese_choices_use_the_unicode_cid_font() {
     // A choice field whose /DA names a non-embedded CID font with a predefined Unicode CMap
@@ -394,10 +516,44 @@ fn reset_restores_defaults() {
 #[test]
 fn documents_without_forms_say_so() {
     let mut doc = Document::new_empty();
+    assert_combined_matches_legacy(&doc, 0);
     assert!(fields(&doc).is_empty());
     assert_eq!(set_value(&mut doc, "x", &FieldValue::Text("y".into())), Err(FormError::NoForm));
 }
 
+#[test]
+fn combined_enumeration_keeps_page_order_across_pages() {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 5 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [6 0 R] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [7 0 R] >>".into(),
+        "<< /Fields [6 0 R] >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (listed) /Rect [50 700 250 720] /P 3 0 R >>".into(),
+        "<< /Type /Annot /Subtype /Widget /FT /Tx /T (adopted) /Rect [50 700 250 720] /P 4 0 R >>".into(),
+    ];
+    let doc = document(&objs);
+    assert_combined_matches_legacy(&doc, 1);
+
+    let combined = fields_with_adopted(&doc);
+    assert_eq!(combined.items.iter().map(|f| f.name.as_str()).collect::<Vec<_>>(), ["listed", "adopted"]);
+    assert_eq!(combined.items.iter().map(|f| f.widgets[0].page).collect::<Vec<_>>(), [Some(0), Some(1)]);
+}
+
+#[test]
+fn combined_enumeration_keeps_leniency_for_dangling_field_entries() {
+    let objs: Vec<String> = vec![
+        "<< /Type /Catalog /Pages 2 0 R /AcroForm 4 0 R >>".into(),
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 600 800] >>".into(),
+        "<< /Type /Page /Parent 2 0 R /Annots [] >>".into(),
+        "<< /Fields [99 0 R null 5 0 R] >>".into(),
+        "<< /FT /Tx /T (valid) >>".into(),
+    ];
+    let doc = document(&objs);
+    assert_combined_matches_legacy(&doc, 0);
+    assert_eq!(fields_with_adopted(&doc).items.iter().map(|f| f.name.as_str()).collect::<Vec<_>>(), ["valid"]);
+}
+
 #[test]
 fn every_field_type_can_be_added_named_and_drawn() {
     let mut doc = Document::new_empty();
@@ -905,6 +1061,7 @@ fn field_actions_round_trip_on_every_trigger() {
     assert_eq!(field_actions(&doc, &name).unwrap(), [(Trigger::MouseExit, FieldAction::Named("NextPage".into()))]);
     // The Mouse Up script is what the button runs.
     set_field_actions(&mut doc, &name, &[(Trigger::MouseUp, FieldAction::JavaScript("this.print();".into()))]).unwrap();
+    assert_combined_matches_legacy(&doc, 0);
     assert_eq!(fields(&doc).iter().find(|f| f.name == "go").unwrap().button, Some(af::ButtonAction::Named("Print".into())));
 }
 
@@ -1337,6 +1494,49 @@ fn check_box_redraw_keeps_down_states_it_still_draws() {
     assert!(!d.contains(b"Gone"), "a state the box no longer draws");
 }
 
+#[test]
+fn recalc_chain_where_script_changes_checkbox() {
+    struct TestScripts;
+    impl Scripts for TestScripts {
+        fn run(&mut self, _event: FieldEvent, script: &str, _target: &Field, _value: &str, fields: &[Field]) -> ScriptResult {
+            if script == "set_box" {
+                ScriptResult {
+                    rc: true,
+                    value: "calc1".into(),
+                    changes: vec![FieldChange {
+                        name: "agree".into(),
+                        value: Some(vec!["Yes".into()]),
+                        read_only: None,
+                        required: None,
+                        display: None,
+                    }],
+                    message: None,
+                }
+            } else if script == "read_box" {
+                let box_val = fields.iter().find(|f| f.name == "agree").and_then(|f| f.value.first()).cloned().unwrap_or_default();
+                ScriptResult { rc: true, value: format!("box_was_{box_val}"), changes: Vec::new(), message: None }
+            } else {
+                ScriptResult { rc: true, value: String::new(), changes: Vec::new(), message: None }
+            }
+        }
+    }
+
+    let mut doc = one_page();
+    add_field(&mut doc, 0, [10.0, 10.0, 100.0, 30.0], &NewField::Text { multiline: false }, Some("trigger")).unwrap();
+    add_field(&mut doc, 0, [10.0, 40.0, 30.0, 60.0], &NewField::CheckBox, Some("agree")).unwrap();
+    add_field(&mut doc, 0, [10.0, 70.0, 100.0, 90.0], &NewField::Text { multiline: false }, Some("result")).unwrap();
+
+    set_field_script(&mut doc, "trigger", "calculate", Some("set_box")).unwrap();
+    set_field_script(&mut doc, "result", "calculate", Some("read_box")).unwrap();
+
+    let changed = recalculate_with(&mut doc, &mut TestScripts).unwrap();
+    assert!(changed >= 2);
+
+    let all = fields(&doc);
+    assert_eq!(field(&all, "agree").value, ["Yes"], "checkbox was set by script in recalc chain");
+    assert_eq!(field(&all, "result").value, ["box_was_Yes"], "second recalc saw the normalized checkbox value");
+}
+
 #[test]
 fn partial_appearance_keeps_custom_default_appearance_and_font_resources() {
     let mut doc = fixture();
diff --git a/crates/geom/src/lib.rs b/crates/geom/src/lib.rs
index b04e47cb..40f38498 100644
--- a/crates/geom/src/lib.rs
+++ b/crates/geom/src/lib.rs
@@ -5,6 +5,8 @@
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+pub mod perspective;
+
 /// An axis-aligned rectangle in PDF user space (points).
 #[derive(Clone, Copy, Debug, PartialEq, Default)]
 pub struct PageRect {
diff --git a/crates/geom/src/perspective.rs b/crates/geom/src/perspective.rs
new file mode 100644
index 00000000..96aa663e
--- /dev/null
+++ b/crates/geom/src/perspective.rs
@@ -0,0 +1,171 @@
+//! Perspective (projective) transforms between quadrilaterals: what straightening a photographed
+//! page needs. Pure maths in `f64`; every input may be hostile, so degenerate or non-finite
+//! quadrilaterals give `None` instead of NaNs.
+
+/// A point `[x, y]`.
+pub type Point = [f64; 2];
+
+/// A 3×3 projective transform, row-major, normalised so that the last entry is 1.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Homography(pub [f64; 9]);
+
+impl Homography {
+    /// The transform that takes each of `from` to the point at the same index of `to`. `None`
+    /// when three of either set are collinear or a coordinate is not finite.
+    pub fn from_points(from: [Point; 4], to: [Point; 4]) -> Option<Self> {
+        if from.iter().chain(to.iter()).flatten().any(|v| !v.is_finite()) {
+            return None;
+        }
+        // x' = (h0 x + h1 y + h2) / (h6 x + h7 y + 1), y' likewise with h3..h5: eight unknowns,
+        // two equations per point pair.
+        let mut m = [[0.0f64; 9]; 8];
+        for (i, (&[x, y], &[u, v])) in from.iter().zip(to.iter()).enumerate() {
+            m[2 * i] = [x, y, 1.0, 0.0, 0.0, 0.0, -u * x, -u * y, u];
+            m[2 * i + 1] = [0.0, 0.0, 0.0, x, y, 1.0, -v * x, -v * y, v];
+        }
+        let h = solve8(m)?;
+        let out = Self([h[0], h[1], h[2], h[3], h[4], h[5], h[6], h[7], 1.0]);
+        // Collinear points can leave a solvable but singular system: check that the transform
+        // really maps the four points.
+        let ok = from.iter().zip(to.iter()).all(|(&p, &q)| {
+            out.apply(p).is_some_and(|r| {
+                let scale = 1.0 + q[0].abs().max(q[1].abs());
+                (r[0] - q[0]).abs() <= 1e-6 * scale && (r[1] - q[1]).abs() <= 1e-6 * scale
+            })
+        });
+        ok.then_some(out)
+    }
+
+    /// The image of `p`, or `None` where the transform sends it to infinity.
+    pub fn apply(&self, [x, y]: Point) -> Option<Point> {
+        let h = &self.0;
+        let w = h[6] * x + h[7] * y + h[8];
+        if !w.is_finite() || w.abs() < 1e-12 {
+            return None;
+        }
+        let u = (h[0] * x + h[1] * y + h[2]) / w;
+        let v = (h[3] * x + h[4] * y + h[5]) / w;
+        (u.is_finite() && v.is_finite()).then_some([u, v])
+    }
+}
+
+/// Gaussian elimination with partial pivoting on an 8×8 system (the 9th column is the right-hand
+/// side). `None` when the system is singular.
+fn solve8(mut m: [[f64; 9]; 8]) -> Option<[f64; 8]> {
+    for col in 0..8 {
+        let pivot = (col..8).max_by(|&a, &b| m[a][col].abs().total_cmp(&m[b][col].abs()))?;
+        if m[pivot][col].abs() < 1e-12 {
+            return None;
+        }
+        m.swap(col, pivot);
+        let p = m[col];
+        for (r, row) in m.iter_mut().enumerate() {
+            if r == col {
+                continue;
+            }
+            let f = row[col] / p[col];
+            if f != 0.0 {
+                for (a, b) in row.iter_mut().zip(p.iter()) {
+                    *a -= f * b;
+                }
+            }
+        }
+    }
+    let mut out = [0.0; 8];
+    for (i, o) in out.iter_mut().enumerate() {
+        *o = m[i][8] / m[i][i];
+        if !o.is_finite() {
+            return None;
+        }
+    }
+    Some(out)
+}
+
+/// The four corners in reading order for a y-down space (view or raster pixels): top-left,
+/// top-right, bottom-right, bottom-left, whatever order they were given in. `None` unless they
+/// form a convex quadrilateral with a non-negligible area.
+pub fn order_quad(points: [Point; 4]) -> Option<[Point; 4]> {
+    if points.iter().flatten().any(|v| !v.is_finite()) {
+        return None;
+    }
+    let cx = points.iter().map(|p| p[0]).sum::<f64>() / 4.0;
+    let cy = points.iter().map(|p| p[1]).sum::<f64>() / 4.0;
+    let mut q = points;
+    // Ascending angle about the centre is clockwise on screen (y down): top, right, bottom, left.
+    q.sort_by(|a, b| (a[1] - cy).atan2(a[0] - cx).total_cmp(&(b[1] - cy).atan2(b[0] - cx)));
+    let first = (0..4).min_by(|&a, &b| (q[a][0] + q[a][1]).total_cmp(&(q[b][0] + q[b][1])))?;
+    q.rotate_left(first);
+    // Convex, with every turn the same way, and not a sliver.
+    let cross = |o: Point, a: Point, b: Point| (a[0] - o[0]) * (b[1] - o[1]) - (a[1] - o[1]) * (b[0] - o[0]);
+    let turns: Vec<f64> = (0..4).map(|i| cross(q[i], q[(i + 1) % 4], q[(i + 2) % 4])).collect();
+    let area = turns.iter().sum::<f64>() / 2.0;
+    let span = q.iter().map(|p| p[0]).fold(f64::MIN, f64::max) - q.iter().map(|p| p[0]).fold(f64::MAX, f64::min);
+    let rise = q.iter().map(|p| p[1]).fold(f64::MIN, f64::max) - q.iter().map(|p| p[1]).fold(f64::MAX, f64::min);
+    let size = span.max(rise);
+    let convex = turns.iter().all(|&t| t > 1e-9 * size * size);
+    (convex && area > 1e-6 * size * size).then_some(q)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn close(a: Point, b: Point) -> bool {
+        (a[0] - b[0]).abs() < 1e-6 && (a[1] - b[1]).abs() < 1e-6
+    }
+
+    #[test]
+    fn maps_each_corner_onto_its_target() {
+        let from = [[12.0, 30.0], [410.0, 5.0], [430.0, 610.0], [-4.0, 590.0]];
+        let to = [[0.0, 0.0], [400.0, 0.0], [400.0, 600.0], [0.0, 600.0]];
+        let h = Homography::from_points(from, to).unwrap();
+        for (p, q) in from.iter().zip(to.iter()) {
+            assert!(close(h.apply(*p).unwrap(), *q), "{p:?} -> {q:?}");
+        }
+    }
+
+    #[test]
+    fn a_rectangle_onto_itself_is_the_identity() {
+        let r = [[0.0, 0.0], [10.0, 0.0], [10.0, 20.0], [0.0, 20.0]];
+        let h = Homography::from_points(r, r).unwrap();
+        assert!(close(h.apply([3.0, 7.0]).unwrap(), [3.0, 7.0]));
+    }
+
+    #[test]
+    fn the_inverse_takes_points_back() {
+        let from = [[50.0, 40.0], [300.0, 70.0], [320.0, 400.0], [30.0, 380.0]];
+        let to = [[0.0, 0.0], [200.0, 0.0], [200.0, 300.0], [0.0, 300.0]];
+        let (h, back) = (Homography::from_points(from, to).unwrap(), Homography::from_points(to, from).unwrap());
+        let p = [120.0, 210.0];
+        assert!(close(back.apply(h.apply(p).unwrap()).unwrap(), p));
+    }
+
+    #[test]
+    fn collinear_or_non_finite_points_have_no_transform() {
+        let to = [[0.0, 0.0], [1.0, 0.0], [1.0, 1.0], [0.0, 1.0]];
+        assert!(Homography::from_points([[0.0, 0.0], [1.0, 1.0], [2.0, 2.0], [3.0, 3.0]], to).is_none());
+        assert!(Homography::from_points([[0.0, 0.0]; 4], to).is_none());
+        assert!(Homography::from_points([[f64::NAN, 0.0], [1.0, 0.0], [1.0, 1.0], [0.0, 1.0]], to).is_none());
+        assert!(Homography::from_points([[f64::INFINITY, 0.0], [1.0, 0.0], [1.0, 1.0], [0.0, 1.0]], to).is_none());
+    }
+
+    #[test]
+    fn corners_come_back_in_reading_order_whatever_the_input_order() {
+        let tl = [10.0, 12.0];
+        let tr = [200.0, 5.0];
+        let br = [210.0, 300.0];
+        let bl = [0.0, 290.0];
+        for q in [[br, tl, bl, tr], [bl, br, tr, tl], [tl, tr, br, bl], [tr, bl, tl, br]] {
+            assert_eq!(order_quad(q), Some([tl, tr, br, bl]), "{q:?}");
+        }
+    }
+
+    #[test]
+    fn concave_degenerate_or_non_finite_quads_are_refused() {
+        // A dart: one corner inside the triangle of the other three.
+        assert_eq!(order_quad([[0.0, 0.0], [100.0, 0.0], [20.0, 20.0], [0.0, 100.0]]), None);
+        assert_eq!(order_quad([[0.0, 0.0], [10.0, 0.0], [20.0, 0.0], [30.0, 0.0]]), None);
+        assert_eq!(order_quad([[5.0, 5.0]; 4]), None);
+        assert_eq!(order_quad([[f64::NAN, 0.0], [1.0, 0.0], [1.0, 1.0], [0.0, 1.0]]), None);
+    }
+}
diff --git a/crates/js/src/formcalc.rs b/crates/js/src/formcalc.rs
index 0fc07164..5942391b 100644
--- a/crates/js/src/formcalc.rs
+++ b/crates/js/src/formcalc.rs
@@ -2543,7 +2543,11 @@ pub(crate) fn run_formcalc_at(
 /// [`run_formcalc`] on its own thread, abandoned after `timeout` (and told to stop itself then).
 pub fn run_formcalc_within(script: &str, event: &XfaEvent, doc: &XfaDoc, root: XfaNode, limits: Limits, timeout: std::time::Duration) -> XfaOutcome {
     let (script, event, doc) = (script.to_string(), event.clone(), doc.clone());
-    run_within("pdfcraft-formcalc", timeout, move || run_formcalc_at(&script, &event, &doc, root, limits, Some(timeout)))
+    // FormCalc has no engine to start: its time (and its own deadline) begins at once.
+    run_within("pdfcraft-formcalc", timeout, move |started| {
+        started();
+        run_formcalc_at(&script, &event, &doc, root, limits, Some(timeout))
+    })
 }
 
 #[cfg(test)]
diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs
index cb8b9974..e0c9a24e 100644
--- a/crates/js/src/tests.rs
+++ b/crates/js/src/tests.rs
@@ -544,6 +544,37 @@ mod xfa_model {
         let o = go("xfa.host.messageBox(new Array(100000).join('x'));", "form1[0].page1[0]", "click");
         assert!(matches!(&o.effects[0], XfaEffect::MessageBox(m) if m.chars().count() <= 4_097));
     }
+
+    #[test]
+    fn a_slow_engine_start_does_not_count_against_the_script() {
+        let ms = std::time::Duration::from_millis;
+        // On a busy machine the engine can take longer to start than a script may run: the
+        // script still runs (abandoning it would turn the form's scripts off).
+        let o = run_within_limits("test", ms(10_000), ms(500), move |started| {
+            std::thread::sleep(ms(1_500));
+            started();
+            XfaOutcome { result: Some("ran".into()), ..Default::default() }
+        });
+        assert!(!o.abandoned, "{o:?}");
+        assert_eq!(o.result.as_deref(), Some("ran"));
+        // The script's own time counts from then.
+        let o = run_within_limits("test", ms(10_000), ms(200), move |started| {
+            started();
+            std::thread::sleep(ms(2_000));
+            XfaOutcome::default()
+        });
+        assert!(o.abandoned && o.error.as_deref().is_some_and(|e| e.contains("ran longer")), "{o:?}");
+        // Start-up has a limit of its own, so nobody waits forever for an engine.
+        let o = run_within_limits("test", ms(200), ms(10_000), move |started| {
+            std::thread::sleep(ms(2_000));
+            started();
+            XfaOutcome::default()
+        });
+        assert!(o.abandoned && o.error.as_deref().is_some_and(|e| e.contains("to start")), "{o:?}");
+        // A script that finishes without saying it started (refused at once) isn't abandoned.
+        let o = run_within_limits("test", ms(10_000), ms(200), |_| XfaOutcome { error: Some("refused".into()), ..Default::default() });
+        assert!(!o.abandoned && o.error.as_deref() == Some("refused"), "{o:?}");
+    }
 }
 
 mod formcalc {
diff --git a/crates/js/src/xfa.rs b/crates/js/src/xfa.rs
index c6995ba2..e9a11c7d 100644
--- a/crates/js/src/xfa.rs
+++ b/crates/js/src/xfa.rs
@@ -1345,7 +1345,7 @@ pub fn run_xfa(script: &str, event: &XfaEvent, doc: &XfaDoc, root: &XfaNode, lim
             let spawned = std::thread::Builder::new()
                 .name("pdfcraft-xfa-js".into())
                 .stack_size(crate::SCRIPT_STACK)
-                .spawn_scoped(scope, || run_here(script, event, doc, root.clone(), limits));
+                .spawn_scoped(scope, || run_here(script, event, doc, root.clone(), limits, &|| {}));
             match spawned {
                 Ok(thread) => thread.join().unwrap_or_else(|_| failed("the script stopped with an internal error".into())),
                 Err(e) => failed(format!("the script engine could not start: {e}")),
@@ -1353,56 +1353,112 @@ pub fn run_xfa(script: &str, event: &XfaEvent, doc: &XfaDoc, root: &XfaNode, lim
         })
     }
     #[cfg(target_arch = "wasm32")]
-    run_here(script, event, doc, root.clone(), limits)
+    run_here(script, event, doc, root.clone(), limits, &|| {})
 }
 
-/// [`run_xfa`] with a time limit: a script still running after `timeout` (loops inside
-/// nested function calls can run for hours within the engine's per-frame loop limit) is left
-/// on its thread, which ends when the engine's own limits stop it, and an outcome with
-/// `abandoned` set comes back at once. In the browser build there are no threads: the script
-/// runs to its limits.
+/// [`run_xfa`] with a time limit: a script still running `timeout` after the engine is ready
+/// (loops inside nested function calls can run for hours within the engine's per-frame loop
+/// limit) is left on its thread, which ends when the engine's own limits stop it, and an
+/// outcome with `abandoned` set comes back at once. In the browser build there are no
+/// threads: the script runs to its limits.
 pub fn run_xfa_within(script: &str, event: &XfaEvent, doc: &XfaDoc, root: XfaNode, limits: Limits, timeout: std::time::Duration) -> XfaOutcome {
     if let Some(why) = refuse(script) {
         return XfaOutcome { error: Some(why), ..Default::default() };
     }
     let (script, event, doc) = (script.to_string(), event.clone(), doc.clone());
-    run_within("pdfcraft-xfa-js", timeout, move || run_here(&script, &event, &doc, root, limits))
+    run_within("pdfcraft-xfa-js", timeout, move |started| run_here(&script, &event, &doc, root, limits, started))
 }
 
+/// Longest the script engine may take to be ready for a script (its thread and context, and
+/// for the first script in a process the engine's own set-up) before the script is abandoned.
+/// It doesn't count against the script's time: on a busy machine the start alone can take
+/// longer than the tightest limit, and abandoning a script turns the form's scripts off.
+const ENGINE_START_LIMIT: std::time::Duration = std::time::Duration::from_secs(10);
+
 /// Run `script` on its own thread (with the script stack) and wait at most `timeout` for its
-/// outcome; past that the thread is abandoned and the outcome says so. On wasm there are no
-/// threads: the script runs here.
-pub(crate) fn run_within(name: &str, timeout: std::time::Duration, script: impl FnOnce() -> XfaOutcome + Send + 'static) -> XfaOutcome {
+/// outcome, counted from when it calls `started` (once the engine is ready); past that the
+/// thread is abandoned and the outcome says so. On wasm there are no threads: the script runs
+/// here.
+pub(crate) fn run_within(name: &str, timeout: std::time::Duration, script: impl FnOnce(&dyn Fn()) -> XfaOutcome + Send + 'static) -> XfaOutcome {
+    run_within_limits(name, ENGINE_START_LIMIT, timeout, script)
+}
+
+/// [`run_within`] with the engine's start-up limit given.
+pub(crate) fn run_within_limits(
+    name: &str,
+    start_limit: std::time::Duration,
+    timeout: std::time::Duration,
+    script: impl FnOnce(&dyn Fn()) -> XfaOutcome + Send + 'static,
+) -> XfaOutcome {
     #[cfg(not(target_arch = "wasm32"))]
     {
+        use std::sync::mpsc::RecvTimeoutError;
+        use std::time::Instant;
+        enum Step {
+            Started,
+            Done(XfaOutcome),
+        }
         let failed = |why: String| XfaOutcome { error: Some(why), ..Default::default() };
+        let abandoned = |why: String| XfaOutcome { error: Some(why), abandoned: true, ..Default::default() };
         let (tx, rx) = std::sync::mpsc::channel();
         let spawned = std::thread::Builder::new().name(name.into()).stack_size(crate::SCRIPT_STACK).spawn(move || {
             // The receiver is gone when the caller stopped waiting: nothing to report then.
-            let _ = tx.send(script());
+            let started = tx.clone();
+            let outcome = script(&move || {
+                let _ = started.send(Step::Started);
+            });
+            let _ = tx.send(Step::Done(outcome));
         });
         if let Err(e) = spawned {
             return failed(format!("the script engine could not start: {e}"));
         }
-        match rx.recv_timeout(timeout) {
-            Ok(o) => o,
-            Err(std::sync::mpsc::RecvTimeoutError::Timeout) => XfaOutcome {
-                error: Some(format!("the script ran longer than {:.1} s and was abandoned", timeout.as_secs_f64())),
-                abandoned: true,
-                ..Default::default()
-            },
-            Err(std::sync::mpsc::RecvTimeoutError::Disconnected) => failed("the script stopped with an internal error".into()),
+        // Wait for the engine within its start-up limit, then for the script within its own.
+        let (mut running, mut limit) = (false, start_limit);
+        let mut deadline = Instant::now().checked_add(limit);
+        loop {
+            let left = deadline.map_or(limit, |d| d.saturating_duration_since(Instant::now()));
+            match rx.recv_timeout(left) {
+                Ok(Step::Done(o)) => return o,
+                Ok(Step::Started) => {
+                    // A second call changes nothing: the script's time has already begun.
+                    if !running {
+                        (running, limit) = (true, timeout);
+                        deadline = Instant::now().checked_add(limit);
+                    }
+                }
+                Err(RecvTimeoutError::Timeout) if running => {
+                    return abandoned(format!("the script ran longer than {:.1} s and was abandoned", timeout.as_secs_f64()));
+                }
+                Err(RecvTimeoutError::Timeout) => {
+                    return abandoned(format!("the script engine took longer than {:.0} s to start", start_limit.as_secs_f64()));
+                }
+                Err(RecvTimeoutError::Disconnected) => return failed("the script stopped with an internal error".into()),
+            }
         }
     }
     #[cfg(target_arch = "wasm32")]
     {
-        let _ = (name, timeout);
-        script()
+        let _ = (name, start_limit, timeout);
+        script(&|| {})
     }
 }
 
-fn run_here(script: &str, event: &XfaEvent, doc: &XfaDoc, root: XfaNode, limits: Limits) -> XfaOutcome {
+/// The first script in a process sets the engine up (its built-ins, parser and compiler come
+/// into use): a trivial script takes that on, so a form's script is never timed with it.
+fn warm_up() {
+    static WARM: std::sync::Once = std::sync::Once::new();
+    // `call_once_force`: a poisoned `Once` (a panic while warming up) only means warming up again.
+    WARM.call_once_force(|_| {
+        let mut ctx = Context::default();
+        let _ = ctx.eval(Source::from_bytes(b"(function () { return eval('0'); }).call({})"));
+    });
+}
+
+/// `started` is called once the engine is ready: a time limit on the script runs from then.
+fn run_here(script: &str, event: &XfaEvent, doc: &XfaDoc, root: XfaNode, limits: Limits, started: &dyn Fn()) -> XfaOutcome {
+    warm_up();
     let mut ctx = Context::default();
+    started();
     ctx.runtime_limits_mut().set_loop_iteration_limit(limits.loop_iterations);
     ctx.runtime_limits_mut().set_recursion_limit(limits.recursion);
     let host_state = XHost::new(root, &event.target, doc);
diff --git a/crates/measure/src/lib.rs b/crates/measure/src/lib.rs
index 067f6fa8..aac6663c 100644
--- a/crates/measure/src/lib.rs
+++ b/crates/measure/src/lib.rs
@@ -447,7 +447,13 @@ pub fn list(doc: &Document) -> Listing {
     out
 }
 /// Last containing viewport wins, using the first point of the measurement (ISO 32000-2 §12.9).
+/// Outside every viewport the page measures true size in inches.
 pub fn scale_at(doc: &Document, page_index: usize, at: Point) -> Result<Scale> {
+    scale_at_or(doc, page_index, at, 1.0 / 72.0, "in")
+}
+/// [`scale_at`], but outside every viewport the page measures true size in `unit`, of which there
+/// are `per_point` in a PDF point (25.4 / 72 for millimetres).
+pub fn scale_at_or(doc: &Document, page_index: usize, at: Point, per_point: f64, unit: &str) -> Result<Scale> {
     check_points(&[at])?;
     let p = page(doc, page_index)?;
     if let Some(o) = p.dict.get(b"VP") {
@@ -470,7 +476,7 @@ pub fn scale_at(doc: &Document, page_index: usize, at: Point) -> Result<Scale> {
             }
         }
     }
-    Scale::new(p.user_unit(doc) / 72.0, "in", 2)
+    Scale::new(p.user_unit(doc) * per_point, unit, 2)
 }
 /// Add a named rectangular viewport. Existing viewports are preserved in drawing order.
 pub fn set_scale(doc: &mut Document, page_index: usize, bbox: [f64; 4], name: &str, scale: &Scale) -> Result<()> {
diff --git a/crates/measure/src/snap.rs b/crates/measure/src/snap.rs
index 46455dcf..71ba78f4 100644
--- a/crates/measure/src/snap.rs
+++ b/crates/measure/src/snap.rs
@@ -74,6 +74,20 @@ fn nearest(p: Point, a: Point, b: Point) -> Point {
     let t = (dot(sub(p, a), v) / length).clamp(0.0, 1.0);
     [a[0] + v[0] * t, a[1] + v[1] * t]
 }
+/// Save a subpath's implicit closing edge for fill operations. An unpainted or
+/// stroke-only open path must not gain that edge.
+fn remember_close(closures: &mut Vec<[Point; 2]>, current: Option<Point>, start: Option<Point>) -> bool {
+    if let (Some(a), Some(b)) = (current, start)
+        && distance(a, b) > 1e-9
+    {
+        if closures.len() >= MAX_SEGMENTS {
+            return false;
+        }
+        closures.push([a, b]);
+    }
+    true
+}
+
 impl Geometry {
     /// Dense intersection searches are capped independently from path extraction.
     pub fn intersection_limited(&self, at: Point, tolerance: f64) -> bool {
@@ -233,6 +247,7 @@ impl Walker<'_> {
         let mut stack = Vec::new();
         let mut start = None;
         let mut current = None;
+        let mut closures = Vec::new();
         let mut path = Geometry::default();
         let point = |m: Matrix, x: f64, y: f64| {
             let (x, y) = m.apply(x, y);
@@ -265,6 +280,10 @@ impl Walker<'_> {
                 }
                 "m" => {
                     if let Some([x, y]) = op.nums::<2>() {
+                        if !remember_close(&mut closures, current, start) {
+                            self.geometry.truncated = true;
+                            break;
+                        }
                         let p = point(matrix, x, y);
                         current = Some(p);
                         start = Some(p);
@@ -309,6 +328,10 @@ impl Walker<'_> {
                 }
                 "re" => {
                     if let Some([x, y, w, h]) = op.nums::<4>() {
+                        if !remember_close(&mut closures, current, start) {
+                            self.geometry.truncated = true;
+                            break;
+                        }
                         let a = point(matrix, x, y);
                         let b = point(matrix, x + w, y);
                         let c = point(matrix, x + w, y + h);
@@ -321,8 +344,24 @@ impl Walker<'_> {
                     }
                 }
                 "S" | "s" | "f" | "F" | "f*" | "B" | "B*" | "b" | "b*" => {
-                    // Fills close open subpaths implicitly (ISO 32000-2 8.5.3.3); only a bare stroke leaves the path open.
-                    if String::from_utf8_lossy(&op.op).as_ref() != "S"
+                    let paint = String::from_utf8_lossy(&op.op);
+                    if matches!(paint.as_ref(), "f" | "F" | "f*" | "B" | "B*" | "b" | "b*") {
+                        if !remember_close(&mut closures, current, start) {
+                            self.geometry.truncated = true;
+                            break;
+                        }
+                        // Filling implicitly closes every open subpath, not just the last one.
+                        // Stroke-only S leaves its open subpaths unchanged.
+                        for [a, b] in closures.drain(..) {
+                            if self.geometry.segments.len().saturating_add(path.segments.len()) >= MAX_SEGMENTS
+                                || self.geometry.targets().saturating_add(path.targets()) >= MAX_TARGETS
+                            {
+                                path.truncated = true;
+                                break;
+                            }
+                            path.edge(a, b);
+                        }
+                    } else if paint == "s"
                         && let (Some(a), Some(b)) = (current, start)
                     {
                         path.edge(a, b);
@@ -331,12 +370,14 @@ impl Walker<'_> {
                     self.geometry.endpoints.append(&mut path.endpoints);
                     self.geometry.midpoints.append(&mut path.midpoints);
                     self.geometry.truncated |= path.truncated;
+                    closures.clear();
                     current = None;
                     start = None;
                 }
                 "n" => {
                     self.geometry.truncated |= path.truncated;
                     path = Geometry::default();
+                    closures.clear();
                     current = None;
                     start = None;
                 }
diff --git a/crates/measure/src/tests.rs b/crates/measure/src/tests.rs
index 1348a3ec..20a730be 100644
--- a/crates/measure/src/tests.rs
+++ b/crates/measure/src/tests.rs
@@ -150,6 +150,39 @@ fn snap_paths_endpoints_midpoints_and_intersections() {
     assert!(paths.snap([200.0, 200.0], 3.0, opts).unwrap().is_none());
     assert!(paths.snap([f64::NAN, 0.0], 3.0, opts).is_err());
 }
+#[test]
+fn filled_open_subpath_offers_the_same_snap_edges_as_explicit_close() {
+    let open = fixture("40 50 m 160 50 l 100 170 l f", "", &[]);
+    let closed = fixture("40 50 m 160 50 l 100 170 l h f", "", &[]);
+    let stroke = fixture("40 50 m 160 50 l 100 170 l S", "", &[]);
+    let filled = snap::geometry(&open, 0).unwrap();
+    let explicit = snap::geometry(&closed, 0).unwrap();
+    let stroked = snap::geometry(&stroke, 0).unwrap();
+
+    assert_eq!(filled.segments, explicit.segments);
+    assert_eq!(filled.segments.len(), 3);
+    assert_eq!(stroked.segments.len(), 2);
+    let paths_only = snap::SnapOptions { endpoints: false, midpoints: false, intersections: false, paths: true };
+    let hit = filled.snap([55.0, 80.0], 5.0, paths_only).unwrap().unwrap();
+    assert_eq!(hit.kind, snap::SnapKind::Path);
+    assert_eq!(hit.point, [55.0, 80.0]);
+    assert!(stroked.snap([55.0, 80.0], 5.0, paths_only).unwrap().is_none());
+}
+
+#[test]
+fn fills_close_all_open_subpaths_but_strokes_do_not() {
+    let triangles = "0 0 m 20 0 l 10 20 l 40 0 m 60 0 l 50 20 l";
+    for paint in ["f", "F", "f*", "B", "B*", "b", "b*"] {
+        let doc = fixture(&format!("{triangles} {paint}"), "", &[]);
+        let geometry = snap::geometry(&doc, 0).unwrap();
+        assert_eq!(geometry.segments.len(), 6, "{paint}");
+        assert!(geometry.segments.contains(&[[10.0, 20.0], [0.0, 0.0]]), "{paint}");
+        assert!(geometry.segments.contains(&[[50.0, 20.0], [40.0, 0.0]]), "{paint}");
+    }
+    let stroked = fixture(&format!("{triangles} S"), "", &[]);
+    assert_eq!(snap::geometry(&stroked, 0).unwrap().segments.len(), 4);
+}
+
 #[test]
 fn nested_forms_transforms_curves_and_cycles_are_bounded() {
     let body = "0 0 m 10 0 l S 0 0 m 0 10 10 10 10 0 c S /Nested Do";
diff --git a/crates/measure/tests/snap_property.rs b/crates/measure/tests/snap_property.rs
new file mode 100644
index 00000000..a05b507a
--- /dev/null
+++ b/crates/measure/tests/snap_property.rs
@@ -0,0 +1,177 @@
+//! Deterministic property checks for `snap::geometry` and `Geometry::snap`: mutated synthetic
+//! content keeps extracted geometry bounded and finite, and snap queries return finite results.
+
+use std::sync::Arc;
+
+use pdfcraft_cos::Document;
+use pdfcraft_measure::snap::{self, Geometry, SnapOptions};
+
+const CASES: usize = 1_000;
+const SEED: u64 = 1;
+const MAX_CONTENT_BYTES: usize = 16 * 1024;
+const MAX_GEOMETRY_SEGMENTS: usize = 20_000;
+const MAX_SNAP_TARGETS: usize = 2 * MAX_GEOMETRY_SEGMENTS + 12;
+
+const SEEDS: &[&[u8]] = &[
+    b"0 0 m 100 100 l S",
+    b"q 1 0 0 1 10 20 cm 0 0 10 10 re S Q",
+    b"0 0 m 20 100 80 -100 100 0 c S",
+    b"1e308 1e308 m -1e308 -1e308 l S",
+    b"BI /W 1 /H 1 /BPC 8 /CS /RGB ID \x00\xff\x7f EI",
+    b"q q q Q Q cm m l c v y h re S n",
+];
+const TOKENS: &[&[u8]] = &[
+    b" m ",
+    b" l ",
+    b" c ",
+    b" v ",
+    b" y ",
+    b" re ",
+    b" S ",
+    b" f* ",
+    b" q Q ",
+    b" cm ",
+    b" Do ",
+    b" BI ID EI ",
+    b" 1e308 ",
+    b" -1e308 ",
+    b" /BadName ",
+    b" [1 2 (unterminated] ",
+];
+const DENSE_PATH: &[u8] = b"0 0 m 1 1 l S ";
+
+#[derive(Clone)]
+struct Rng(u64);
+
+impl Rng {
+    fn next(&mut self) -> u64 {
+        self.0 ^= self.0 >> 12;
+        self.0 ^= self.0 << 25;
+        self.0 ^= self.0 >> 27;
+        self.0.wrapping_mul(0x2545_F491_4F6C_DD1D)
+    }
+
+    fn below(&mut self, n: usize) -> usize {
+        if n == 0 { 0 } else { (self.next() % n as u64) as usize }
+    }
+}
+
+fn mutate(rng: &mut Rng, seed: &[u8]) -> Vec<u8> {
+    let mut data = seed.to_vec();
+    let rounds = 1 + rng.below(8);
+    for _ in 0..rounds {
+        if data.is_empty() {
+            data.extend_from_slice(b"0 0 m 10 10 l S");
+        }
+        let at = rng.below(data.len());
+        match rng.below(6) {
+            0 => data[at] ^= 1 << rng.below(8),
+            1 => {
+                let n = 1 + rng.below(64.min(data.len() - at));
+                data.drain(at..at + n);
+            }
+            2 => {
+                let token = TOKENS[rng.below(TOKENS.len())];
+                data.splice(at..at, token.iter().copied());
+            }
+            3 => {
+                let n = 1 + rng.below(128.min(data.len() - at));
+                let duplicate = data[at..at + n].to_vec();
+                let to = rng.below(data.len());
+                data.splice(to..to, duplicate);
+            }
+            4 => {
+                let byte = [rng.next() as u8];
+                data.splice(at..at, byte);
+            }
+            _ => {
+                let token = TOKENS[rng.below(TOKENS.len())];
+                let end = at.saturating_add(1).min(data.len());
+                data.splice(at..end, token.iter().copied());
+            }
+        }
+        data.truncate(MAX_CONTENT_BYTES);
+    }
+    data
+}
+
+fn one_page_pdf(content: &[u8]) -> Vec<u8> {
+    let stream = format!("<< /Length {} >>\nstream\n", content.len());
+    let objects = [
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 612 792] >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /Contents 4 0 R /Resources << >> >>".to_vec(),
+        {
+            let mut object = stream.into_bytes();
+            object.extend_from_slice(content);
+            object.extend_from_slice(b"\nendstream");
+            object
+        },
+    ];
+    let mut bytes = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::with_capacity(objects.len());
+    for (index, object) in objects.iter().enumerate() {
+        offsets.push(bytes.len());
+        bytes.extend_from_slice(format!("{} 0 obj\n", index + 1).as_bytes());
+        bytes.extend_from_slice(object);
+        bytes.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = bytes.len();
+    bytes.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objects.len() + 1).as_bytes());
+    for offset in offsets {
+        bytes.extend_from_slice(format!("{offset:010} 00000 n \n").as_bytes());
+    }
+    bytes.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objects.len() + 1).as_bytes());
+    bytes
+}
+
+fn finite(point: [f64; 2]) -> bool {
+    point.into_iter().all(f64::is_finite)
+}
+
+fn geometry_of(content: &[u8]) -> Geometry {
+    let doc = Document::open(Arc::new(one_page_pdf(content))).unwrap();
+    snap::geometry(&doc, 0).unwrap()
+}
+
+/// Checks the bounds and finiteness that snapping relies on, and returns the extracted geometry.
+fn check_snap_invariants(content: &[u8]) -> Geometry {
+    assert!(content.len() <= MAX_CONTENT_BYTES, "generated content exceeded the byte cap");
+    let geometry = geometry_of(content);
+    assert!(geometry.segments.len() <= MAX_GEOMETRY_SEGMENTS, "geometry exceeded the segment cap: {}", geometry.segments.len());
+    assert!(geometry.endpoints.len().saturating_add(geometry.midpoints.len()) <= MAX_SNAP_TARGETS, "geometry exceeded the snap-target cap");
+    assert!(geometry.segments.iter().flatten().copied().all(finite), "geometry contains a non-finite segment coordinate");
+    assert!(geometry.endpoints.iter().copied().all(finite), "geometry contains a non-finite endpoint");
+    assert!(geometry.midpoints.iter().copied().all(finite), "geometry contains a non-finite midpoint");
+
+    geometry.intersection_limited([0.0, 0.0], 10_000.0);
+    let snap = geometry.snap([0.0, 0.0], 10_000.0, SnapOptions::default()).unwrap();
+    if let Some(hit) = snap {
+        assert!(finite(hit.point) && hit.distance.is_finite(), "snap result contains a non-finite value");
+    }
+    geometry
+}
+
+#[test]
+fn mutated_snap_geometry_stays_bounded_and_finite() {
+    let mut seeds: Vec<Vec<u8>> = SEEDS.iter().map(|seed| seed.to_vec()).collect();
+    let mut dense = Vec::with_capacity(MAX_CONTENT_BYTES);
+    while dense.len().saturating_add(DENSE_PATH.len()) <= MAX_CONTENT_BYTES {
+        dense.extend_from_slice(DENSE_PATH);
+    }
+    seeds.push(dense);
+
+    let mut rng = Rng(SEED);
+    for _ in 0..CASES {
+        let seed_index = rng.below(seeds.len());
+        let content = mutate(&mut rng, &seeds[seed_index]);
+        check_snap_invariants(&content);
+    }
+}
+
+#[test]
+fn high_curvature_geometry_hits_segment_cap() {
+    let stress_curve = b"0 0 m 0 100000000 100000000 100000000 100000000 0 c S ".repeat(6);
+    let geometry = check_snap_invariants(&stress_curve);
+    assert!(geometry.truncated, "high-curvature geometry did not report its extraction cap ({} segments)", geometry.segments.len());
+}
diff --git a/crates/optimize/README.md b/crates/optimize/README.md
index 87d06128..7c1c8187 100644
--- a/crates/optimize/README.md
+++ b/crates/optimize/README.md
@@ -16,7 +16,9 @@ let report = optimize_with_progress(&mut doc, &settings, &mut |stage| keep_going
   An image is replaced only if the result is smaller. Left alone: CMYK and other colour spaces,
   image masks, decode arrays, more than 8 bits, JPEG 2000, JBIG2 and CCITT.
 - **Discard objects:** thumbnails, alternate images, document tags, print settings.
-- **Clean up:** Flate for streams with no filter.
+- **Clean up:** Flate for streams with no filter; for streams with an outer ASCII85 or ASCIIHex
+  layer, that layer is removed when the result is smaller (the inner filters keep their encoded
+  bytes). Streams with `/DecodeParms`, images and object streams are left alone.
 
 The engine runs Remove Hidden Information (`pdfcraft-redact`) for the user-data categories,
 then this, then merges identical objects and writes a full, compressed save
diff --git a/crates/optimize/src/lib.rs b/crates/optimize/src/lib.rs
index 5ebd006c..7cfcb09c 100644
--- a/crates/optimize/src/lib.rs
+++ b/crates/optimize/src/lib.rs
@@ -10,7 +10,8 @@
 //! - **Discard objects:** page thumbnails, alternate images, document tags (structure tree),
 //!   print settings.
 //! - **Clean up:** drop images and forms that pages list but never draw (such as a deleted
-//!   image); Flate-compress streams that have no filter.
+//!   image); Flate-compress streams that have no filter; remove a redundant outer ASCII85 or
+//!   ASCIIHex layer from streams that have one.
 //!
 //! Metadata, attachments, comments, scripts, private data, hidden layers, bookmarks and form
 //! fields are discarded by `pdfcraft-redact`'s Remove Hidden Information, which the engine
@@ -25,7 +26,7 @@ mod unused;
 
 pub use audit::{SpaceCategory, SpaceUse, audit_space};
 
-use pdfcraft_cos::{Document, ObjRef, Object, Stream};
+use pdfcraft_cos::{Document, ObjRef, Object, Stream, serialize};
 
 pub use images::effective_resolutions;
 
@@ -84,7 +85,8 @@ pub struct Settings {
     pub discard_alternate_images: bool,
     pub discard_tags: bool,
     pub discard_print_settings: bool,
-    /// Flate-compress streams stored without a filter.
+    /// Flate-compress streams stored without a filter, and strip a redundant outer ASCII85 or
+    /// ASCIIHex layer from streams that have one.
     pub flate_unencoded: bool,
     /// Clean Up: remove links (and bookmark destinations) that point nowhere.
     pub remove_invalid_links: bool,
@@ -227,17 +229,53 @@ pub fn optimize_with_progress(doc: &mut Document, settings: &Settings, progress:
             let obj = doc.get(r);
             let Object::Stream(s) = &*obj else { continue };
             // XMP stays readable as plain text (PDF/A requires it); tiny streams don't gain.
-            if s.dict.contains(b"Filter") || s.dict.name(b"Type") == Some(b"Metadata") || s.dict.name(b"Type") == Some(b"XRef") || s.raw.len() < 64 {
+            if s.dict.name(b"Type") == Some(b"Metadata") || s.dict.name(b"Type") == Some(b"XRef") || s.raw.len() < 64 {
                 continue;
             }
-            let mut d = s.dict.clone();
-            d.remove(b"Length");
-            let packed = Stream::flate(d, &s.raw);
-            if packed.raw.len() < s.raw.len() {
-                doc.set(r, Object::Stream(packed));
+            let replacement = if s.dict.contains(b"Filter") {
+                strip_ascii_wrapper(s)
+            } else {
+                let mut d = s.dict.clone();
+                d.remove(b"Length");
+                let packed = Stream::flate(d, &s.raw);
+                (packed.raw.len() < s.raw.len()).then_some(packed)
+            };
+            if let Some(replacement) = replacement {
+                doc.set(r, Object::Stream(replacement));
                 report.streams_compressed += 1;
             }
         }
     }
     Ok(report)
 }
+
+/// `s` without its outer ASCII85 or ASCIIHex layer (`[/ASCII85Decode /FlateDecode]` becomes
+/// `[/FlateDecode]`), when that is smaller. Only the outer layer is decoded: strictly, and within
+/// the stored size, which ASCII text never falls below, so the inner encoded bytes stay exact.
+fn strip_ascii_wrapper(s: &Stream) -> Option<Stream> {
+    if s.dict.contains(b"DecodeParms") || s.dict.name(b"Type") == Some(b"ObjStm") || s.dict.name(b"Subtype") == Some(b"Image") {
+        return None;
+    }
+    let Some(Object::Array(filters)) = s.dict.get(b"Filter") else { return None };
+    let names = filters.iter().map(Object::as_name).collect::<Option<Vec<_>>>()?;
+    let (outer, inner) = names.split_first()?;
+    if !matches!(*outer, b"ASCII85Decode" | b"ASCIIHexDecode") || inner.is_empty() || inner.contains(&&b"Crypt"[..]) {
+        return None;
+    }
+    let data = s.decoded_first_filter_strict(s.raw.len()).ok()?;
+    let mut dict = s.dict.clone();
+    dict.remove(b"Length");
+    dict.set(b"Filter".to_vec(), Object::Array(inner.iter().map(|n| Object::Name(n.to_vec())).collect()));
+    let candidate = Stream::from_raw(dict, data);
+    (stored_len(&candidate)? < stored_len(s)?).then_some(candidate)
+}
+
+/// Bytes the stream object takes in the file: its dictionary with `/Length` set as the writer
+/// sets it, then its data.
+fn stored_len(s: &Stream) -> Option<usize> {
+    let mut dict = s.dict.clone();
+    dict.set(b"Length".to_vec(), Object::Int(i64::try_from(s.raw.len()).ok()?));
+    let mut out = Vec::new();
+    serialize(&Object::Dict(dict), &mut out);
+    out.len().checked_add(s.raw.len())
+}
diff --git a/crates/optimize/tests/optimize.rs b/crates/optimize/tests/optimize.rs
index ff4dc801..ac675a39 100644
--- a/crates/optimize/tests/optimize.rs
+++ b/crates/optimize/tests/optimize.rs
@@ -583,3 +583,107 @@ fn nothing_is_dropped_when_a_stream_cannot_be_checked() {
         assert_eq!(build(s), kept, "{dict:?}");
     }
 }
+
+/// `data` as ASCII85 text with the `~>` end marker, as ASCII85Decode reads it.
+fn ascii85(data: &[u8]) -> Vec<u8> {
+    let mut out = Vec::new();
+    for chunk in data.chunks(4) {
+        let mut word = [0u8; 4];
+        word[..chunk.len()].copy_from_slice(chunk);
+        let mut v = u32::from_be_bytes(word);
+        let mut digits = [0u8; 5];
+        for d in digits.iter_mut().rev() {
+            *d = (v % 85) as u8 + b'!';
+            v /= 85;
+        }
+        out.extend_from_slice(&digits[..chunk.len() + 1]);
+    }
+    out.extend_from_slice(b"~>");
+    out
+}
+
+/// `data` as hex digits with the `>` end marker, as ASCIIHexDecode reads it.
+fn ascii_hex(data: &[u8]) -> Vec<u8> {
+    let mut out: Vec<u8> = data.iter().flat_map(|b| format!("{b:02X}").into_bytes()).collect();
+    out.push(b'>');
+    out
+}
+
+fn filtered(names: &[&str], raw: Vec<u8>) -> Stream {
+    let mut d = Dict::new();
+    d.set(b"Filter".to_vec(), Object::Array(names.iter().map(|n| Object::name(n)).collect()));
+    Stream::from_raw(d, raw)
+}
+
+/// A one-page document whose page content is `content`, with the content's reference.
+fn with_content(content: Stream) -> (Document, ObjRef) {
+    let mut doc = Document::new_empty();
+    let pg = page(&mut doc, &[], "");
+    let c = doc.add(Object::Stream(content));
+    doc.update_dict(pg, |d| d.set(b"Contents".to_vec(), Object::Ref(c))).unwrap();
+    (doc, c)
+}
+
+fn vector_ops() -> Vec<u8> {
+    "0 0 m 612 792 l S\n".repeat(400).into_bytes()
+}
+
+#[test]
+fn ascii_wrappers_come_off_filtered_streams_and_the_inner_data_is_unchanged() {
+    let ops = vector_ops();
+    let inner = Stream::flate(Dict::new(), &ops).raw.to_vec();
+    for (outer, encoded) in [("ASCII85Decode", ascii85(&inner)), ("ASCIIHexDecode", ascii_hex(&inner))] {
+        let source = filtered(&[outer, "FlateDecode"], encoded);
+        let (mut doc, c) = with_content(source.clone());
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        assert_eq!(r.streams_compressed, 1, "{outer}");
+        let after = stream(&doc, c);
+        assert_eq!(after.dict.get(b"Filter"), Some(&Object::Array(vec![Object::name("FlateDecode")])), "{outer}");
+        assert_eq!(after.raw.to_vec(), inner, "{outer}: the inner Flate bytes are kept exactly");
+        assert_eq!(after.decoded_strict().unwrap(), ops, "{outer}");
+        assert!(after.raw.len() < source.raw.len(), "{outer}");
+    }
+}
+
+#[test]
+fn streams_the_wrapper_stripping_does_not_touch_stay_unchanged() {
+    let inner = Stream::flate(Dict::new(), &vector_ops()).raw.to_vec();
+    let wrapped = ascii85(&inner);
+    let mut with_parms = filtered(&["ASCII85Decode", "FlateDecode"], wrapped.clone());
+    with_parms.dict.set(b"DecodeParms".to_vec(), Object::Dict(Dict::new()));
+    let mut image = filtered(&["ASCII85Decode", "FlateDecode"], wrapped.clone());
+    image.dict.set(b"Subtype".to_vec(), Object::name("Image"));
+    let mut objstm = filtered(&["ASCII85Decode", "FlateDecode"], wrapped.clone());
+    objstm.dict.set(b"Type".to_vec(), Object::name("ObjStm"));
+    let mut metadata = filtered(&["ASCII85Decode", "FlateDecode"], wrapped.clone());
+    metadata.dict.set(b"Type".to_vec(), Object::name("Metadata"));
+    let cases = [
+        ("malformed ASCII85", filtered(&["ASCII85Decode", "FlateDecode"], b"{{ not ASCII85 ~>".to_vec())),
+        ("malformed ASCIIHex", filtered(&["ASCIIHexDecode", "FlateDecode"], b"G0>".to_vec())),
+        ("DecodeParms", with_parms),
+        ("single ASCII filter", filtered(&["ASCII85Decode"], wrapped.clone())),
+        ("image", image),
+        ("object stream", objstm),
+        ("metadata", metadata),
+        ("crypt after the wrapper", filtered(&["ASCII85Decode", "Crypt", "FlateDecode"], wrapped.clone())),
+        ("tiny", filtered(&["ASCII85Decode", "FlateDecode"], ascii85(b"ab"))),
+        ("single Flate", Stream::flate(Dict::new(), &vector_ops())),
+    ];
+    for (label, s) in cases {
+        let (mut doc, c) = with_content(s.clone());
+        let r = optimize(&mut doc, &Settings::default()).unwrap();
+        assert_eq!(r.streams_compressed, 0, "{label}");
+        assert_eq!(stream(&doc, c), s, "{label}");
+    }
+}
+
+#[test]
+fn a_second_run_leaves_the_stripped_stream_alone() {
+    let inner = Stream::flate(Dict::new(), &vector_ops()).raw.to_vec();
+    let (mut doc, c) = with_content(filtered(&["ASCII85Decode", "FlateDecode"], ascii85(&inner)));
+    optimize(&mut doc, &Settings::default()).unwrap();
+    let once = stream(&doc, c);
+    let r = optimize(&mut doc, &Settings::default()).unwrap();
+    assert_eq!(r.streams_compressed, 0);
+    assert_eq!(stream(&doc, c), once);
+}
diff --git a/crates/organize/src/import.rs b/crates/organize/src/import.rs
index b3342c9b..72e20103 100644
--- a/crates/organize/src/import.rs
+++ b/crates/organize/src/import.rs
@@ -486,7 +486,7 @@ pub fn extract_pages(src: &Document, pages: &[usize]) -> Result<Document, Organi
         }
     }
     // After the title: the XMP packet repeats it.
-    crate::pdfx::carry(&mut out, src, &crate::pdfx::PrintStandard::of(src), imported.objects)?;
+    crate::pdfx::carry(&mut out, Some(src), &crate::pdfx::PrintStandard::of(src), imported.objects)?;
     // The pages share their source's resource dictionary, so the part would otherwise carry every
     // XObject the source lists — images and all (#204). Keep only what these pages draw.
     crate::prune::prune_unused_xobjects(&mut out)?;
@@ -540,16 +540,54 @@ pub fn combine(sources: &[(&str, &Document)]) -> Result<Document, OrganizeError>
 /// Combine Files with chosen pages: each source contributes `pages` (0-based, in that order;
 /// `None` for all of them). Bookmarks that point at pages left out lose their destination.
 pub fn combine_selected(sources: &[(&str, &Document, Option<&[usize]>)]) -> Result<Document, OrganizeError> {
-    let mut out = Document::new_empty();
-    let mut marks = Vec::new();
-    let mut attachments = Vec::new();
-    // The first source's print standard, and what its pages brought along; it carries over
-    // only when every source declares the same one.
-    let mut standard: Option<(crate::pdfx::PrintStandard, &Document, HashMap<ObjRef, ObjRef>)> = None;
-    let mut agreed = true;
+    let mut combiner = Combiner::new();
     for (title, src, chosen) in sources {
+        combiner.add(title, src, *chosen)?;
+    }
+    combiner.finish()
+}
+
+/// Combine Files one source at a time, with the same result as [`combine_selected`]. [`Combiner::add`]
+/// copies a source's pages into the result and keeps only what the rest of the combine needs: its
+/// bookmarks (read and mapped to the copied pages), its attachments (copied), and its document only
+/// when it declares output intents. So each source can be dropped as soon as it is added, and a long
+/// list holds one source at a time rather than all of them.
+pub struct Combiner {
+    out: Document,
+    marks: Vec<Mark>,
+    attachments: Vec<(Vec<u8>, Object)>,
+    /// The first source's print standard, and what its pages brought along.
+    standard: Option<Standard>,
+    /// Whether every source so far declares the first source's print standard.
+    agreed: bool,
+}
+
+/// The first source's print standard (see [`Combiner`]).
+struct Standard {
+    declared: crate::pdfx::PrintStandard,
+    /// The source objects the copied pages brought along, and their copies.
+    objects: HashMap<ObjRef, ObjRef>,
+    /// The source itself, kept only for its output intents, which are copied from it.
+    source: Option<Document>,
+}
+
+impl Default for Combiner {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Combiner {
+    /// A combine with no sources yet.
+    pub fn new() -> Self {
+        Self { out: Document::new_empty(), marks: Vec::new(), attachments: Vec::new(), standard: None, agreed: true }
+    }
+
+    /// Add `src`'s `pages` (0-based, in that order; `None` for all of them) after the pages added so far,
+    /// under a bookmark titled `title`. `src` need not outlive the call.
+    pub fn add(&mut self, title: &str, src: &Document, pages: Option<&[usize]>) -> Result<(), OrganizeError> {
         let n = crate::page_count(src)?;
-        let pages: Vec<usize> = match chosen {
+        let pages: Vec<usize> = match pages {
             Some(p) => {
                 if let Some(bad) = p.iter().find(|i| **i >= n) {
                     return Err(OrganizeError::NoSuchPage(*bad));
@@ -558,27 +596,38 @@ pub fn combine_selected(sources: &[(&str, &Document, Option<&[usize]>)]) -> Resu
             }
             None => (0..n).collect(),
         };
-        let at = crate::page_count(&out)?;
-        let imported = import_pages_mapped(&mut out, src, &pages, at)?;
+        let at = crate::page_count(&self.out)?;
+        let imported = import_pages_mapped(&mut self.out, src, &pages, at)?;
         if let Some(first) = imported.pages.first() {
-            marks.push((title.to_string(), *first, *src, imported.page_map));
+            let outline = source_outline(src, imported.page_map);
+            self.marks.push(Mark { title: title.to_string(), page: *first, outline });
         }
-        collect_attachments(&mut out, src, &mut attachments);
+        collect_attachments(&mut self.out, src, &mut self.attachments);
         let declared = crate::pdfx::PrintStandard::of(src);
-        match &standard {
-            None => standard = Some((declared, *src, imported.objects)),
-            Some((first, _, _)) => agreed &= first.same_as(&declared),
+        match self.standard.as_ref().map(|first| first.declared.same_as(&declared)) {
+            Some(same) => self.agreed &= same,
+            None => {
+                let source = declared.declares_output_intents().then(|| src.clone());
+                self.standard = Some(Standard { declared, objects: imported.objects, source });
+            }
         }
+        Ok(())
     }
-    if let Some((declared, src, objects)) = standard.filter(|_| agreed) {
-        crate::pdfx::carry(&mut out, src, &declared, objects)?;
+
+    /// The combined document: the pages as added, the print standard of the first source when every
+    /// source declares the same one, shared resources stored once, then the bookmarks and attachments.
+    pub fn finish(self) -> Result<Document, OrganizeError> {
+        let Combiner { mut out, marks, attachments, standard, agreed } = self;
+        if let Some(first) = standard.filter(|_| agreed) {
+            crate::pdfx::carry(&mut out, first.source.as_ref(), &first.declared, first.objects)?;
+        }
+        // Sources often share fonts, images and profiles (or are the same file): store them once.
+        let all: Vec<ObjRef> = out.object_numbers().into_iter().map(|n| ObjRef::new(n, out.generation(n))).collect();
+        crate::dedupe::dedupe_resources(&mut out, &all, false);
+        add_outline(&mut out, &marks)?;
+        set_attachments(&mut out, attachments)?;
+        Ok(out)
     }
-    // Sources often share fonts, images and profiles (or are the same file): store them once.
-    let all: Vec<ObjRef> = out.object_numbers().into_iter().map(|n| ObjRef::new(n, out.generation(n))).collect();
-    crate::dedupe::dedupe_resources(&mut out, &all, false);
-    add_outline(&mut out, &marks)?;
-    set_attachments(&mut out, attachments)?;
-    Ok(out)
 }
 
 /// One run of pages for [`combine_grouped`]: the file it comes from (`group`: runs with the same
@@ -633,7 +682,7 @@ pub fn combine_grouped(runs: &[Run<'_>]) -> Result<Document, OrganizeError> {
         let imported = import_pages_mapped(&mut out, file.src, &file.pages, at)?;
         copies.push(imported.pages.clone());
         if let Some(first) = imported.pages.first() {
-            marks.push((file.title.to_string(), *first, file.src, imported.page_map));
+            marks.push(Mark { title: file.title.to_string(), page: *first, outline: source_outline(file.src, imported.page_map) });
         }
         collect_attachments(&mut out, file.src, &mut attachments);
         let declared = crate::pdfx::PrintStandard::of(file.src);
@@ -651,7 +700,7 @@ pub fn combine_grouped(runs: &[Run<'_>]) -> Result<Document, OrganizeError> {
     }
     rebuild(&mut out, &order)?;
     if let Some((declared, src, objects)) = standard.filter(|_| agreed) {
-        crate::pdfx::carry(&mut out, src, &declared, objects)?;
+        crate::pdfx::carry(&mut out, Some(src), &declared, objects)?;
     }
     let all: Vec<ObjRef> = out.object_numbers().into_iter().map(|n| ObjRef::new(n, out.generation(n))).collect();
     crate::dedupe::dedupe_resources(&mut out, &all, false);
@@ -714,36 +763,132 @@ fn set_attachments(dst: &mut Document, mut entries: Vec<(Vec<u8>, Object)>) -> R
     Ok(())
 }
 
-type Mark<'a> = (String, ObjRef, &'a Document, HashMap<ObjRef, ObjRef>);
+/// A source's entry in the combined outline (see [`add_outline`]): its title, its first page in the
+/// result, and its own bookmarks, read from the source when it was added.
+struct Mark {
+    title: String,
+    page: ObjRef,
+    outline: Vec<OutlineNode>,
+}
 
-/// Replace the outline with one bookmark per source (title → its first page), each holding a
-/// collapsed copy of that source's own bookmarks with destinations mapped to the copied pages.
-fn add_outline(doc: &mut Document, marks: &[Mark<'_>]) -> Result<(), OrganizeError> {
+/// One of a source's bookmarks, read and ready to write: its title, colour and flags, its destination
+/// in the result (`None` when the page it points at was not copied), whether it is open, and its own
+/// bookmarks.
+struct OutlineNode {
+    title: Option<Object>,
+    colour: Option<Object>,
+    flags: Option<Object>,
+    dest: Option<Object>,
+    open: bool,
+    children: Vec<OutlineNode>,
+}
+
+/// The bookmarks of `src`, with destinations mapped through `pages` (source page to copied page). They
+/// are read while `src` is at hand, so the source itself need not be kept.
+fn source_outline(src: &Document, pages: HashMap<ObjRef, ObjRef>) -> Vec<OutlineNode> {
+    let first = src
+        .root()
+        .and_then(|r| src.get(r).as_dict().cloned())
+        .and_then(|c| c.get(b"Outlines").map(|o| src.resolve(o)))
+        .and_then(|o| o.as_dict().and_then(|d| d.reference(b"First")));
+    let mapper = Copier { src, map: HashMap::new(), pages, annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() };
+    let mut budget = 10_000usize;
+    outline_level(&mapper, first, 0, &mut budget)
+}
+
+/// One level of bookmarks from `first` (its siblings), each with its children. Cycle- and size-safe:
+/// at most `budget` bookmarks are read in all, and nesting stops at 32 levels.
+fn outline_level(m: &Copier<'_>, first: Option<ObjRef>, depth: u8, budget: &mut usize) -> Vec<OutlineNode> {
+    if depth > 32 {
+        return Vec::new();
+    }
+    let mut seen = std::collections::HashSet::new();
+    let mut made = Vec::new();
+    let mut cur = first;
+    while let Some(r) = cur {
+        if !seen.insert(r) || *budget == 0 {
+            break;
+        }
+        *budget -= 1;
+        let Some(item) = m.src.get(r).as_dict().cloned() else { break };
+        cur = item.reference(b"Next");
+        let title = item.get(b"Title").map(|t| m.src.resolve(t).as_ref().clone());
+        let colour = item.get(b"C").map(|v| m.src.resolve(v).as_ref().clone());
+        let flags = item.get(b"F").map(|v| m.src.resolve(v).as_ref().clone());
+        let target = item.get(b"Dest").cloned().or_else(|| {
+            let a = m.src.resolve(item.get(b"A")?);
+            let a = a.as_dict()?;
+            (a.name(b"S") == Some(b"GoTo")).then(|| a.get(b"D").cloned()).flatten()
+        });
+        let dest = target.and_then(|t| m.map_dest(&t));
+        let open = item.int(b"Count").is_some_and(|c| c > 0);
+        let children = outline_level(m, item.reference(b"First"), depth + 1, budget);
+        made.push(OutlineNode { title, colour, flags, dest, open, children });
+    }
+    made
+}
+
+/// Write `nodes` as one level under `parent`: each bookmark is created, then its children, depth first
+/// and in order, so the object numbers come out as they always did. Returns the level's first and last
+/// item and how many items it has (`None` when it is empty).
+fn write_outline_level(dst: &mut Document, parent: ObjRef, nodes: &[OutlineNode]) -> Result<Option<(ObjRef, ObjRef, usize)>, OrganizeError> {
+    let mut made: Vec<ObjRef> = Vec::new();
+    for node in nodes {
+        let new = dst.add(Object::Null);
+        let mut d = Dict::new();
+        if let Some(t) = &node.title {
+            d.set(b"Title".to_vec(), t.clone());
+        }
+        if let Some(c) = &node.colour {
+            d.set(b"C".to_vec(), c.clone());
+        }
+        if let Some(f) = &node.flags {
+            d.set(b"F".to_vec(), f.clone());
+        }
+        if let Some(dest) = &node.dest {
+            d.set(b"Dest".to_vec(), dest.clone());
+        }
+        d.set(b"Parent".to_vec(), Object::Ref(parent));
+        if let Some(prev) = made.last() {
+            d.set(b"Prev".to_vec(), Object::Ref(*prev));
+            dst.update_dict(*prev, |p| p.set(b"Next".to_vec(), Object::Ref(new)))?;
+        }
+        if let Some((f, l, n)) = write_outline_level(dst, new, &node.children)? {
+            d.set(b"First".to_vec(), Object::Ref(f));
+            d.set(b"Last".to_vec(), Object::Ref(l));
+            // Keep the source's open/closed state.
+            d.set(b"Count".to_vec(), Object::Int(if node.open { n as i64 } else { -(n as i64) }));
+        }
+        dst.set(new, Object::Dict(d));
+        made.push(new);
+    }
+    Ok(match (made.first(), made.last()) {
+        (Some(first), Some(last)) => Some((*first, *last, made.len())),
+        _ => None,
+    })
+}
+
+/// Replace the outline with one bookmark per source (title → its first page), each holding a collapsed
+/// copy of that source's own bookmarks with destinations mapped to the copied pages.
+fn add_outline(doc: &mut Document, marks: &[Mark]) -> Result<(), OrganizeError> {
     if marks.is_empty() {
         return Ok(());
     }
     let outlines = doc.add(Object::Null);
     let items: Vec<ObjRef> = marks.iter().map(|_| doc.add(Object::Null)).collect();
     let (Some(&first_item), Some(&last_item)) = (items.first(), items.last()) else { return Ok(()) };
-    for (i, ((title, page, src, page_map), r)) in marks.iter().zip(&items).enumerate() {
+    for (i, (mark, r)) in marks.iter().zip(&items).enumerate() {
         let mut d = Dict::new();
-        d.set(b"Title".to_vec(), Object::String(pdfcraft_cos::PdfString::text(title)));
+        d.set(b"Title".to_vec(), Object::String(pdfcraft_cos::PdfString::text(&mark.title)));
         d.set(b"Parent".to_vec(), Object::Ref(outlines));
-        d.set(b"Dest".to_vec(), Object::Array(vec![Object::Ref(*page), Object::name("Fit")]));
+        d.set(b"Dest".to_vec(), Object::Array(vec![Object::Ref(mark.page), Object::name("Fit")]));
         if i > 0 {
             d.set(b"Prev".to_vec(), Object::Ref(items[i - 1]));
         }
         if let Some(next) = items.get(i + 1) {
             d.set(b"Next".to_vec(), Object::Ref(*next));
         }
-        let first = src
-            .root()
-            .and_then(|r| src.get(r).as_dict().cloned())
-            .and_then(|c| c.get(b"Outlines").map(|o| src.resolve(o)))
-            .and_then(|o| o.as_dict().and_then(|d| d.reference(b"First")));
-        let mapper = Copier { src, map: HashMap::new(), pages: page_map.clone(), annots: Vec::new(), fields: Vec::new(), ocgs: Vec::new() };
-        let mut budget = 10_000usize;
-        if let Some((f, l, n)) = copy_outline_level(doc, &mapper, first, *r, 0, &mut budget) {
+        if let Some((f, l, n)) = write_outline_level(doc, *r, &mark.outline)? {
             d.set(b"First".to_vec(), Object::Ref(f));
             d.set(b"Last".to_vec(), Object::Ref(l));
             d.set(b"Count".to_vec(), Object::Int(-(n as i64))); // collapsed
@@ -764,67 +909,6 @@ fn add_outline(doc: &mut Document, marks: &[Mark<'_>]) -> Result<(), OrganizeErr
     Ok(())
 }
 
-/// Copy one level of a source outline (siblings from `first`) under `parent`, recursing into
-/// children. Returns (first, last, visible count). Cycle- and size-safe.
-fn copy_outline_level(
-    dst: &mut Document,
-    m: &Copier<'_>,
-    first: Option<ObjRef>,
-    parent: ObjRef,
-    depth: u8,
-    budget: &mut usize,
-) -> Option<(ObjRef, ObjRef, usize)> {
-    if depth > 32 {
-        return None;
-    }
-    let mut seen = std::collections::HashSet::new();
-    let mut made: Vec<ObjRef> = Vec::new();
-    let mut total = 0;
-    let mut cur = first;
-    while let Some(r) = cur {
-        if !seen.insert(r) || *budget == 0 {
-            break;
-        }
-        *budget -= 1;
-        let Some(item) = m.src.get(r).as_dict().cloned() else { break };
-        cur = item.reference(b"Next");
-        let new = dst.add(Object::Null);
-        let mut d = Dict::new();
-        if let Some(t) = item.get(b"Title").map(|t| m.src.resolve(t)) {
-            d.set(b"Title".to_vec(), t.as_ref().clone());
-        }
-        for k in [&b"C"[..], b"F"] {
-            if let Some(v) = item.get(k) {
-                d.set(k.to_vec(), m.src.resolve(v).as_ref().clone());
-            }
-        }
-        let target = item.get(b"Dest").cloned().or_else(|| {
-            let a = m.src.resolve(item.get(b"A")?);
-            let a = a.as_dict()?;
-            (a.name(b"S") == Some(b"GoTo")).then(|| a.get(b"D").cloned()).flatten()
-        });
-        if let Some(dest) = target.and_then(|t| m.map_dest(&t)) {
-            d.set(b"Dest".to_vec(), dest);
-        }
-        d.set(b"Parent".to_vec(), Object::Ref(parent));
-        if let Some(prev) = made.last() {
-            d.set(b"Prev".to_vec(), Object::Ref(*prev));
-            dst.update_dict(*prev, |p| p.set(b"Next".to_vec(), Object::Ref(new))).ok()?;
-        }
-        if let Some((f, l, n)) = copy_outline_level(dst, m, item.reference(b"First"), new, depth + 1, budget) {
-            d.set(b"First".to_vec(), Object::Ref(f));
-            d.set(b"Last".to_vec(), Object::Ref(l));
-            // Keep the source's open/closed state.
-            let open = item.int(b"Count").is_some_and(|c| c > 0);
-            d.set(b"Count".to_vec(), Object::Int(if open { n as i64 } else { -(n as i64) }));
-        }
-        dst.set(new, Object::Dict(d));
-        made.push(new);
-        total += 1;
-    }
-    Some((*made.first()?, *made.last()?, total))
-}
-
 /// Page `page` of `src` as a form XObject in `dst` (its content and resources, no annotations),
 /// for backgrounds and watermarks taken from a PDF. The form's `/BBox` is the page's crop box
 /// and its `/Matrix` undoes the page rotation, so it draws upright as displayed. Returns the
diff --git a/crates/organize/src/lib.rs b/crates/organize/src/lib.rs
index 3c6bf759..c7ac3c86 100644
--- a/crates/organize/src/lib.rs
+++ b/crates/organize/src/lib.rs
@@ -24,7 +24,9 @@ pub mod view;
 
 pub use boxes::{BoxSpec, PageBox, page_boxes, set_page_box};
 pub use dedupe::dedupe_resources;
-pub use import::{Run, SplitBy, combine, combine_grouped, combine_selected, extract_pages, import_pages, page_as_form, split, split_ranges};
+pub use import::{
+    Combiner, Run, SplitBy, combine, combine_grouped, combine_selected, extract_pages, import_pages, page_as_form, split, split_ranges,
+};
 pub use labels::{LabelRange, LabelStyle, PageLabels, number_pages, page_label_ranges, page_labels, set_page_label_ranges};
 pub use outline::{
     Bookmark, BookmarkPage, OutlineEntry, OutlineError, add_bookmark, add_bookmark_tree, bookmark_page, bookmarks, delete_bookmark, move_bookmark,
@@ -274,7 +276,8 @@ fn drop_named_destinations(doc: &mut Document, gone: &[ObjRef]) -> Result<Vec<Ve
             }
         }
         Some(Object::Dict(mut d)) => {
-            if prune_legacy(doc, &mut d, gone, &mut dead) {
+            let changed = prune_legacy(doc, &mut d, gone, &mut dead);
+            if changed {
                 doc.update_dict(root, |c| c.set(b"Dests".to_vec(), Object::Dict(d)))?;
             }
         }
diff --git a/crates/organize/src/pdfx.rs b/crates/organize/src/pdfx.rs
index a24b5a3a..3241d430 100644
--- a/crates/organize/src/pdfx.rs
+++ b/crates/organize/src/pdfx.rs
@@ -73,6 +73,11 @@ impl PrintStandard {
         }
     }
 
+    /// Whether the document declares output intents (its printing condition and profile).
+    pub(crate) fn declares_output_intents(&self) -> bool {
+        self.intents.is_some()
+    }
+
     /// Whether `other` declares the same standard: the same version and trapping, and the same
     /// output intents (type, printing condition and profile).
     pub(crate) fn same_as(&self, other: &Self) -> bool {
@@ -82,10 +87,12 @@ impl PrintStandard {
 
 /// Give `dst` the print standard `src` declares: its output intents, copied with their profiles
 /// (through `map`, what the pages already brought along), and, for PDF/X, the document
-/// information entries and the XMP metadata that identify it.
-pub(crate) fn carry(dst: &mut Document, src: &Document, standard: &PrintStandard, map: HashMap<ObjRef, ObjRef>) -> Result<(), OrganizeError> {
+/// information entries and the XMP metadata that identify it. The output intents are copied from
+/// `src`, so a standard that declares them needs the source document (`None` otherwise).
+pub(crate) fn carry(dst: &mut Document, src: Option<&Document>, standard: &PrintStandard, map: HashMap<ObjRef, ObjRef>) -> Result<(), OrganizeError> {
     let root = dst.root().ok_or(OrganizeError::NoPageTree)?;
     if let Some(intents) = &standard.intents {
+        let src = src.ok_or_else(|| OrganizeError::Invalid("the output intents' source document was not kept".into()))?;
         let copied = crate::import::copy_object(dst, src, intents, map);
         dst.update_dict(root, |c| c.set(b"OutputIntents".to_vec(), copied))?;
     }
diff --git a/crates/organize/src/tests.rs b/crates/organize/src/tests.rs
index c6d5b839..50f35ebe 100644
--- a/crates/organize/src/tests.rs
+++ b/crates/organize/src/tests.rs
@@ -416,6 +416,41 @@ fn combine_concatenates_with_a_bookmark_per_file() {
     assert_eq!(dest_page, pages(&out).unwrap()[3].obj);
 }
 
+#[test]
+fn combiner_adds_each_source_then_releases_it() {
+    let bytes = Arc::new(fixture());
+    let src = Document::open(bytes.clone()).unwrap();
+    let mut combiner = crate::Combiner::new();
+    combiner.add("A", &src, None).unwrap();
+    drop(src);
+    // No output intents to copy, so the combine keeps nothing of the source's file.
+    assert_eq!(Arc::strong_count(&bytes), 1);
+    let picked: &[usize] = &[1];
+    combiner.add("B", &open(fixture()), Some(picked)).unwrap();
+    let streamed = combiner.finish().unwrap();
+    let whole = combine_selected(&[("A", &open(fixture()), None), ("B", &open(fixture()), Some(picked))]).unwrap();
+    assert_eq!(write_full(&streamed, &SaveOptions::default()).unwrap(), write_full(&whole, &SaveOptions::default()).unwrap());
+}
+
+#[test]
+fn combining_hostile_outlines_ends_their_runs_too() {
+    // The bookmark cases of `hostile_outlines_end_their_runs_and_never_loop`, combined: each run ends
+    // where it would repeat, and the source's bookmarks sit under its own entry.
+    let cases: [(&[&str], &str); 3] = [
+        (&["<< /Title (Self) /Parent 3 0 R /Next 5 0 R >>"], "H[Self]"),
+        (&["<< /Title (A) /Parent 3 0 R /Next 6 0 R >>", "<< /Title (B) /Parent 3 0 R /Next 5 0 R >>"], "H[A,B]"),
+        (&["<< /Title (A) /Parent 3 0 R /Next 99 0 R >>"], "H[A]"),
+    ];
+    for (items, listed) in cases {
+        let out = full_roundtrip(&combine(&[("H", &outline_with(items))]).unwrap());
+        assert_eq!(titles(&crate::bookmarks(&out)), [listed]);
+    }
+    // A bookmark whose first child is itself: nesting is cut off, so the combine still ends.
+    let looped = outline_with(&["<< /Title (Self) /Parent 3 0 R /First 5 0 R >>"]);
+    let out = full_roundtrip(&combine(&[("H", &looped)]).unwrap());
+    assert_eq!(crate::bookmarks(&out).first().map(|b| b.title.as_str()), Some("H"));
+}
+
 #[test]
 fn inherited_attributes_travel_with_copied_pages() {
     let out = full_roundtrip(&extract_pages(&doc_b(), &[1]).unwrap());
diff --git a/crates/platform/Cargo.toml b/crates/platform/Cargo.toml
index d3644b91..cbae93fc 100644
--- a/crates/platform/Cargo.toml
+++ b/crates/platform/Cargo.toml
@@ -11,7 +11,14 @@ workspace = true
 [dependencies]
 
 [target.'cfg(target_os = "linux")'.dependencies]
-# The desktop's light/dark choice (see `desktop_theme.rs`). Already in the tree, with the features
-# this needs, through accesskit's accessibility bus; pinned to the same version so nothing is
-# built twice.
-zbus = "=5.19.0"
+# Already in the dependency graph through the accessibility integration. The portal watcher
+# uses the async API so dropping it can cancel an idle subscription without polling.
+zbus = { version = "=5.19.0", default-features = false, features = ["async-io"] }
+async-channel = "2"
+futures-lite = "2"
+
+[dev-dependencies]
+# Exercise the actual portal wire decoder and cancellable worker on every native test host.
+zbus = { version = "=5.19.0", default-features = false, features = ["async-io"] }
+async-channel = "2"
+futures-lite = "2"
diff --git a/crates/platform/src/desktop_theme.rs b/crates/platform/src/desktop_theme.rs
index 9b88f9ef..c0f89f74 100644
--- a/crates/platform/src/desktop_theme.rs
+++ b/crates/platform/src/desktop_theme.rs
@@ -1,136 +1,550 @@
-//! The desktop's own light/dark choice, for an interface setting that follows it.
+//! Linux desktop appearance through the XDG Settings portal. Other platforms use native window
+//! events. No desktop polling or UI dependency is needed here.
 //!
-//! winit reports no system theme on Linux — `ActiveEventLoop::system_theme` is `None` on every
-//! desktop there — so "Use system setting" has to ask the desktop itself. The XDG Desktop Portal's
-//! Settings interface answers on GNOME, KDE and XFCE alike, over X11 and Wayland alike.
+//! Protocol reference: <https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Settings.html>.
 
-use std::sync::mpsc::{Receiver, TryRecvError, channel};
-use std::time::Duration;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, AtomicU8, Ordering};
 
-/// How often [`DesktopTheme::start`] re-reads the desktop's answer. The portal also publishes a
-/// change signal, but subscribing needs a connection kept alive for the life of every window; one
-/// round trip every few seconds is cheap and reacts soon enough after a theme switch.
-const POLL: Duration = Duration::from_secs(4);
-
-/// Whether the desktop asks applications to draw dark. `None` when it says nothing, and when
-/// there is no session bus or no portal to ask (a bare X server, a container), so the caller
-/// keeps whatever it chose itself.
-pub fn prefers_dark() -> Option<bool> {
-    read()
+/// A concrete appearance requested by the desktop. An absent value means no preference or no
+/// available appearance source; the UI owns its fallback and its saved manual choice.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum DesktopAppearance {
+    Light,
+    Dark,
 }
 
-/// Watches the desktop and reports its choice when it changes. [`prefers_dark`] covers the
-/// answer at start-up; this covers the user switching theme while the app runs.
-#[derive(Default)]
+struct Shared {
+    appearance: AtomicU8,
+    #[cfg(any(target_os = "linux", test))]
+    published: AtomicBool,
+    active: AtomicBool,
+    #[cfg(any(target_os = "linux", test))]
+    wake: Box<dyn Fn() + Send + Sync>,
+}
+
+impl Shared {
+    fn new(wake: impl Fn() + Send + Sync + 'static) -> Self {
+        #[cfg(not(any(target_os = "linux", test)))]
+        let _ = wake;
+        Self {
+            appearance: AtomicU8::new(0),
+            #[cfg(any(target_os = "linux", test))]
+            published: AtomicBool::new(false),
+            active: AtomicBool::new(true),
+            #[cfg(any(target_os = "linux", test))]
+            wake: Box::new(wake),
+        }
+    }
+
+    fn get(&self) -> Option<DesktopAppearance> {
+        match self.appearance.load(Ordering::Acquire) {
+            1 => Some(DesktopAppearance::Dark),
+            2 => Some(DesktopAppearance::Light),
+            _ => None,
+        }
+    }
+
+    #[cfg(any(target_os = "linux", test))]
+    fn publish(&self, appearance: Option<DesktopAppearance>) {
+        let encoded = match appearance {
+            Some(DesktopAppearance::Dark) => 1,
+            Some(DesktopAppearance::Light) => 2,
+            None => 0,
+        };
+        let changed = self.appearance.swap(encoded, Ordering::AcqRel) != encoded;
+        let first = !self.published.swap(true, Ordering::AcqRel);
+        // Publish before waking: an otherwise idle UI must see the new answer on its next frame.
+        if (first || changed) && self.active.load(Ordering::Acquire) {
+            (self.wake)();
+        }
+    }
+}
+
+/// An event-driven appearance cache. Start when System is first selected and keep it alive while
+/// the window exists. Manual modes can suppress wakeups while preserving the latest desktop value.
 pub struct DesktopTheme {
-    /// `None` when no watcher thread could be started; the one-shot read still works.
-    changes: Option<Receiver<Option<bool>>>,
+    shared: Arc<Shared>,
+    #[cfg(any(target_os = "linux", test))]
+    stop: Option<async_channel::Sender<()>>,
+    #[cfg(any(target_os = "linux", test))]
+    worker: Option<std::thread::JoinHandle<()>>,
 }
 
 impl DesktopTheme {
-    /// Start watching. Nothing runs before this is called, and calling it once is enough. The
-    /// first answer is sent straight away, so the caller does not have to ask for it separately.
-    pub fn start() -> Self {
-        let (tx, rx) = channel();
-        let started = std::thread::Builder::new().name("pdfcraft-desktop-theme".into()).spawn(move || {
-            let mut last = read();
-            if tx.send(last).is_err() {
-                return;
+    /// Start a Linux portal subscription off the UI thread. The first answer and subsequent
+    /// changes call `wake` while active. Missing services and thread-start failure yield `None`.
+    /// On other platforms this is inert because the window integration owns appearance events.
+    pub fn start(wake: impl Fn() + Send + Sync + 'static) -> Self {
+        #[cfg(target_os = "linux")]
+        {
+            Self::spawn(wake, portal::watch)
+        }
+        #[cfg(not(target_os = "linux"))]
+        {
+            Self {
+                shared: Arc::new(Shared::new(wake)),
+                #[cfg(test)]
+                stop: None,
+                #[cfg(test)]
+                worker: None,
             }
-            loop {
-                std::thread::sleep(POLL);
-                let now = read();
-                if now != last {
-                    last = now;
-                    if tx.send(now).is_err() {
-                        return;
-                    }
+        }
+    }
+
+    /// Get the latest desktop answer without blocking or making a D-Bus call.
+    pub fn get(&self) -> Option<DesktopAppearance> {
+        self.shared.get()
+    }
+
+    /// Allow UI wakeups only while following the desktop. Events still update the cache in
+    /// manual mode, so selecting System again can immediately resolve the current appearance.
+    pub fn set_active(&self, active: bool) {
+        self.shared.active.store(active, Ordering::Release);
+    }
+
+    #[cfg(any(target_os = "linux", test))]
+    fn spawn<F, T>(wake: impl Fn() + Send + Sync + 'static, task: T) -> Self
+    where
+        F: std::future::Future<Output = ()> + 'static,
+        T: FnOnce(Arc<Shared>) -> F + Send + 'static,
+    {
+        let shared = Arc::new(Shared::new(wake));
+        let thread_shared = Arc::clone(&shared);
+        let (stop, stopped) = async_channel::bounded::<()>(1);
+        let worker = std::thread::Builder::new().name("pdfcraft-desktop-theme".into()).spawn(move || {
+            futures_lite::future::block_on(futures_lite::future::race(
+                async {
+                    let _ = stopped.recv().await;
+                },
+                task(thread_shared),
+            ));
+        });
+        Self { shared, stop: Some(stop), worker: worker.ok() }
+    }
+}
+
+impl Drop for DesktopTheme {
+    fn drop(&mut self) {
+        self.set_active(false);
+        #[cfg(any(target_os = "linux", test))]
+        {
+            if let Some(stop) = self.stop.take() {
+                stop.close();
+            }
+            if let Some(worker) = self.worker.take() {
+                // Cancellation also interrupts connection setup, the initial read, and idle waits.
+                // A worker panic does not propagate into the window or its open document.
+                let _ = worker.join();
+            }
+        }
+    }
+}
+
+#[cfg(any(target_os = "linux", test))]
+mod portal {
+    use super::{DesktopAppearance, Shared};
+    use futures_lite::StreamExt;
+    use std::sync::Arc;
+    use zbus::zvariant::{OwnedValue, Value};
+
+    const DESTINATION: &str = "org.freedesktop.portal.Desktop";
+    const PATH: &str = "/org/freedesktop/portal/desktop";
+    const INTERFACE: &str = "org.freedesktop.portal.Settings";
+    const NAMESPACE: &str = "org.freedesktop.appearance";
+    const KEY: &str = "color-scheme";
+    /// The colour scheme under its GNOME schema name, as a string. GNOME's portal answers it, and
+    /// so does XFCE's, which proxies the GSettings schemas but not the freedesktop namespace. KDE
+    /// answers only the freedesktop one, so that one wins when it states a preference.
+    const GNOME_NAMESPACE: &str = "org.gnome.desktop.interface";
+
+    /// Standard uint32 semantics, including future values treated as no preference.
+    fn numeric(value: &Value<'_>) -> Option<Option<DesktopAppearance>> {
+        match value {
+            Value::U32(1) => Some(Some(DesktopAppearance::Dark)),
+            Value::U32(2) => Some(Some(DesktopAppearance::Light)),
+            Value::U32(_) => Some(None),
+            _ => None,
+        }
+    }
+
+    /// GNOME's string values; anything but the two preferences (`default`) is no preference.
+    fn gnome_scheme(value: &Value<'_>) -> Option<Option<DesktopAppearance>> {
+        match value {
+            Value::Str(scheme) => Some(match scheme.as_str() {
+                "prefer-dark" => Some(DesktopAppearance::Dark),
+                "prefer-light" => Some(DesktopAppearance::Light),
+                _ => None,
+            }),
+            _ => None,
+        }
+    }
+
+    /// The freedesktop answer when it states a preference, otherwise the GNOME schema's.
+    fn combined(freedesktop: Option<DesktopAppearance>, gnome: Option<DesktopAppearance>) -> Option<DesktopAppearance> {
+        freedesktop.or(gnome)
+    }
+
+    fn read_gnome_reply(reply: &zbus::Message) -> Option<DesktopAppearance> {
+        let answer = reply.body().deserialize::<OwnedValue>().ok()?;
+        // Same two variant layers as the freedesktop Read.
+        let Value::Value(inner) = &*answer else { return None };
+        gnome_scheme(inner).flatten()
+    }
+
+    fn gnome_setting_changed(message: &zbus::Message) -> Option<Option<DesktopAppearance>> {
+        let body = message.body();
+        let (namespace, key, value) = body.deserialize::<(&str, &str, OwnedValue)>().ok()?;
+        if namespace != GNOME_NAMESPACE || key != KEY {
+            return None;
+        }
+        gnome_scheme(&value)
+    }
+
+    fn read_reply(reply: &zbus::Message) -> Option<DesktopAppearance> {
+        let answer = reply.body().deserialize::<OwnedValue>().ok()?;
+        // Legacy Read is available in Settings version 1 and returns two variant layers. The
+        // OwnedValue decoder removes the outer layer; unwrap exactly the documented inner one.
+        let Value::Value(inner) = &*answer else { return None };
+        numeric(inner).flatten()
+    }
+
+    fn setting_changed(message: &zbus::Message) -> Option<Option<DesktopAppearance>> {
+        let body = message.body();
+        let (namespace, key, value) = body.deserialize::<(&str, &str, OwnedValue)>().ok()?;
+        if namespace != NAMESPACE || key != KEY {
+            return None;
+        }
+        // SettingChanged has one variant layer, unlike legacy Read. Malformed signals do not
+        // discard a valid cached appearance; numeric no-preference signals do clear it.
+        numeric(&value)
+    }
+
+    pub(super) async fn watch(shared: Arc<Shared>) {
+        if watch_inner(&shared).await.is_err() {
+            shared.publish(None);
+        }
+    }
+
+    async fn watch_inner(shared: &Shared) -> zbus::Result<()> {
+        let connection = zbus::connection::Builder::session()?.method_timeout(std::time::Duration::from_secs(5)).build().await?;
+        watch_connection(shared, connection).await
+    }
+
+    fn setting_rule(namespace: &'static str) -> zbus::Result<zbus::MatchRule<'static>> {
+        Ok(zbus::MatchRule::builder()
+            .msg_type(zbus::message::Type::Signal)
+            .sender(DESTINATION)?
+            .path(PATH)?
+            .interface(INTERFACE)?
+            .member("SettingChanged")?
+            .arg(0, namespace)?
+            .arg(1, KEY)?
+            .build())
+    }
+
+    async fn watch_connection(shared: &Shared, connection: zbus::Connection) -> zbus::Result<()> {
+        // Install the matches before reading. Unlike Proxy::receive_signal this does not require
+        // the portal to already own its bus name, so Read can activate an installed portal.
+        let freedesktop_changes = zbus::MessageStream::for_match_rule(setting_rule(NAMESPACE)?, &connection, Some(64)).await?;
+        let gnome_changes = zbus::MessageStream::for_match_rule(setting_rule(GNOME_NAMESPACE)?, &connection, Some(64)).await?;
+        let mut changes = freedesktop_changes.or(gnome_changes);
+        let reply = connection.call_method(Some(DESTINATION), PATH, Some(INTERFACE), "Read", &(NAMESPACE, KEY)).await;
+        let mut freedesktop = reply.as_ref().ok().and_then(read_reply);
+        let reply = connection.call_method(Some(DESTINATION), PATH, Some(INTERFACE), "Read", &(GNOME_NAMESPACE, KEY)).await;
+        let mut gnome = reply.as_ref().ok().and_then(read_gnome_reply);
+        shared.publish(combined(freedesktop, gnome));
+        while let Some(message) = changes.next().await {
+            let message = message?;
+            // Keep every subscribed update, including those queued during Read. A Read handler
+            // can capture an old value and emit a new one before returning its older snapshot.
+            if let Some(appearance) = setting_changed(&message) {
+                freedesktop = appearance;
+            } else if let Some(appearance) = gnome_setting_changed(&message) {
+                gnome = appearance;
+            } else {
+                continue;
+            }
+            shared.publish(combined(freedesktop, gnome));
+        }
+        shared.publish(None);
+        Ok(())
+    }
+
+    #[cfg(test)]
+    mod tests {
+        use super::*;
+
+        fn reply(value: Value<'_>) -> zbus::Message {
+            let call = zbus::Message::method_call(PATH, "Read").unwrap().build(&(NAMESPACE, KEY)).unwrap();
+            zbus::Message::method_return(&call.header()).unwrap().build(&value).unwrap()
+        }
+
+        fn signal(namespace: &str, key: &str, value: Value<'_>) -> zbus::Message {
+            zbus::Message::signal(PATH, INTERFACE, "SettingChanged").unwrap().build(&(namespace, key, value)).unwrap()
+        }
+
+        #[test]
+        fn legacy_read_decodes_documented_double_variant_numeric_values() {
+            // Keep the native subscription implementation typechecked on non-Linux test hosts.
+            let _native_backend = watch;
+            for (number, expected) in [(0, None), (1, Some(DesktopAppearance::Dark)), (2, Some(DesktopAppearance::Light)), (u32::MAX, None)] {
+                assert_eq!(read_reply(&reply(Value::Value(Box::new(Value::U32(number))))), expected);
+            }
+        }
+
+        #[test]
+        fn legacy_read_refuses_strings_wrong_types_and_extra_nesting() {
+            assert_eq!(read_reply(&reply(Value::Value(Box::new(Value::from("prefer-dark"))))), None);
+            assert_eq!(read_reply(&reply(Value::Value(Box::new(Value::I32(1))))), None);
+            assert_eq!(read_reply(&reply(Value::Value(Box::new(Value::Value(Box::new(Value::U32(1))))))), None);
+            assert_eq!(read_reply(&reply(Value::U32(1))), None);
+        }
+
+        #[test]
+        fn signals_distinguish_no_preference_from_unrelated_or_malformed_updates() {
+            assert_eq!(setting_changed(&signal(NAMESPACE, KEY, Value::U32(1))), Some(Some(DesktopAppearance::Dark)));
+            assert_eq!(setting_changed(&signal(NAMESPACE, KEY, Value::U32(2))), Some(Some(DesktopAppearance::Light)));
+            assert_eq!(setting_changed(&signal(NAMESPACE, KEY, Value::U32(0))), Some(None));
+            assert_eq!(setting_changed(&signal(NAMESPACE, KEY, Value::U32(1234))), Some(None));
+            assert_eq!(setting_changed(&signal("org.gnome.desktop.interface", KEY, Value::U32(1))), None);
+            assert_eq!(setting_changed(&signal(NAMESPACE, "contrast", Value::U32(1))), None);
+            assert_eq!(setting_changed(&signal(NAMESPACE, KEY, Value::from("prefer-dark"))), None);
+            assert_eq!(setting_changed(&signal(NAMESPACE, KEY, Value::Value(Box::new(Value::U32(1))))), None);
+            let wrong_body = zbus::Message::signal(PATH, INTERFACE, "SettingChanged").unwrap().build(&(NAMESPACE, KEY)).unwrap();
+            assert_eq!(setting_changed(&wrong_body), None);
+        }
+
+        #[test]
+        fn the_gnome_schema_answers_when_the_freedesktop_one_states_no_preference() {
+            // XFCE's portal proxies only the GSettings schemas; its answer is a string.
+            assert_eq!(read_gnome_reply(&reply(Value::Value(Box::new(Value::from("prefer-dark"))))), Some(DesktopAppearance::Dark));
+            assert_eq!(read_gnome_reply(&reply(Value::Value(Box::new(Value::from("prefer-light"))))), Some(DesktopAppearance::Light));
+            assert_eq!(read_gnome_reply(&reply(Value::Value(Box::new(Value::from("default"))))), None);
+            assert_eq!(read_gnome_reply(&reply(Value::Value(Box::new(Value::U32(1))))), None);
+            assert_eq!(read_gnome_reply(&reply(Value::from("prefer-dark"))), None);
+            assert_eq!(gnome_setting_changed(&signal(GNOME_NAMESPACE, KEY, Value::from("prefer-dark"))), Some(Some(DesktopAppearance::Dark)));
+            assert_eq!(gnome_setting_changed(&signal(GNOME_NAMESPACE, KEY, Value::from("default"))), Some(None));
+            assert_eq!(gnome_setting_changed(&signal(GNOME_NAMESPACE, "gtk-theme", Value::from("prefer-dark"))), None);
+            assert_eq!(gnome_setting_changed(&signal(NAMESPACE, KEY, Value::from("prefer-dark"))), None);
+            assert_eq!(gnome_setting_changed(&signal(GNOME_NAMESPACE, KEY, Value::U32(1))), None);
+            // The freedesktop answer wins when it states one (KDE answers only that one).
+            assert_eq!(combined(Some(DesktopAppearance::Light), Some(DesktopAppearance::Dark)), Some(DesktopAppearance::Light));
+            assert_eq!(combined(None, Some(DesktopAppearance::Dark)), Some(DesktopAppearance::Dark));
+            assert_eq!(combined(None, None), None);
+        }
+
+        #[test]
+        #[cfg(target_os = "linux")]
+        #[ignore = "requires dbus-daemon; uses only a private test session bus"]
+        fn private_bus_delayed_read_keeps_queued_changes_and_wakes_idle_tracker() {
+            use crate::desktop_theme::DesktopTheme;
+            use std::io::BufRead;
+            use std::process::{Command, Stdio};
+            use std::sync::{OnceLock, Weak, mpsc};
+            use std::time::{Duration, Instant};
+
+            struct Daemon(std::process::Child);
+            impl Drop for Daemon {
+                fn drop(&mut self) {
+                    let _ = self.0.kill();
+                    let _ = self.0.wait();
                 }
             }
-        });
-        Self { changes: started.ok().map(|_| rx) }
-    }
-
-    /// The desktop's new answer if it changed since the last call, to be polled once a frame.
-    /// Several changes in one frame collapse to the newest, and a desktop that stops answering
-    /// leaves the last answer in place.
-    pub fn take_change(&mut self) -> Option<bool> {
-        let Some(changes) = &self.changes else { return None };
-        let mut newest = None;
-        loop {
-            match changes.try_recv() {
-                Ok(changed) => newest = changed,
-                Err(TryRecvError::Empty) | Err(TryRecvError::Disconnected) => return newest,
+            struct Settings {
+                captured: mpsc::Sender<()>,
+                release: async_channel::Receiver<()>,
             }
+            #[zbus::interface(name = "org.freedesktop.portal.Settings")]
+            impl Settings {
+                async fn read(&self, namespace: &str, key: &str) -> zbus::fdo::Result<OwnedValue> {
+                    if namespace != NAMESPACE || key != KEY {
+                        return Err(zbus::fdo::Error::InvalidArgs("unknown setting".into()));
+                    }
+                    // Capture Light before a later Dark signal, then deliberately return the
+                    // stale snapshot after that signal. Reply ordering cannot date this value.
+                    let snapshot = Value::Value(Box::new(Value::U32(2)));
+                    self.captured.send(()).map_err(|error| zbus::fdo::Error::Failed(error.to_string()))?;
+                    self.release.recv().await.map_err(|error| zbus::fdo::Error::Failed(error.to_string()))?;
+                    OwnedValue::try_from(snapshot).map_err(|error| zbus::fdo::Error::Failed(error.to_string()))
+                }
+            }
+            fn wait_for(tracker: &DesktopTheme, appearance: Option<DesktopAppearance>) {
+                let deadline = Instant::now() + Duration::from_secs(5);
+                while tracker.get() != appearance {
+                    assert!(Instant::now() < deadline, "tracker did not consume the setting signal");
+                    std::thread::sleep(Duration::from_millis(5));
+                }
+            }
+            fn emit(connection: &zbus::Connection, number: u32) {
+                futures_lite::future::block_on(connection.emit_signal(
+                    None::<&str>,
+                    PATH,
+                    INTERFACE,
+                    "SettingChanged",
+                    &(NAMESPACE, KEY, OwnedValue::from(number)),
+                ))
+                .unwrap();
+            }
+
+            let child = Command::new("dbus-daemon")
+                .args(["--session", "--nofork", "--print-address=1"])
+                // Abstract sockets disappear with the daemon, even if a test fails.
+                .arg(format!("--address=unix:abstract=pdfcraft-theme-test-{}", std::process::id()))
+                .stdout(Stdio::piped())
+                .stderr(Stdio::null())
+                .spawn()
+                .unwrap();
+            let mut daemon = Daemon(child);
+            let mut address = String::new();
+            std::io::BufReader::new(daemon.0.stdout.take().unwrap()).read_line(&mut address).unwrap();
+            assert!(!address.trim().is_empty());
+            let (captured, capture_seen) = mpsc::channel();
+            let (release, released) = async_channel::bounded(1);
+            let server = futures_lite::future::block_on(
+                zbus::connection::Builder::address(address.trim())
+                    .unwrap()
+                    .name(DESTINATION)
+                    .unwrap()
+                    .serve_at(PATH, Settings { captured, release: released })
+                    .unwrap()
+                    .build(),
+            )
+            .unwrap();
+            let client = futures_lite::future::block_on(
+                zbus::connection::Builder::address(address.trim()).unwrap().method_timeout(Duration::from_secs(5)).build(),
+            )
+            .unwrap();
+            let source = Arc::new(OnceLock::<Weak<Shared>>::new());
+            let observed = Arc::clone(&source);
+            let (wake, woke) = mpsc::channel();
+            let tracker = DesktopTheme::spawn(
+                move || {
+                    wake.send(observed.get().unwrap().upgrade().unwrap().get()).unwrap();
+                },
+                move |shared| async move {
+                    watch_connection(&shared, client).await.unwrap();
+                },
+            );
+            source.set(Arc::downgrade(&tracker.shared)).unwrap();
+            capture_seen.recv_timeout(Duration::from_secs(5)).unwrap();
+            emit(&server, 1);
+            release.send_blocking(()).unwrap();
+            assert_eq!(woke.recv_timeout(Duration::from_secs(5)).unwrap(), Some(DesktopAppearance::Light));
+            assert_eq!(woke.recv_timeout(Duration::from_secs(5)).unwrap(), Some(DesktopAppearance::Dark));
+            assert_eq!(tracker.get(), Some(DesktopAppearance::Dark));
+
+            emit(&server, 2);
+            assert_eq!(woke.recv_timeout(Duration::from_secs(5)).unwrap(), Some(DesktopAppearance::Light));
+            emit(&server, 0);
+            assert_eq!(woke.recv_timeout(Duration::from_secs(5)).unwrap(), None);
+            tracker.set_active(false);
+            emit(&server, 1);
+            wait_for(&tracker, Some(DesktopAppearance::Dark));
+            emit(&server, 2);
+            wait_for(&tracker, Some(DesktopAppearance::Light));
+            assert!(matches!(woke.try_recv(), Err(mpsc::TryRecvError::Empty)));
+            tracker.set_active(true);
+            assert_eq!(tracker.get(), Some(DesktopAppearance::Light));
+            emit(&server, 1);
+            assert_eq!(woke.recv_timeout(Duration::from_secs(5)).unwrap(), Some(DesktopAppearance::Dark));
+            // Closing the tracker must cancel an idle bus subscription and join the worker.
+            drop(tracker);
+            drop(server);
         }
     }
 }
 
-/// Ask the portal once. D-Bus calls block, so this belongs off the UI thread: the watcher's
-/// thread is its only caller.
-#[cfg(target_os = "linux")]
-fn read() -> Option<bool> {
-    const PORTAL: &str = "org.freedesktop.portal.Desktop";
-    const SETTINGS: &str = "org.freedesktop.portal.Settings";
-    // The colour scheme under its GNOME schema name first: GNOME's portal answers it, and so
-    // does XFCE's, which proxies the GSettings schemas but not the older freedesktop one. KDE
-    // answers only the second.
-    const SCHEMAS: [(&str, &str); 2] = [("org.gnome.desktop.interface", "color-scheme"), ("org.freedesktop.interface.color-scheme", "color-scheme")];
-    let connection = zbus::blocking::Connection::session().ok()?;
-    for (schema, key) in SCHEMAS {
-        let Ok(reply) = connection.call_method(Some(PORTAL), "/org/freedesktop/portal/desktop", Some(SETTINGS), "ReadOne", &(schema, key)) else {
-            continue;
-        };
-        let Ok((answer,)) = reply.body().deserialize::<(zbus::zvariant::OwnedValue,)>() else { continue };
-        // The reply is one variant wrapping a string.
-        if let Ok(scheme) = String::try_from(&*answer) {
-            return parse(&scheme);
-        }
-    }
-    None
-}
-
-/// The portal's `color-scheme` answer. `default` means the desktop states no preference, so
-/// neither does the application.
-#[cfg(target_os = "linux")]
-fn parse(scheme: &str) -> Option<bool> {
-    match scheme {
-        "prefer-dark" => Some(true),
-        "prefer-light" => Some(false),
-        _ => None,
-    }
-}
-
-/// macOS and Windows answer through winit, which the caller already has.
-#[cfg(not(target_os = "linux"))]
-fn read() -> Option<bool> {
-    None
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::sync::atomic::AtomicUsize;
 
-    /// The portal answers with one of three strings; only the two preferences are a choice.
     #[test]
-    #[cfg(target_os = "linux")]
-    fn the_portal_answer_reads_as_a_choice_or_as_none() {
-        assert_eq!(parse("prefer-dark"), Some(true));
-        assert_eq!(parse("prefer-light"), Some(false));
-        assert_eq!(parse("default"), None);
-        assert_eq!(parse(""), None);
+    fn initial_and_changed_results_wake_after_publication_but_duplicates_do_not() {
+        let wakes = Arc::new(AtomicUsize::new(0));
+        let observed = Arc::clone(&wakes);
+        let source = Arc::new(std::sync::OnceLock::<std::sync::Weak<Shared>>::new());
+        let observed_source = Arc::clone(&source);
+        let (snapshot, snapshots) = std::sync::mpsc::channel();
+        let shared = Arc::new(Shared::new(move || {
+            snapshot.send(observed_source.get().unwrap().upgrade().unwrap().get()).unwrap();
+            observed.fetch_add(1, Ordering::Relaxed);
+        }));
+        source.set(Arc::downgrade(&shared)).unwrap();
+        shared.publish(None);
+        assert_eq!(snapshots.try_recv().unwrap(), None);
+        assert_eq!(wakes.load(Ordering::Relaxed), 1);
+        shared.publish(None);
+        assert_eq!(wakes.load(Ordering::Relaxed), 1);
+        shared.publish(Some(DesktopAppearance::Dark));
+        assert_eq!(snapshots.try_recv().unwrap(), Some(DesktopAppearance::Dark));
+        assert_eq!(shared.get(), Some(DesktopAppearance::Dark));
+        assert_eq!(wakes.load(Ordering::Relaxed), 2);
+        shared.publish(Some(DesktopAppearance::Dark));
+        assert_eq!(wakes.load(Ordering::Relaxed), 2);
+        shared.publish(Some(DesktopAppearance::Light));
+        assert_eq!(snapshots.try_recv().unwrap(), Some(DesktopAppearance::Light));
+        assert_eq!(shared.get(), Some(DesktopAppearance::Light));
+        assert_eq!(wakes.load(Ordering::Relaxed), 3);
+        shared.publish(None);
+        assert_eq!(snapshots.try_recv().unwrap(), None);
+        assert_eq!(shared.get(), None);
+        assert_eq!(wakes.load(Ordering::Relaxed), 4);
+        assert!(matches!(snapshots.try_recv(), Err(std::sync::mpsc::TryRecvError::Empty)));
+    }
+
+    #[test]
+    fn manual_mode_caches_changes_without_waking_and_system_resumes_latest_value() {
+        let wakes = Arc::new(AtomicUsize::new(0));
+        let observed = Arc::clone(&wakes);
+        let tracker = DesktopTheme::spawn(
+            move || {
+                observed.fetch_add(1, Ordering::Relaxed);
+            },
+            |_| futures_lite::future::pending(),
+        );
+        tracker.set_active(false);
+        tracker.shared.publish(Some(DesktopAppearance::Dark));
+        tracker.shared.publish(Some(DesktopAppearance::Light));
+        assert_eq!(tracker.get(), Some(DesktopAppearance::Light));
+        assert_eq!(wakes.load(Ordering::Relaxed), 0);
+        tracker.set_active(true);
+        assert_eq!(tracker.get(), Some(DesktopAppearance::Light));
+        tracker.shared.publish(Some(DesktopAppearance::Dark));
+        assert_eq!(wakes.load(Ordering::Relaxed), 1);
+    }
+
+    #[test]
+    fn dropping_tracker_cancels_and_joins_an_idle_worker() {
+        struct Finished(Arc<AtomicBool>);
+        impl Drop for Finished {
+            fn drop(&mut self) {
+                self.0.store(true, Ordering::Release);
+            }
+        }
+        let finished = Arc::new(AtomicBool::new(false));
+        let worker_finished = Arc::clone(&finished);
+        let (ready, waiting) = std::sync::mpsc::channel();
+        let tracker = DesktopTheme::spawn(
+            || {},
+            move |_| async move {
+                let _finished = Finished(worker_finished);
+                ready.send(()).unwrap();
+                futures_lite::future::pending::<()>().await;
+            },
+        );
+        waiting.recv_timeout(std::time::Duration::from_secs(5)).unwrap();
+        drop(tracker);
+        assert!(finished.load(Ordering::Acquire));
     }
 
-    /// Off Linux the caller already has winit's answer, so this adds nothing.
     #[test]
     #[cfg(not(target_os = "linux"))]
-    fn other_platforms_answer_through_winit() {
-        assert_eq!(prefers_dark(), None);
-    }
-
-    /// A watcher that was never started is inert rather than a panic.
-    #[test]
-    fn a_watcher_without_a_thread_is_inert() {
-        assert_eq!(DesktopTheme::default().take_change(), None);
+    fn native_non_linux_tracker_is_inert() {
+        let tracker = DesktopTheme::start(|| panic!("non-Linux tracker must not wake"));
+        assert_eq!(tracker.get(), None);
+        tracker.set_active(false);
+        tracker.set_active(true);
     }
 }
diff --git a/crates/preflight/src/lib.rs b/crates/preflight/src/lib.rs
index 7dc6ee24..c2457c47 100644
--- a/crates/preflight/src/lib.rs
+++ b/crates/preflight/src/lib.rs
@@ -58,17 +58,90 @@ impl Level {
 }
 
 /// A rule a document breaks.
+///
+/// [`message`](Issue::message) is the problem in English, ready to read. An interface that reads in
+/// another language says it from [`pattern`](Issue::pattern) and [`value`](Issue::value) instead:
+/// the pattern is wording of ours, listed in [`WORDINGS`], and the value — when there is one — is
+/// the document's own name for something, a PDF keyword that reads the same in every language.
+/// [`Issue::said`] does that.
 #[derive(Clone, Debug, PartialEq)]
 pub struct Issue {
     /// The ISO 19005-2 clause.
     pub clause: &'static str,
     pub message: String,
+    /// The problem as it is worded here, with `{}` where the document's own name goes.
+    pub pattern: &'static str,
+    /// What goes in the pattern's `{}`: an annotation subtype, an action, a font, a page number.
+    pub value: Option<String>,
     /// 0-based page, when the problem is on a page.
     pub page: Option<usize>,
     /// Whether [`convert`] can fix it.
     pub fixable: bool,
 }
 
+impl Issue {
+    /// The problem as one sentence, said in the language `words` translates into.
+    ///
+    /// The wording is translated and the document's own name goes in afterwards, in one pass, so a
+    /// font called `{}` cannot turn into anything else. With [`in_english`] this is
+    /// [`message`](Issue::message).
+    pub fn said(&self, words: Words) -> String {
+        let said = words(self.pattern);
+        match &self.value {
+            Some(v) => said.replacen("{}", v, 1),
+            None => said,
+        }
+    }
+}
+
+/// How an interface says one of our wordings in its own language: given the English in [`WORDINGS`],
+/// the same wording in that language. [`in_english`] keeps the English.
+pub type Words<'a> = &'a dyn Fn(&str) -> String;
+
+/// The [`Words`] that translate nothing: the wording as it is written here.
+pub fn in_english(wording: &str) -> String {
+    wording.to_owned()
+}
+
+/// Every problem [`verify`] can report, in English, with `{}` where the document's own name goes.
+///
+/// An interface that shows them in another language translates these, which is the whole reason they
+/// are gathered here; `wordings_are_complete` fails if a rule says something that is not on the
+/// list. What [`convert`] reports as fixed is not here: that is read by scripts, in English.
+pub const WORDINGS: &[&str] = &[
+    // Identification and metadata.
+    "The document has no XMP metadata",
+    "The metadata doesn't identify the file as {}",
+    "The title in the metadata and the document information differ",
+    // The document as a whole.
+    "The document is encrypted",
+    "Device colour is used, but there is no PDF/A output intent",
+    "DeviceCMYK is used: it needs a CMYK output intent (not added automatically)",
+    "DeviceCMYK is used, but the PDF/A output intent isn't a CMYK profile",
+    "DeviceRGB is used, but the PDF/A output intent isn't an RGB profile",
+    "The document has additional actions (/AA)",
+    "The document has document-level JavaScript",
+    "The form asks viewers to make appearances (NeedAppearances)",
+    // Pages, actions, annotations and fields.
+    "Page {} has additional actions",
+    "A {} action isn't allowed",
+    "{} annotations aren't allowed",
+    "A {} annotation isn't set to print, or is hidden",
+    "A {} annotation has no appearance stream",
+    "A {} annotation has additional actions",
+    "A form field has additional actions",
+    // Fonts, streams, images and embedded files.
+    "The font {} isn't embedded",
+    "A font isn't embedded",
+    "A stream uses LZW compression",
+    "A stream refers to an external file",
+    "An image asks to be interpolated",
+    "An image has alternates or OPI information",
+    "PostScript XObjects aren't allowed",
+    "Embedded files must be PDF/A files themselves (use PDF/A-3 for others)",
+    "An embedded file has no AFRelationship",
+];
+
 /// What a document declares (the Standards panel).
 #[derive(Clone, Debug, Default, PartialEq)]
 pub struct Declared {
@@ -230,62 +303,70 @@ fn uses_device_colour(doc: &Document, objs: &[(ObjRef, std::sync::Arc<Object>)])
 /// Check `doc` against `level`.
 pub fn verify(doc: &Document, level: Level) -> Vec<Issue> {
     let mut out = Vec::new();
-    let mut issue = |clause: &'static str, message: String, page: Option<usize>, fixable: bool| out.push(Issue { clause, message, page, fixable });
+    // Each problem is worded here and named by the document there: the wording goes on the list in
+    // `WORDINGS` for an interface to translate, and the name goes in its `{}` as it stands.
+    let mut issue = |clause: &'static str, pattern: &'static str, value: Option<String>, page: Option<usize>, fixable: bool| {
+        let message = match &value {
+            Some(v) => pattern.replacen("{}", v, 1),
+            None => pattern.to_owned(),
+        };
+        out.push(Issue { clause, message, pattern, value, page, fixable });
+    };
     let cat = catalog(doc);
     // 6.1.3 / 6.6: identification and metadata.
     match metadata(doc) {
-        None => issue("6.6.2.1", "The document has no XMP metadata".into(), None, true),
+        None => issue("6.6.2.1", "The document has no XMP metadata", None, None, true),
         Some(x) => {
             let part = xmp::value(&x, "pdfaid:part");
             let conf = xmp::value(&x, "pdfaid:conformance");
             if part.as_deref() != Some(&level.part().to_string()) || conf.as_deref().map(str::to_uppercase).as_deref() != Some("B") {
-                issue("6.6.4", format!("The metadata doesn't identify the file as {}", level.label()), None, true);
+                issue("6.6.4", "The metadata doesn't identify the file as {}", Some(level.label().to_owned()), None, true);
             }
             if let Some(title) = info(doc, "Title")
                 && xmp::value(&x, "dc:title").is_some_and(|t| t != title)
             {
-                issue("6.6.3", "The title in the metadata and the document information differ".into(), None, true);
+                issue("6.6.3", "The title in the metadata and the document information differ", None, None, true);
             }
         }
     }
     // 6.1.3: encryption.
     if doc.trailer().get(b"Encrypt").is_some() {
-        issue("6.1.3", "The document is encrypted".into(), None, true);
+        issue("6.1.3", "The document is encrypted", None, None, true);
     }
     // 6.2.2: output intent when device colour is used.
     let objs = objects(doc);
     let used = uses_device_colour(doc, &objs);
     match pdfa_intent_profile(doc) {
         None if used.any() => {
-            issue("6.2.3", "Device colour is used, but there is no PDF/A output intent".into(), None, !used.cmyk);
+            issue("6.2.3", "Device colour is used, but there is no PDF/A output intent", None, None, !used.cmyk);
             if used.cmyk {
-                issue("6.2.4.3", "DeviceCMYK is used: it needs a CMYK output intent (not added automatically)".into(), None, false);
+                issue("6.2.4.3", "DeviceCMYK is used: it needs a CMYK output intent (not added automatically)", None, None, false);
             }
         }
         // 6.2.4.3: DeviceRGB needs an RGB output intent and DeviceCMYK a CMYK one (#667).
         Some(n) => {
             if used.cmyk && !used.default_cmyk && n != Some(4) {
-                issue("6.2.4.3", "DeviceCMYK is used, but the PDF/A output intent isn't a CMYK profile".into(), None, false);
+                issue("6.2.4.3", "DeviceCMYK is used, but the PDF/A output intent isn't a CMYK profile", None, None, false);
             }
             if used.rgb && !used.default_rgb && n != Some(3) {
-                issue("6.2.4.3", "DeviceRGB is used, but the PDF/A output intent isn't an RGB profile".into(), None, false);
+                issue("6.2.4.3", "DeviceRGB is used, but the PDF/A output intent isn't an RGB profile", None, None, false);
             }
         }
         None => {}
     }
     // 6.1.3 / 6.6.1: catalog actions.
     if cat.get(b"AA").is_some() {
-        issue("6.5.2", "The document has additional actions (/AA)".into(), None, true);
+        issue("6.5.2", "The document has additional actions (/AA)", None, None, true);
     }
     if let Some(names) = cat.get(b"Names").map(|n| doc.resolve(n))
         && names.as_dict().is_some_and(|n| n.get(b"JavaScript").is_some())
     {
-        issue("6.5.1", "The document has document-level JavaScript".into(), None, true);
+        issue("6.5.1", "The document has document-level JavaScript", None, None, true);
     }
     if let Some(af) = cat.get(b"AcroForm").map(|a| doc.resolve(a))
         && af.as_dict().is_some_and(|a| matches!(a.get(b"NeedAppearances"), Some(Object::Bool(true))))
     {
-        issue("6.4.1", "The form asks viewers to make appearances (NeedAppearances)".into(), None, true);
+        issue("6.4.1", "The form asks viewers to make appearances (NeedAppearances)", None, None, true);
     }
     // Pages: annotations and page actions.
     let pages = pdfcraft_model::pages(doc);
@@ -302,7 +383,7 @@ pub fn verify(doc: &Document, level: Level) -> Vec<Issue> {
     };
     for (i, p) in pages.iter().enumerate() {
         if p.dict.get(b"AA").is_some() {
-            issue("6.5.2", format!("Page {} has additional actions", i + 1), Some(i), true);
+            issue("6.5.2", "Page {} has additional actions", Some((i + 1).to_string()), Some(i), true);
         }
     }
     for (r, o) in &objs {
@@ -314,19 +395,19 @@ pub fn verify(doc: &Document, level: Level) -> Vec<Issue> {
             && FORBIDDEN_ACTIONS.contains(&s)
             && is_action(d)
         {
-            issue("6.5.1", format!("A {} action isn't allowed", String::from_utf8_lossy(s)), None, true);
+            issue("6.5.1", "A {} action isn't allowed", Some(String::from_utf8_lossy(s).into_owned()), None, true);
         }
         // Annotations.
         if ty == Some(b"Annot") || (sub.is_some() && d.get(b"Rect").is_some() && d.get(b"P").is_some()) {
             let page = page_of(*r);
             let name = sub.map(|s| String::from_utf8_lossy(s).into_owned()).unwrap_or_default();
             if sub.is_some_and(|s| FORBIDDEN_ANNOTS.contains(&s)) {
-                issue("6.3.1", format!("{name} annotations aren't allowed"), page, true);
+                issue("6.3.1", "{} annotations aren't allowed", Some(name), page, true);
                 continue;
             }
             let f = d.int(b"F").unwrap_or(0);
             if sub != Some(b"Popup") && (f & 4 == 0 || f & (1 | 2 | 32) != 0) {
-                issue("6.3.2", format!("A {name} annotation isn't set to print, or is hidden"), page, true);
+                issue("6.3.2", "A {} annotation isn't set to print, or is hidden", Some(name.clone()), page, true);
             }
             let has_ap = d.get(b"AP").map(|a| doc.resolve(a)).and_then(|a| a.as_dict().cloned()).is_some_and(|a| a.get(b"N").is_some());
             if !has_ap && !matches!(sub, Some(b"Popup") | Some(b"Link")) {
@@ -335,16 +416,16 @@ pub fn verify(doc: &Document, level: Level) -> Vec<Issue> {
                     v.len() == 4 && (v[2] - v[0]).abs() < 1e-6 && (v[3] - v[1]).abs() < 1e-6
                 });
                 if !zero {
-                    issue("6.3.3", format!("A {name} annotation has no appearance stream"), page, false);
+                    issue("6.3.3", "A {} annotation has no appearance stream", Some(name.clone()), page, false);
                 }
             }
             if d.get(b"AA").is_some() {
-                issue("6.5.2", format!("A {name} annotation has additional actions"), page, true);
+                issue("6.5.2", "A {} annotation has additional actions", Some(name), page, true);
             }
         }
         // Form fields with additional actions (non-widget fields).
         if d.get(b"FT").is_some() && d.get(b"AA").is_some() && ty != Some(b"Annot") {
-            issue("6.5.2", "A form field has additional actions".into(), None, true);
+            issue("6.5.2", "A form field has additional actions", None, None, true);
         }
         // Fonts.
         if ty == Some(b"Font") || d.get(b"BaseFont").is_some() && sub.is_some() {
@@ -361,30 +442,30 @@ pub fn verify(doc: &Document, level: Level) -> Vec<Issue> {
                 None => Vec::new(),
             };
             if filters.iter().any(|f| f == b"LZWDecode") {
-                issue("6.1.7.2", "A stream uses LZW compression".into(), None, false);
+                issue("6.1.7.2", "A stream uses LZW compression", None, None, false);
             }
             if s.dict.get(b"F").is_some() || s.dict.get(b"FFilter").is_some() {
-                issue("6.1.7.1", "A stream refers to an external file".into(), None, false);
+                issue("6.1.7.1", "A stream refers to an external file", None, None, false);
             }
             if sub == Some(b"Image") {
                 if matches!(s.dict.get(b"Interpolate"), Some(Object::Bool(true))) {
-                    issue("6.2.8", "An image asks to be interpolated".into(), None, true);
+                    issue("6.2.8", "An image asks to be interpolated", None, None, true);
                 }
                 if s.dict.get(b"Alternates").is_some() || s.dict.get(b"OPI").is_some() {
-                    issue("6.2.8", "An image has alternates or OPI information".into(), None, true);
+                    issue("6.2.8", "An image has alternates or OPI information", None, None, true);
                 }
             }
             if sub == Some(b"PS") {
-                issue("6.2.9", "PostScript XObjects aren't allowed".into(), None, false);
+                issue("6.2.9", "PostScript XObjects aren't allowed", None, None, false);
             }
         }
         // Embedded files.
         if ty == Some(b"Filespec") && d.get(b"EF").is_some() {
             match level {
-                Level::A2b => issue("6.8", "Embedded files must be PDF/A files themselves (use PDF/A-3 for others)".into(), None, false),
+                Level::A2b => issue("6.8", "Embedded files must be PDF/A files themselves (use PDF/A-3 for others)", None, None, false),
                 Level::A3b => {
                     if d.get(b"AFRelationship").is_none() {
-                        issue("6.8", "An embedded file has no AFRelationship".into(), None, true);
+                        issue("6.8", "An embedded file has no AFRelationship", None, None, true);
                     }
                 }
             }
@@ -396,12 +477,12 @@ pub fn verify(doc: &Document, level: Level) -> Vec<Issue> {
     out
 }
 
-fn check_font(doc: &Document, d: &Dict, issue: &mut impl FnMut(&'static str, String, Option<usize>, bool)) {
+fn check_font(doc: &Document, d: &Dict, issue: &mut impl FnMut(&'static str, &'static str, Option<String>, Option<usize>, bool)) {
     let sub = d.name(b"Subtype");
     if sub == Some(b"Type3") {
         return;
     }
-    let name = d.name(b"BaseFont").map(|n| String::from_utf8_lossy(n).into_owned()).unwrap_or_else(|| "a font".into());
+    let name = d.name(b"BaseFont").map(|n| String::from_utf8_lossy(n).into_owned());
     let descriptor = if sub == Some(b"Type0") {
         d.get(b"DescendantFonts")
             .map(|x| doc.resolve(x))
@@ -416,7 +497,12 @@ fn check_font(doc: &Document, d: &Dict, issue: &mut impl FnMut(&'static str, Str
         .and_then(|fd| fd.as_dict().cloned())
         .is_some_and(|fd| fd.get(b"FontFile").is_some() || fd.get(b"FontFile2").is_some() || fd.get(b"FontFile3").is_some());
     if !embedded {
-        issue("6.2.11.4", format!("The font {name} isn't embedded"), None, false);
+        // A font the document doesn't name gets a sentence of its own, rather than the word for
+        // "a font" put where a name goes, which read badly even in English.
+        match name {
+            Some(n) => issue("6.2.11.4", "The font {} isn't embedded", Some(n), None, false),
+            None => issue("6.2.11.4", "A font isn't embedded", None, None, false),
+        }
     }
 }
 
diff --git a/crates/preflight/src/tests.rs b/crates/preflight/src/tests.rs
index 35ed8565..dadbd583 100644
--- a/crates/preflight/src/tests.rs
+++ b/crates/preflight/src/tests.rs
@@ -60,6 +60,39 @@ fn verify_reports_what_breaks_pdfa() {
     }
     assert!(issues.iter().find(|i| i.message.starts_with("The font")).is_some_and(|i| !i.fixable));
     assert!(clauses(&issues).contains(&"6.6.2.1"));
+    // Each problem is also worded separately from what the document calls things, so an interface
+    // can say it in another language; in English the two come to the same sentence.
+    for i in &issues {
+        assert_eq!(i.said(&in_english), i.message);
+        assert!(WORDINGS.contains(&i.pattern), "{:?} is not in WORDINGS", i.pattern);
+    }
+    let font = issues.iter().find(|i| i.pattern == "The font {} isn't embedded").unwrap();
+    assert_eq!(font.said(&|w: &str| format!("«{w}»")), "«The font {} isn't embedded»".replace("{}", "Helvetica"));
+}
+
+/// Every problem the rules can report is listed in `WORDINGS`, so an interface showing them in
+/// another language has something to translate. The wording is `verify`'s second argument, which is
+/// what this reads off the file; the sentences `convert` reports as fixed are not wordings.
+#[test]
+fn wordings_are_complete() {
+    let source = include_str!("lib.rs");
+    let mut said = Vec::new();
+    let mut rest = source;
+    while let Some(at) = rest.find("issue(\"") {
+        rest = &rest[at + 7..];
+        // Step over the clause, then take the wording that follows it.
+        let Some(end) = rest.find('"') else { break };
+        rest = &rest[end + 1..];
+        let Some(text) = rest.strip_prefix(", \"") else { continue };
+        let Some(end) = text.find('"') else { break };
+        said.push(&text[..end]);
+        rest = text;
+    }
+    assert!(said.len() >= 24, "the wordings are not being read off the file: {said:#?}");
+    let missing: Vec<&&str> = said.iter().filter(|word| !WORDINGS.contains(word)).collect();
+    assert!(missing.is_empty(), "add these to WORDINGS, and a translation of each to every interface: {missing:#?}");
+    let unsaid: Vec<&&str> = WORDINGS.iter().filter(|word| !said.contains(word)).collect();
+    assert!(unsaid.is_empty(), "WORDINGS lists problems the rules no longer report: {unsaid:#?}");
 }
 
 #[test]
diff --git a/crates/print/README.md b/crates/print/README.md
index df7db109..a7514023 100644
--- a/crates/print/README.md
+++ b/crates/print/README.md
@@ -49,3 +49,25 @@ still needs hardware validation.
 
 Not yet: the web spooler, print as image, poster labels, PostScript output, colour conversion for
 grayscale.
+
+## Architectural sheets and scale
+
+The Paper menu and `doc_print` share Letter, Legal, Tabloid, A3/A4/A5 plus
+ARCH A/B/C/D/E1/E, ANSI C/D/E and ISO A0/A1/A2. ARCH D is 24 × 36 inches;
+ANSI D is 22 × 34 inches. Dimensions follow the [HP DesignJet paper-size table](https://support.hp.com/hr-en/document/bpp01676).
+Automation accepts short names such as `"ARCH D"` (case-insensitive) or the full menu label.
+For example, `doc_print` with `paper: "ARCH D"`, `layout: "actual"`,
+`orientation: "auto"` and `path: "plan.pdf"` writes a print-ready PDF at 100%.
+
+**Match page at 100%** uses the currently viewed document page to choose a standard
+sheet (either orientation, within 0.5 pt for rounded metric dimensions), Actual size
+and Auto orientation. It leaves the selected page range intact. It is disabled
+for a custom page size with no matching preset. One preset applies to the whole job;
+this is not per-page paper-source selection.
+
+**PDF scale** describes the source-to-sheet transform in the previewed print-ready
+PDF, not measured physical output. Fit reserves an 18 pt margin and can reduce even
+a matching page. The current Windows backend still rasterises and can substitute
+paper/shrink a job if its driver lacks the requested size. These controls do not
+add #599's strict PrintTicket validation or vector spooler. Verify the driver's
+paper/scaling settings and physical calibration before relying on drawing scale.
diff --git a/crates/print/src/lib.rs b/crates/print/src/lib.rs
index 7566f8ca..1a2868d7 100644
--- a/crates/print/src/lib.rs
+++ b/crates/print/src/lib.rs
@@ -27,10 +27,22 @@ mod tests;
 
 pub use range::{Subset, select_listed, select_pages};
 
+/// What can go wrong when printing.
+///
+/// The three things a *person* can be wrong about — there is nothing to print, a page number past
+/// the end, a range that is not a page — each have their own variant with the numbers apart from
+/// the words, so an interface can say them in its own language with [`PrintError::said`]. The rest
+/// are faults rather than mistakes and carry their text as it is.
 #[derive(Debug, thiserror::Error, PartialEq)]
 pub enum PrintError {
     #[error("there are no pages to print")]
     NoPages,
+    /// A page number past the end of the document: the number asked for, and the page count.
+    #[error("page {0} is out of range (1–{1})")]
+    OutOfRange(usize, usize),
+    /// A range token that is neither a page number nor a page label.
+    #[error("{0:?} is not a page number or label")]
+    NotAPage(String),
     #[error("{0}")]
     Invalid(String),
     #[error("{0}")]
@@ -39,6 +51,67 @@ pub enum PrintError {
     Cos(#[from] pdfcraft_cos::CosError),
 }
 
+/// How an interface says one of our wordings in its own language, holes and all: given the English
+/// in [`WORDINGS`], the same wording in that language. [`in_english`] keeps the English.
+pub type Words<'a> = &'a dyn Fn(&str) -> String;
+
+/// The [`Words`] that translate nothing: the wording as it is written here.
+pub fn in_english(wording: &str) -> String {
+    wording.to_owned()
+}
+
+/// What a person can get wrong about what to print, in English, with their holes still in them.
+///
+/// An interface that reports these in another language translates these three, which is the whole
+/// reason they are gathered here; `wordings_are_said` keeps them in step with the errors.
+pub const WORDINGS: &[&str] = &["there are no pages to print", "page {n} is out of range (1–{count})", "{page} is not a page number or label"];
+
+impl PrintError {
+    /// This error as one sentence, said in the language `words` translates into.
+    ///
+    /// The wording is translated and the numbers go in afterwards, in a single pass, so what the
+    /// person typed cannot be read as a hole. With [`in_english`] this is the error's own
+    /// `Display`, which is what the command line and scripts report.
+    pub fn said(&self, words: Words) -> String {
+        match self {
+            PrintError::NoPages => words("there are no pages to print"),
+            PrintError::OutOfRange(n, count) => {
+                say(&words("page {n} is out of range (1–{count})"), &[("{n}", n.to_string()), ("{count}", count.to_string())])
+            }
+            // The token goes in quoted, the way it is typed, as the error itself prints it.
+            PrintError::NotAPage(token) => say(&words("{page} is not a page number or label"), &[("{page}", format!("{token:?}"))]),
+            fault => fault.to_string(),
+        }
+    }
+}
+
+/// A wording with its holes filled.
+///
+/// A hole is a name in braces, such as `{n}`; what is not in `values` is left as it is written.
+/// Values go in during a single pass, so a value with braces in it is never read as a hole.
+fn say(wording: &str, values: &[(&str, String)]) -> String {
+    let mut out = String::with_capacity(wording.len() + 8);
+    let mut rest = wording;
+    while let Some(open) = rest.find('{') {
+        let (before, from_brace) = rest.split_at(open);
+        out.push_str(before);
+        // `find` counts from the brace and `}` is one byte, so this is a char boundary.
+        let Some(close) = from_brace.find('}') else {
+            // A brace with nothing closing it is just text.
+            out.push_str(from_brace);
+            return out;
+        };
+        let Some(hole) = from_brace.get(..=close) else { return out + from_brace };
+        match values.iter().find(|(name, _)| *name == hole) {
+            Some((_, value)) => out.push_str(value),
+            None => out.push_str(hole),
+        }
+        rest = from_brace.get(close + 1..).unwrap_or_default();
+    }
+    out.push_str(rest);
+    out
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
 pub enum Orientation {
     #[default]
@@ -161,15 +234,37 @@ impl Default for Settings {
 }
 
 /// Common paper sizes (points, portrait).
-pub const PAPERS: [(&str, (f64, f64)); 6] = [
+pub const PAPERS: [(&str, (f64, f64)); 18] = [
     ("US Letter", (612.0, 792.0)),
     ("US Legal", (612.0, 1008.0)),
     ("Tabloid", (792.0, 1224.0)),
     ("A3", (841.89, 1190.55)),
     ("A4", (595.28, 841.89)),
     ("A5", (419.53, 595.28)),
+    ("ARCH A (9 x 12 in)", (648.0, 864.0)),
+    ("ARCH B (12 x 18 in)", (864.0, 1296.0)),
+    ("ARCH C (18 x 24 in)", (1296.0, 1728.0)),
+    ("ARCH D (24 x 36 in)", (1728.0, 2592.0)),
+    ("ARCH E1 (30 x 42 in)", (2160.0, 3024.0)),
+    ("ARCH E (36 x 48 in)", (2592.0, 3456.0)),
+    ("ANSI C (17 x 22 in)", (1224.0, 1584.0)),
+    ("ANSI D (22 x 34 in)", (1584.0, 2448.0)),
+    ("ANSI E (34 x 44 in)", (2448.0, 3168.0)),
+    ("A2", (1190.55, 1683.78)),
+    ("A1", (1683.78, 2383.94)),
+    ("A0", (2383.94, 3370.39)),
 ];
 
+/// Match a displayed PDF page to a standard sheet, independent of orientation.
+/// Half a point allows rounded metric PDF dimensions without confusing distinct sizes.
+pub fn matching_paper(size: (f64, f64)) -> Option<usize> {
+    if !size.0.is_finite() || !size.1.is_finite() {
+        return None;
+    }
+    let size = (size.0.min(size.1), size.0.max(size.1));
+    PAPERS.iter().position(|(_, p)| (p.0 - size.0).abs() <= 0.5 && (p.1 - size.1).abs() <= 0.5)
+}
+
 /// The unprintable margin assumed around the sheet for Fit, Multiple and Booklet.
 pub const MARGIN: f64 = 18.0;
 
diff --git a/crates/print/src/range.rs b/crates/print/src/range.rs
index 2fea7541..07526194 100644
--- a/crates/print/src/range.rs
+++ b/crates/print/src/range.rs
@@ -19,11 +19,31 @@ fn page_of(tok: &str, count: usize, labels: &[String]) -> Result<usize, PrintErr
     }
     match t.parse::<usize>() {
         Ok(n) if n >= 1 && n <= count => Ok(n - 1),
-        Ok(n) => Err(PrintError::Invalid(format!("page {n} is out of range (1–{count})"))),
-        Err(_) => Err(PrintError::Invalid(format!("{t:?} is not a page number or label"))),
+        Ok(n) => Err(PrintError::OutOfRange(n, count)),
+        Err(_) => Err(PrintError::NotAPage(t.to_string())),
     }
 }
 
+/// Split a range whose endpoint is a logical page label containing a hyphen, such
+/// as "A-1-A-3" or "A-2-". The plain range parser must not mistake the first
+/// hyphen inside the label for the delimiter between endpoints.
+fn hyphenated_label_range(part: &str, count: usize, labels: &[String]) -> Option<(usize, usize)> {
+    for (split, _) in part.match_indices('-') {
+        let (Some(first), Some(last)) = (part.get(..split), part.get(split + 1..)) else { continue };
+        let (first, last) = (first.trim(), last.trim());
+        // Avoid changing the meaning of ordinary numeric and open-ended ranges.
+        if !labels.iter().any(|l| l.contains('-') && (l == first || l == last)) {
+            continue;
+        }
+        let from = if first.is_empty() { Some(0) } else { page_of(first, count, labels).ok() };
+        let to = if last.is_empty() { count.checked_sub(1) } else { page_of(last, count, labels).ok() };
+        if let (Some(from), Some(to)) = (from, to) {
+            return Some((from, to));
+        }
+    }
+    None
+}
+
 /// The pages to print (0-based, in print order). `range` is `None` for all pages; it may list
 /// numbers and labels with `-` ranges (open-ended allowed: `5-`, `-3`). The subset counts the
 /// selected pages (the first selected is "odd"), as Acrobat does.
@@ -33,6 +53,18 @@ pub fn select_pages(count: usize, range: Option<&str>, labels: &[String], subset
         None => pages.extend(0..count),
         Some(r) => {
             for part in r.split([',', ';']).map(str::trim).filter(|p| !p.is_empty()) {
+                // A complete label (e.g. "A-1") still wins over interpreting it as a range.
+                // A range of such labels (e.g. "A-1-A-3") needs a later '-' split.
+                if !labels.iter().any(|l| l == part)
+                    && let Some((from, to)) = hyphenated_label_range(part, count, labels)
+                {
+                    if from <= to {
+                        pages.extend(from..=to);
+                    } else {
+                        pages.extend((to..=from).rev());
+                    }
+                    continue;
+                }
                 match part.split_once('-') {
                     // A label may itself contain a dash ("A-1"): try the whole token first.
                     Some(_) if labels.iter().any(|l| l == part) => pages.push(page_of(part, count, labels)?),
@@ -58,7 +90,7 @@ pub fn select_pages(count: usize, range: Option<&str>, labels: &[String], subset
 /// labels. The subset and `reverse` apply as in [`select_pages`].
 pub fn select_listed(count: usize, pages: &[usize], subset: Subset, reverse: bool) -> Result<Vec<usize>, PrintError> {
     if let Some(p) = pages.iter().find(|p| **p >= count) {
-        return Err(PrintError::Invalid(format!("page {} is out of range (1–{count})", p.saturating_add(1))));
+        return Err(PrintError::OutOfRange(p.saturating_add(1), count));
     }
     narrow(pages.to_vec(), subset, reverse)
 }
diff --git a/crates/print/src/tests.rs b/crates/print/src/tests.rs
index 0cfead39..7f49df03 100644
--- a/crates/print/src/tests.rs
+++ b/crates/print/src/tests.rs
@@ -65,18 +65,65 @@ fn page_selection() {
     assert_eq!(select_pages(5, Some("ii-2, A-1"), &labels, Subset::All, false).unwrap(), [1, 2, 3, 4], "labels, even with a dash");
     assert_eq!(select_pages(5, None, &[], Subset::Even, true).unwrap(), [3, 1]);
     assert_eq!(select_pages(5, None, &[], Subset::Odd, false).unwrap(), [0, 2, 4]);
-    assert!(matches!(select_pages(5, Some("7"), &[], Subset::All, false), Err(PrintError::Invalid(_))));
-    assert!(matches!(select_pages(5, Some("x"), &[], Subset::All, false), Err(PrintError::Invalid(_))));
+    assert_eq!(select_pages(5, Some("7"), &[], Subset::All, false), Err(PrintError::OutOfRange(7, 5)));
+    assert_eq!(select_pages(5, Some("x"), &[], Subset::All, false), Err(PrintError::NotAPage("x".into())));
+    assert_eq!(select_pages(5, Some("7"), &[], Subset::All, false).unwrap_err().to_string(), "page 7 is out of range (1–5)");
     assert_eq!(select_pages(1, None, &[], Subset::Even, false), Err(PrintError::NoPages));
     // An explicit list (selected thumbnails): positions, never labels, in the order given.
     assert_eq!(select_listed(5, &[1, 3], Subset::All, false).unwrap(), [1, 3]);
     assert_eq!(select_listed(5, &[0, 2, 4], Subset::Even, false).unwrap(), [2]);
     assert_eq!(select_listed(5, &[0, 2, 4], Subset::Odd, true).unwrap(), [4, 0]);
-    assert!(matches!(select_listed(5, &[1, 5], Subset::All, false), Err(PrintError::Invalid(_))));
-    assert!(matches!(select_listed(0, &[usize::MAX], Subset::All, false), Err(PrintError::Invalid(_))));
+    assert_eq!(select_listed(5, &[1, 5], Subset::All, false), Err(PrintError::OutOfRange(6, 5)));
+    assert!(matches!(select_listed(0, &[usize::MAX], Subset::All, false), Err(PrintError::OutOfRange(_, 0))));
     assert_eq!(select_listed(5, &[], Subset::All, false), Err(PrintError::NoPages));
 }
 
+/// Every mistake a person can make about what to print says itself out of a wording on the list
+/// and the numbers apart from it, and says itself in English exactly as the error prints itself.
+#[test]
+fn wordings_are_said() {
+    let mistakes = [PrintError::NoPages, PrintError::OutOfRange(7, 5), PrintError::NotAPage("x".into())];
+    for e in &mistakes {
+        assert_eq!(e.said(&in_english), e.to_string(), "{e:?} says itself in English the way it prints itself");
+    }
+    // Each wording is one of a mistake's, and each mistake's is on the list: the hole names and
+    // all, so a catalog that translates the list translates every sentence a person can be shown.
+    let said: Vec<String> = WORDINGS.iter().map(|w| w.to_string()).collect();
+    assert_eq!(said.len(), mistakes.len(), "one wording per mistake");
+    for w in WORDINGS {
+        assert!(!w.is_empty() && w.ends_with(|c: char| c.is_alphanumeric() || c == ')'), "a whole sentence, not a fragment: {w:?}");
+    }
+    // A fault is not a mistake: it carries its own text and is not on the list.
+    let fault = PrintError::Spool("lp: no such printer".into());
+    assert_eq!(fault.said(&in_english), "lp: no such printer");
+    assert_eq!(fault.said(&|_| "traducido".to_string()), "lp: no such printer", "nothing to translate");
+    // Said in another language, the numbers still go in, and in that language's own order.
+    let other = |w: &str| match w {
+        "page {n} is out of range (1–{count})" => "el documento tiene {count} páginas, no {n}".to_string(),
+        w => w.to_string(),
+    };
+    assert_eq!(PrintError::OutOfRange(7, 5).said(&other), "el documento tiene 5 páginas, no 7");
+    // What was typed goes in as it stands, braces and all, and is never read as a hole.
+    assert_eq!(PrintError::NotAPage("{count}".into()).said(&other), "\"{count}\" is not a page number or label");
+}
+
+#[test]
+fn page_selection_handles_ranges_between_hyphenated_labels() {
+    let labels: Vec<String> = ["A-1", "A-2", "A-3", "B-1", "B-2"].iter().map(|s| s.to_string()).collect();
+    let pages = |range| select_pages(5, Some(range), &labels, Subset::All, false).unwrap();
+    assert_eq!(pages("A-1"), [0], "the complete label takes precedence over a range");
+    assert_eq!(pages("A-1-A-3"), [0, 1, 2]);
+    assert_eq!(pages("A-3-A-1"), [2, 1, 0], "reverse logical ranges");
+    assert_eq!(pages("A-2-"), [1, 2, 3, 4], "an open-ended range starting at a hyphenated label");
+    assert_eq!(pages("-A-2"), [0, 1], "an open-ended range ending at a hyphenated label");
+    assert_eq!(pages("A-2-5"), [1, 2, 3, 4], "a label followed by a numeric endpoint");
+    assert_eq!(pages("B-1-B-2"), [3, 4]);
+    // If an earlier dash yields one known label but an unknown endpoint, continue
+    // checking later dashes instead of rejecting the whole range.
+    let ambiguous: Vec<String> = ["A-1", "A-1-B", "C"].iter().map(|s| s.to_string()).collect();
+    assert_eq!(select_pages(3, Some("A-1-B-C"), &ambiguous, Subset::All, false).unwrap(), [1, 2]);
+}
+
 #[test]
 fn size_modes() {
     let sizes = [(200.0, 300.0), (1000.0, 1500.0)];
@@ -412,3 +459,30 @@ fn a_scaled_appearance_is_not_scaled_twice() {
     assert!(close(m.0[0], 2.0) && close(m.0[3], 2.0), "{:?}", m.0);
     assert!(close(m.0[4], 10.0) && close(m.0[5], 10.0), "{:?}", m.0);
 }
+
+#[test]
+fn architectural_sheets_preserve_full_scale() {
+    let index = matching_paper((2592.0, 1728.0)).unwrap();
+    assert_eq!(PAPERS[index].0, "ARCH D (24 x 36 in)");
+    assert_eq!(matching_paper((1728.0, 2592.0)), Some(index));
+    assert_eq!(matching_paper((f64::NAN, 2592.0)), None);
+    let s = Settings { pages: vec![0], paper: PAPERS[index].1, layout: Layout::Size(SizeMode::Actual), ..Settings::default() };
+    let sheets = layout(&[(2592.0, 1728.0)], &s).unwrap();
+    assert_eq!(sheets[0].size, (2592.0, 1728.0));
+    assert_eq!(sheets[0].placed[0].matrix.0, [1.0, 0.0, 0.0, 1.0, 0.0, 0.0]);
+    let fit = layout(&[(2592.0, 1728.0)], &Settings { layout: Layout::Size(SizeMode::Fit), ..s }).unwrap();
+    assert!(fit[0].placed[0].matrix.0[0] < 1.0, "Fit adds margins and must not masquerade as full scale");
+}
+
+#[test]
+fn paper_matching_accepts_rounded_metric_sizes_but_not_custom_or_invalid_sizes() {
+    for (i, (_, (w, h))) in PAPERS.iter().enumerate() {
+        assert_eq!(matching_paper((*w, *h)), Some(i));
+        assert_eq!(matching_paper((*h, *w)), Some(i));
+        assert_eq!(matching_paper((w.round(), h.round())), Some(i));
+        assert_eq!(matching_paper((w + 0.51, *h)), None);
+    }
+    for size in [(0.0, 0.0), (-1728.0, 2592.0), (f64::INFINITY, 2592.0), (1728.0, f64::NAN), (1000.0, 1000.0)] {
+        assert_eq!(matching_paper(size), None);
+    }
+}
diff --git a/crates/redact/src/interp.rs b/crates/redact/src/interp.rs
index 4a607ddd..cd496c33 100644
--- a/crates/redact/src/interp.rs
+++ b/crates/redact/src/interp.rs
@@ -38,6 +38,10 @@ pub(crate) enum Mode {
 struct Gs {
     ctm: Matrix,
     font: Rc<Metrics>,
+    /// The current font writes vertically (a Type0 font with an `-V` encoding or a CMap whose
+    /// `/WMode` is 1). Glyph layout here is horizontal, so such text cannot be placed under a
+    /// region; apply fails closed when it meets any (see `show`).
+    vertical: bool,
     size: f64,
     char_spacing: f64,
     word_spacing: f64,
@@ -54,8 +58,15 @@ pub(crate) struct Output {
     pub streams: Vec<Option<Vec<u8>>>,
     /// New XObjects the rewritten content refers to: (resource name, object).
     pub xobjects: Vec<(Vec<u8>, ObjRef)>,
+    /// Resource names whose `Do` this scope dropped or pointed at a cleaned copy, so the caller
+    /// can unlink the original from the resource dictionary (a full save keeps whatever is still
+    /// referenced, which would otherwise retain the removed image or form bytes).
+    pub replaced: Vec<Vec<u8>>,
     /// Glyphs / inline images still overlapping a region (verify mode).
     pub residue: usize,
+    /// Apply mode met vertical-writing text (which it cannot remove) while a redaction region was
+    /// in force: the operation must fail closed rather than leave that text under the mark.
+    pub vertical: bool,
 }
 
 pub(crate) struct Scope<'a> {
@@ -148,6 +159,20 @@ fn res_dict(doc: &Document, res: &Dict, key: &[u8]) -> Dict {
     res.get(key).map(|o| doc.resolve(o)).and_then(|o| o.as_dict().cloned()).unwrap_or_default()
 }
 
+/// Does this font write vertically? Only a Type0 (composite) font can: its `/Encoding` is a
+/// predefined CMap name ending in `-V` (Identity-V and the like), or an embedded CMap stream
+/// whose `/WMode` is 1 (ISO 32000-2 §9.7.5).
+fn is_vertical(doc: &Document, font: &Dict) -> bool {
+    if font.name(b"Subtype") != Some(b"Type0".as_slice()) {
+        return false;
+    }
+    match font.get(b"Encoding").map(|e| doc.resolve(e)).as_deref() {
+        Some(Object::Name(n)) => n.ends_with(b"-V"),
+        Some(Object::Stream(s)) => s.dict.int(b"WMode") == Some(1),
+        _ => false,
+    }
+}
+
 fn fresh_name(scope: &mut Scope<'_>, xobjects: &Dict) -> Vec<u8> {
     let mut i = scope.used_names.len() + 1;
     loop {
@@ -160,6 +185,23 @@ fn fresh_name(scope: &mut Scope<'_>, xobjects: &Dict) -> Vec<u8> {
     }
 }
 
+/// Drop every `replaced` resource name whose `Do` no longer appears in the rewritten `content`,
+/// so a full-rewrite save stops reaching the original image or form it named. A name that some
+/// surviving `Do` still draws (the same image shown again outside a mark) is kept.
+pub(crate) fn prune(xo: &mut Dict, replaced: &[Vec<u8>], content: &[Vec<u8>]) {
+    if replaced.is_empty() {
+        return;
+    }
+    let joined = Pieces::join(content);
+    let ops = joined.parse().ops;
+    let still_drawn = |n: &[u8]| ops.iter().any(|op| op.is("Do") && op.name(0) == Some(n));
+    for n in replaced {
+        if !still_drawn(n) {
+            xo.remove(n);
+        }
+    }
+}
+
 /// The clip that hides everything inside each region: one even-odd clip per region (a big
 /// rectangle with the region cut out), in the current user space. Returns `None` when the CTM
 /// can't be inverted (nothing is painted then anyway).
@@ -195,8 +237,18 @@ struct Glyph {
 pub(crate) fn process(doc: &mut Document, scope: &mut Scope<'_>, streams: &[Vec<u8>], resources: &Dict, ctm: Matrix) -> Output {
     let mut out = Output::default();
     let fallback = Rc::new(Metrics::fallback());
-    let mut gs =
-        Gs { ctm, font: fallback.clone(), size: 0.0, char_spacing: 0.0, word_spacing: 0.0, render_mode: 0, scale: 1.0, leading: 0.0, rise: 0.0 };
+    let mut gs = Gs {
+        ctm,
+        font: fallback.clone(),
+        vertical: false,
+        size: 0.0,
+        char_spacing: 0.0,
+        word_spacing: 0.0,
+        render_mode: 0,
+        scale: 1.0,
+        leading: 0.0,
+        rise: 0.0,
+    };
     let mut stack: Vec<Gs> = Vec::new();
     let (mut tm, mut tlm) = (Matrix::IDENTITY, Matrix::IDENTITY);
     let fonts_res = res_dict(doc, resources, b"Font");
@@ -329,14 +381,12 @@ pub(crate) fn process(doc: &mut Document, scope: &mut Scope<'_>, streams: &[Vec<
                 b"Tf" => {
                     gs.size = op.num(1).unwrap_or(gs.size);
                     if let Some(name) = op.name(0) {
+                        let font_dict = fonts_res.get(name).and_then(|f| doc.resolve(f).as_dict().cloned());
+                        gs.vertical = font_dict.as_ref().is_some_and(|d| is_vertical(doc, d));
                         gs.font = match scope.fonts.get(name) {
                             Some(f) => f.clone(),
                             None => {
-                                let m = fonts_res
-                                    .get(name)
-                                    .and_then(|f| doc.resolve(f).as_dict().cloned())
-                                    .map(|d| Rc::new(Metrics::from_dict(doc, &d)))
-                                    .unwrap_or_else(|| fallback.clone());
+                                let m = font_dict.as_ref().map(|d| Rc::new(Metrics::from_dict(doc, d))).unwrap_or_else(|| fallback.clone());
                                 scope.fonts.insert(name.to_vec(), m.clone());
                                 m
                             }
@@ -381,6 +431,18 @@ pub(crate) fn process(doc: &mut Document, scope: &mut Scope<'_>, streams: &[Vec<
                         b"TJ" => op.operands.first().and_then(Object::as_array).cloned().unwrap_or_default(),
                         _ => op.operands.last().cloned().into_iter().collect(),
                     };
+                    // Vertical-writing text is laid out horizontally by `show`, so its glyphs are
+                    // never matched against a region. Rather than ship a document whose vertical
+                    // text was silently left under a mark, record it so apply can fail closed.
+                    // (Full vertical-text removal is a future enhancement.)
+                    if gs.vertical
+                        && scope.mode == Mode::Apply
+                        && scope.hidden_text.is_none()
+                        && !scope.rects.is_empty()
+                        && items.iter().any(|o| matches!(o, Object::String(s) if !s.bytes.is_empty()))
+                    {
+                        out.vertical = true;
+                    }
                     let (new_items, removed) = show(scope, &gs, &mut tm, &items);
                     if removed == 0 {
                         ops.push(op);
@@ -543,6 +605,7 @@ fn xobject(
                 return None;
             }
             scope.layer_blocks += 1;
+            out.replaced.push(name);
             Some(None)
         }
         Some(b"Image") => {
@@ -552,6 +615,7 @@ fn xobject(
             }
             if scope.covered(b) {
                 scope.report.images_removed += 1;
+                out.replaced.push(name);
                 return Some(None);
             }
             match image::clear(doc, s, &gs.ctm, scope.rects) {
@@ -561,11 +625,13 @@ fn xobject(
                     let n = fresh_name(scope, xobjects);
                     xobjects.set(n.clone(), Object::Ref(nr));
                     out.xobjects.push((n.clone(), nr));
+                    out.replaced.push(name);
                     scope.report.images_cleared += 1;
                     Some(Some(Op::new("Do", vec![Object::Name(n)])))
                 }
                 Err(()) => {
                     scope.report.images_removed += 1;
+                    out.replaced.push(name);
                     Some(None)
                 }
             }
@@ -588,12 +654,14 @@ fn xobject(
                     return None;
                 }
                 scope.report.forms_removed += 1;
+                out.replaced.push(name);
                 return Some(None);
             }
             let data = match s.decoded() {
                 Ok(d) => d,
                 Err(_) if scope.mode == Mode::Apply => {
                     scope.report.forms_removed += 1;
+                    out.replaced.push(name);
                     return Some(None);
                 }
                 Err(_) => return None,
@@ -606,18 +674,24 @@ fn xobject(
             scope.depth -= 1;
             scope.fonts = saved_fonts;
             out.residue += inner.residue;
+            out.vertical |= inner.vertical;
             if scope.mode == Mode::Verify {
                 return None;
             }
             let new_data = inner.streams.into_iter().next().flatten();
-            if new_data.is_none() && inner.xobjects.is_empty() {
+            if new_data.is_none() && inner.xobjects.is_empty() && inner.replaced.is_empty() {
                 return None;
             }
             let mut dict = s.dict.clone();
             dict.remove(b"Length");
-            if !inner.xobjects.is_empty() {
+            // Rebuild the copy's /Resources whenever inner content gained or lost an XObject, so a
+            // `Do` the copy no longer makes stops keeping the original image or form reachable.
+            if !inner.xobjects.is_empty() || !inner.replaced.is_empty() {
                 let mut res = res;
                 let mut xo = res_dict(doc, &res, b"XObject");
+                if let Some(d) = &new_data {
+                    prune(&mut xo, &inner.replaced, std::slice::from_ref(d));
+                }
                 for (n, r) in &inner.xobjects {
                     xo.set(n.clone(), Object::Ref(*r));
                 }
@@ -632,6 +706,7 @@ fn xobject(
             let n = fresh_name(scope, xobjects);
             xobjects.set(n.clone(), Object::Ref(nr));
             out.xobjects.push((n.clone(), nr));
+            out.replaced.push(name);
             scope.report.forms_rewritten += 1;
             Some(Some(Op::new("Do", vec![Object::Name(n)])))
         }
diff --git a/crates/redact/src/lib.rs b/crates/redact/src/lib.rs
index 17db7404..4ceef50b 100644
--- a/crates/redact/src/lib.rs
+++ b/crates/redact/src/lib.rs
@@ -37,6 +37,8 @@ pub enum RedactError {
     Unreadable(usize),
     #[error("redaction could not be verified: {0} item(s) were still found under the marks, so nothing was changed")]
     Residue(usize),
+    #[error("page {0} has vertical-writing text under a redaction mark, which PdfCraft cannot remove yet, so nothing was changed")]
+    VerticalText(usize),
     #[error(transparent)]
     Edit(#[from] pdfcraft_edit::EditError),
     #[error(transparent)]
@@ -107,6 +109,9 @@ pub struct Report {
     pub fields: usize,
     /// Structure elements that lost alternate/actual text or emptied marked content.
     pub tags: usize,
+    /// The form was an AcroForm+XFA form and its `/XFA` packets (which still held redacted field
+    /// values, and from which a relayout could rebuild them) were removed.
+    pub xfa_removed: bool,
 }
 
 fn rect_of(doc: &Document, o: Option<&Object>) -> Option<[f64; 4]> {
@@ -292,6 +297,13 @@ pub fn apply(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Reda
             let mut scope = Scope::new(&rects, Mode::Apply, &mut report);
             process(doc, &mut scope, &data, &resources, pdfcraft_content::Matrix::IDENTITY)
         };
+        // Fail closed: the interpreter lays vertical-writing text out horizontally, so it cannot
+        // place such glyphs under a mark or confirm they are gone. Rather than report success and
+        // ship the text under the box, refuse the whole operation (the caller keeps the previous
+        // document). Full vertical-text removal is a future enhancement.
+        if out.vertical {
+            return Err(RedactError::VerticalText(pi + 1));
+        }
         let mut new_list = list.clone();
         let mut changed = false;
         for (i, new) in out.streams.into_iter().enumerate() {
@@ -309,10 +321,20 @@ pub fn apply(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Reda
             new_list[i] = Object::Ref(doc.add(Object::Stream(Stream::flate(dict, &bytes))));
             changed = true;
         }
-        if changed || !out.xobjects.is_empty() {
+        if changed || !out.xobjects.is_empty() || !out.replaced.is_empty() {
             let mut res = resources;
-            if !out.xobjects.is_empty() {
+            if !out.xobjects.is_empty() || !out.replaced.is_empty() {
                 let mut xo = res.get(b"XObject").and_then(|x| doc.resolve(x).as_dict().cloned()).unwrap_or_default();
+                // A full save keeps whatever is still referenced: unlink the originals this page no
+                // longer draws so the removed image or form bytes cannot survive in the saved file.
+                let page_content: Vec<Vec<u8>> = new_list
+                    .iter()
+                    .map(|o| match &*doc.resolve(o) {
+                        Object::Stream(s) => s.decoded().unwrap_or_default(),
+                        _ => Vec::new(),
+                    })
+                    .collect();
+                interp::prune(&mut xo, &out.replaced, &page_content);
                 for (n, r) in &out.xobjects {
                     xo.set(n.clone(), Object::Ref(*r));
                 }
@@ -388,6 +410,37 @@ pub fn apply(doc: &mut Document, pages: Option<&[usize]>) -> Result<Report, Reda
         }
     }
 
+    // 3b. An XFA form mirrors its field values in the /XFA datasets packet, and a relayout
+    // rebuilds fields and pages from that packet, so deleting the AcroForm field alone leaves the
+    // redacted value in the file and lets a later relayout put it back. Once redactions are
+    // applied the form stops being XFA: drop /AcroForm /XFA (template and datasets), the catalog's
+    // /NeedsRendering, and PdfCraft's own layout mark (pdfcraft_xfa::LAYOUT_KEY), leaving a plain
+    // already-laid-out AcroForm that neither the saved file nor a relayout can restore from.
+    if let Some(root) = doc.root() {
+        let strip_xfa = |d: &mut Dict| {
+            d.remove(b"XFA");
+            d.remove(b"PCXfaLayout");
+        };
+        match doc.get(root).as_dict().and_then(|d| d.get(b"AcroForm").cloned()) {
+            Some(Object::Ref(af)) if doc.get(af).as_dict().is_some_and(|d| d.contains(b"XFA")) => {
+                doc.update_dict(af, strip_xfa)?;
+                doc.update_dict(root, |d| {
+                    d.remove(b"NeedsRendering");
+                })?;
+                report.xfa_removed = true;
+            }
+            Some(Object::Dict(mut af)) if af.contains(b"XFA") => {
+                strip_xfa(&mut af);
+                doc.update_dict(root, |d| {
+                    d.set(b"AcroForm".to_vec(), Object::Dict(af));
+                    d.remove(b"NeedsRendering");
+                })?;
+                report.xfa_removed = true;
+            }
+            _ => {}
+        }
+    }
+
     // 4. The boxes.
     for &pi in &by_page {
         let page_marks: Vec<&Mark> = chosen.iter().copied().filter(|m| m.page == pi).collect();
diff --git a/crates/redact/src/sanitize.rs b/crates/redact/src/sanitize.rs
index 11756bba..180e6cc9 100644
--- a/crates/redact/src/sanitize.rs
+++ b/crates/redact/src/sanitize.rs
@@ -178,10 +178,20 @@ fn content_pass(doc: &mut Document, text: bool, layers: bool, write: bool) -> Re
             new_list[i] = Object::Ref(doc.add(Object::Stream(pdfcraft_cos::Stream::flate(dict, &bytes))));
             changed = true;
         }
-        if changed || !out.xobjects.is_empty() {
+        if changed || !out.xobjects.is_empty() || !out.replaced.is_empty() {
             let mut res = resources;
-            if !out.xobjects.is_empty() {
+            if !out.xobjects.is_empty() || !out.replaced.is_empty() {
                 let mut xo = res.get(b"XObject").and_then(|x| doc.resolve(x).as_dict().cloned()).unwrap_or_default();
+                // A full save keeps whatever is still referenced: unlink the originals this page no
+                // longer draws so the removed form or image bytes cannot survive in the saved file.
+                let page_content: Vec<Vec<u8>> = new_list
+                    .iter()
+                    .map(|o| match &*doc.resolve(o) {
+                        Object::Stream(s) => s.decoded().unwrap_or_default(),
+                        _ => Vec::new(),
+                    })
+                    .collect();
+                crate::interp::prune(&mut xo, &out.replaced, &page_content);
                 for (n, r) in &out.xobjects {
                     xo.set(n.clone(), Object::Ref(*r));
                 }
diff --git a/crates/redact/src/tests.rs b/crates/redact/src/tests.rs
index c8b913c0..ef725674 100644
--- a/crates/redact/src/tests.rs
+++ b/crates/redact/src/tests.rs
@@ -203,6 +203,48 @@ fn rotated_text_and_composite_fonts() {
     assert!(c.contains("[<0001> -750 <0004>] TJ") || c.contains("[(\\000\\001) -750 (\\000\\004)] TJ"), "{c}");
 }
 
+#[test]
+fn vertical_writing_text_under_a_mark_fails_closed() {
+    // A Type0 font laid out vertically (Identity-V / CMap WMode 1) cannot have its glyphs placed
+    // under a mark by the horizontal interpreter, so Apply Redactions must fail rather than ship
+    // the text under the box. The horizontal control (Identity-H) is redacted normally.
+    let make = |encoding: &str| -> Document {
+        let t0 = format!(
+            "<< /Type /Font /Subtype /Type0 /BaseFont /X /Encoding /{encoding} /DescendantFonts [<< /Type /Font /Subtype /CIDFontType2 /BaseFont /X /DW 1000 /W [1 [500 500] 3 4 250] >>] >>"
+        )
+        .into_bytes();
+        let src = b"BT /F2 10 Tf 0 1 -1 0 100 50 Tm <0001000200030004> Tj ET";
+        let mut doc = one_page(src, "", vec![]);
+        let font_ref = doc.add(Object::Dict(Dict::new()));
+        let parsed = {
+            let mut lx = pdfcraft_cos::Lexer::new(&t0, 0);
+            lx.object().unwrap()
+        };
+        doc.set(font_ref, parsed);
+        let page = pdfcraft_model::pages(&doc)[0].obj;
+        doc.update_dict(page, |d| {
+            let mut res = d.get(b"Resources").and_then(Object::as_dict).cloned().unwrap();
+            let mut fonts = res.get(b"Font").and_then(Object::as_dict).cloned().unwrap();
+            fonts.set(b"F2".to_vec(), Object::Ref(font_ref));
+            res.set(b"Font".to_vec(), Object::Dict(fonts));
+            d.set(b"Resources".to_vec(), Object::Dict(res));
+        })
+        .unwrap();
+        doc
+    };
+
+    // Identity-V: apply must refuse rather than report success with the text still in the file.
+    let mut vdoc = make("Identity-V");
+    mark(&mut vdoc, 0, &[[85.0, 55.5, 105.0, 61.0]], "");
+    assert_eq!(apply(&mut vdoc, None), Err(RedactError::VerticalText(1)), "vertical text under a mark must not silently pass");
+
+    // Identity-H control: the same glyphs and mark are redacted normally.
+    let mut hdoc = make("Identity-H");
+    mark(&mut hdoc, 0, &[[85.0, 55.5, 105.0, 61.0]], "");
+    let r = apply(&mut hdoc, None).unwrap();
+    assert_eq!(r.glyphs, 2, "the horizontal control is redacted: {r:?}");
+}
+
 #[test]
 fn images_are_removed_or_have_their_pixels_cleared() {
     // Image 1 is fully covered; image 2 (4×1 gray, all white) is half covered.
@@ -262,6 +304,94 @@ fn shared_form_xobjects_are_copied_not_changed() {
     assert_eq!(under(&mut doc, 0, &[[0.0, 90.0, 300.0, 120.0]]), 0);
 }
 
+#[test]
+fn redacted_images_and_forms_do_not_survive_a_full_rewrite_save() {
+    // Page 1 draws a fully covered image, a partly covered image and a form XObject whose text
+    // is under the mark. After Apply Redactions and the forced full rewrite, none of their secret
+    // bytes may stay in the saved file, while an unrelated image drawn only on page 2 survives.
+    let im1 = b"REDIMGONECOVERED"; // 16 bytes, one gray row
+    let impart = b"REDIMGPARTSECRETPUBPARTBOTTOMROW"; // 16-byte secret top row + 16-byte bottom row
+    let imkeep = b"PUBIMGKEEPSURVIVE"; // 17 bytes, used only on page 2
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R 10 0 R] /Count 2 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> /XObject << /Im1 7 0 R /ImPart 8 0 R /FmSecret 9 0 R >> >> >>".to_vec(),
+        stream("", b"q 50 0 0 50 20 230 cm /Im1 Do Q q 50 0 0 100 100 180 cm /ImPart Do Q /FmSecret Do"),
+        FONT.replace("95 0 R", "6 0 R").into_bytes(),
+        widths(),
+        stream("/Type /XObject /Subtype /Image /Width 16 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", im1),
+        stream("/Type /XObject /Subtype /Image /Width 16 /Height 2 /ColorSpace /DeviceGray /BitsPerComponent 8", impart),
+        stream(
+            "/Type /XObject /Subtype /Form /BBox [0 0 300 300] /Resources << /Font << /F1 5 0 R >> >>",
+            b"BT /F1 10 Tf 20 230 Td (REDFORMSECRETTEXT) Tj ET",
+        ),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 11 0 R /Resources << /XObject << /ImKeep 12 0 R >> >> >>".to_vec(),
+        stream("", b"q 50 0 0 50 20 20 cm /ImKeep Do Q"),
+        stream("/Type /XObject /Subtype /Image /Width 17 /Height 1 /ColorSpace /DeviceGray /BitsPerComponent 8", imkeep),
+    ];
+    let mut doc = pdf(objs);
+    mark(&mut doc, 0, &[[0.0, 200.0, 300.0, 300.0]], "");
+    let r = apply(&mut doc, None).unwrap();
+    assert!(r.images_removed >= 1 && r.forms_rewritten >= 1, "{r:?}");
+
+    // The full rewrite that redaction forces must not carry the removed content forward.
+    let bytes = write_full(&doc, &SaveOptions::default()).unwrap();
+    let has = |needle: &[u8]| bytes.windows(needle.len()).any(|w| w == needle);
+    assert!(!has(b"REDIMGONECOVERED"), "covered image samples survived the save");
+    assert!(!has(b"REDIMGPARTSECRET"), "partly covered image's secret row survived the save");
+    assert!(!has(b"REDFORMSECRETTEXT"), "the form's redacted text survived the save");
+
+    // The unrelated image drawn only on page 2 stays referenced and intact.
+    let saved = Document::open(Arc::new(bytes)).unwrap();
+    let keep = pdfcraft_model::pages(&saved).swap_remove(1);
+    let res = saved.resolve(keep.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+    let xo = saved.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+    let kref = xo.get(b"ImKeep").and_then(Object::as_ref).expect("ImKeep still referenced");
+    let Object::Stream(s) = &*saved.get(kref) else { panic!("ImKeep is a stream") };
+    assert_eq!(s.decoded().unwrap(), imkeep, "the unrelated image survives intact");
+}
+
+#[test]
+fn redacting_an_xfa_field_drops_the_xfa_packet_so_its_value_cannot_survive() {
+    // A static AcroForm+XFA form whose field value lives both in the widget /V and in the XFA
+    // datasets packet (Designer-style /XFA array). Redacting the widget must delete the field and
+    // stop the form being XFA, so neither the saved file nor a later relayout keeps the value.
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R /NeedsRendering true /AcroForm 7 0 R >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> /Annots [8 0 R] >>".to_vec(),
+        stream("", b"BT ET"),
+        FONT.replace("95 0 R", "6 0 R").into_bytes(),
+        widths(),
+        b"<< /Fields [8 0 R] /XFA 9 0 R /PCXfaLayout << /Pages 1 /Fields 1 >> >>".to_vec(),
+        b"<< /Type /Annot /Subtype /Widget /FT /Tx /T (ssn) /V (SSN-987-65-4321) /Rect [72 200 272 220] /P 3 0 R >>".to_vec(),
+        b"[(datasets) 10 0 R (template) 11 0 R]".to_vec(),
+        stream(
+            "",
+            b"<xfa:datasets xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0/\"><xfa:data><ssn>SSN-987-65-4321</ssn></xfa:data></xfa:datasets>",
+        ),
+        stream(
+            "",
+            b"<template xmlns=\"http://www.xfa.org/schema/xfa-template/3.3/\"><subform name=\"form1\"><field name=\"ssn\"/></subform></template>",
+        ),
+    ];
+    let mut doc = pdf(objs);
+    assert_eq!(pdfcraft_forms::fields(&doc).len(), 1, "the XFA-bound field is present before");
+    mark(&mut doc, 0, &[[72.0, 200.0, 272.0, 220.0]], "");
+    let r = apply(&mut doc, None).unwrap();
+    assert!(r.fields >= 1 && r.xfa_removed, "{r:?}");
+
+    let bytes = write_full(&doc, &SaveOptions::default()).unwrap();
+    assert!(!bytes.windows(15).any(|w| w == b"SSN-987-65-4321"), "the redacted value survived in the datasets packet");
+
+    let saved = Document::open(Arc::new(bytes)).unwrap();
+    let cat = saved.get(saved.root().unwrap()).as_dict().cloned().unwrap();
+    let acro = saved.resolve(cat.get(b"AcroForm").unwrap()).as_dict().cloned().unwrap();
+    assert!(acro.get(b"XFA").is_none(), "/XFA is gone from the saved AcroForm");
+    assert!(acro.get(b"PCXfaLayout").is_none(), "the cached layout mark is cleared");
+    assert!(cat.get(b"NeedsRendering").is_none(), "/NeedsRendering is cleared");
+}
+
 #[test]
 fn comments_links_and_fields_under_a_mark_go() {
     let mut doc = one_page(b"", "", vec![]);
diff --git a/crates/render/src/inspect.rs b/crates/render/src/inspect.rs
index ab20f560..d22d63c5 100644
--- a/crates/render/src/inspect.rs
+++ b/crates/render/src/inspect.rs
@@ -921,7 +921,9 @@ impl<'a> Inspector<'a> {
                     page,
                     subtype,
                     author: self.text(d, b"T"),
-                    contents: self.text(d, b"Contents"),
+                    // Acrobat ends lines with CR, which the interface would draw as nothing (keep
+                    // in step with `pdfcraft_annot::summaries`).
+                    contents: self.text(d, b"Contents").map(|s| s.replace("\r\n", "\n").replace('\r', "\n")),
                     modified: self.text(d, b"M").map(|m| pretty_date(&m)),
                     name: self.text(d, b"NM"),
                     in_reply_to,
@@ -2233,6 +2235,35 @@ trailer << /Root 1 0 R >>
         assert!(info.warnings.is_empty(), "{:?}", info.warnings);
     }
 
+    #[test]
+    fn carriage_returns_in_comment_text_become_line_breaks() {
+        use lopdf::dictionary;
+
+        let mut doc = Document::with_version("1.7");
+        let pages_id = doc.new_object_id();
+        let annot_id = doc.add_object(dictionary! {
+            "Type" => "Annot",
+            "Subtype" => "Text",
+            "Rect" => vec![10.into(), 10.into(), 30.into(), 30.into()],
+            // Acrobat ends lines in /Contents with CR; the interface only breaks lines at LF.
+            "Contents" => Object::string_literal("one\r\rtwo\r\nthree"),
+        });
+        let page_id = doc.add_object(dictionary! {
+            "Type" => "Page",
+            "Parent" => pages_id,
+            "MediaBox" => vec![0.into(), 0.into(), 200.into(), 300.into()],
+            "Annots" => vec![annot_id.into()],
+        });
+        doc.objects.insert(pages_id, dictionary! { "Type" => "Pages", "Kids" => vec![page_id.into()], "Count" => 1 }.into());
+        let catalog_id = doc.add_object(dictionary! { "Type" => "Catalog", "Pages" => pages_id });
+        doc.trailer.set("Root", catalog_id);
+        let mut bytes = Vec::new();
+        doc.save_to(&mut bytes).expect("write synthetic fixture");
+
+        let info = inspect(Arc::new(bytes), None).expect("opens");
+        assert_eq!(info.annotations[0].contents.as_deref(), Some("one\n\ntwo\nthree"));
+    }
+
     #[test]
     fn dates_are_prettified() {
         assert_eq!(pretty_date("D:20260930104512-04'00'"), "2026-09-30 10:45");
diff --git a/crates/render/src/raster.rs b/crates/render/src/raster.rs
index e6b635ef..f05a8112 100644
--- a/crates/render/src/raster.rs
+++ b/crates/render/src/raster.rs
@@ -2099,48 +2099,59 @@ mod tests {
     // Metadata-only: the test budget is 128 pixels and no image buffer is allocated.
     #[test]
     fn image_resampling_rejects_anisotropic_target_growth() {
-        assert_eq!(hayro::image_resampling_size(16, 1, 1, 16, 0.5, 32.0, 128), None);
-        assert_eq!(hayro::image_resampling_size(16, 1, 3, 48, 0.5, 32.0, 128), None);
-        assert_eq!(hayro::image_resampling_size(16, 1, 4, 64, 0.5, 32.0, 128), None);
+        assert_eq!(hayro::image_resampling_size(16, 1, 1, 16, 0.5, 32.0, 128, true), None);
+        assert_eq!(hayro::image_resampling_size(16, 1, 3, 48, 0.5, 32.0, 128, true), None);
+        assert_eq!(hayro::image_resampling_size(16, 1, 4, 64, 0.5, 32.0, 128, true), None);
     }
 
     #[test]
     fn image_resampling_bounds_intermediate_before_planning() {
         // Source and destination are each 128 pixels, but their crossed dimensions are 256.
-        assert_eq!(hayro::image_resampling_size(16, 8, 4, 512, 0.5, 2.0, 128), None);
+        assert_eq!(hayro::image_resampling_size(16, 8, 4, 512, 0.5, 2.0, 128, true), None);
     }
 
     #[test]
     fn image_resampling_rejects_invalid_sources_and_scales() {
-        assert_eq!(hayro::image_resampling_size(4, 4, 3, 47, 0.5, 0.5, 128), None);
-        assert_eq!(hayro::image_resampling_size(4, 4, 3, 49, 0.5, 0.5, 128), None);
+        assert_eq!(hayro::image_resampling_size(4, 4, 3, 47, 0.5, 0.5, 128, true), None);
+        assert_eq!(hayro::image_resampling_size(4, 4, 3, 49, 0.5, 0.5, 128, true), None);
         for scale in [f32::NAN, f32::INFINITY, f32::NEG_INFINITY, -1.0, 0.0] {
-            assert_eq!(hayro::image_resampling_size(4, 4, 3, 48, 0.5, scale, 128), None);
+            assert_eq!(hayro::image_resampling_size(4, 4, 3, 48, 0.5, scale, 128, true), None);
         }
     }
 
     #[test]
     fn image_resampling_keeps_valid_sizes_and_exact_limits() {
-        assert_eq!(hayro::image_resampling_size(16, 8, 1, 128, 0.5, 0.5, 128), Some((8, 4)));
-        assert_eq!(hayro::image_resampling_size(16, 1, 3, 48, 0.5, 8.0, 128), Some((8, 8)));
-        assert_eq!(hayro::image_resampling_size(16, 8, 4, 512, 1.0, 1.0, 128), Some((16, 8)));
-        assert_eq!(hayro::image_resampling_size(0, 8, 1, 0, 1.0, 1.0, 128), None);
-        assert_eq!(hayro::image_resampling_size(16, 9, 1, 144, 1.0, 1.0, 128), None);
-        assert_eq!(hayro::image_resampling_size(65_536, 1, 1, 65_536, 1.0, 1.0, u64::MAX), None);
+        assert_eq!(hayro::image_resampling_size(16, 8, 1, 128, 0.5, 0.5, 128, true), Some((8, 4)));
+        assert_eq!(hayro::image_resampling_size(16, 1, 3, 48, 0.5, 8.0, 128, true), Some((8, 8)));
+        assert_eq!(hayro::image_resampling_size(16, 8, 4, 512, 1.0, 1.0, 128, true), Some((16, 8)));
+        assert_eq!(hayro::image_resampling_size(0, 8, 1, 0, 1.0, 1.0, 128, true), None);
+        assert_eq!(hayro::image_resampling_size(16, 9, 1, 144, 1.0, 1.0, 128, true), None);
+        assert_eq!(hayro::image_resampling_size(65_536, 1, 1, 65_536, 1.0, 1.0, u64::MAX, true), None);
         for channels in [1, 3, 4] {
-            assert_eq!(hayro::image_resampling_size(65_536, 1, channels, 65_536 * channels, 1.0 / 4096.0, 1.0, 65_536), Some((16, 1)));
+            assert_eq!(hayro::image_resampling_size(65_536, 1, channels, 65_536 * channels, 1.0 / 4096.0, 1.0, 65_536, true), Some((16, 1)));
         }
-        assert_eq!(hayro::image_resampling_size(65_535, 1, 1, 65_535, 1.0, 1.0, 65_535), Some((65_535, 1)));
-        assert_eq!(hayro::image_resampling_size((1 << 20) + 1, 1, 1, (1 << 20) + 1, 1.0 / 4096.0, 1.0, 1 << 28), None);
+        assert_eq!(hayro::image_resampling_size(65_535, 1, 1, 65_535, 1.0, 1.0, 65_535, true), Some((65_535, 1)));
+        assert_eq!(hayro::image_resampling_size((1 << 20) + 1, 1, 1, (1 << 20) + 1, 1.0 / 4096.0, 1.0, 1 << 28, true), None);
     }
 
     #[test]
     fn image_resampling_padded_backend_dimensions_stay_checked() {
         // A Type 3 image's two-pixel frame may reach u16::MAX exactly, never wrap to zero.
-        assert_eq!(hayro::image_resampling_size(65_531 + 4, 1 + 4, 4, 65_535 * 5 * 4, 1.0, 1.0, 65_535 * 5), Some((65_535, 5)));
-        assert_eq!(hayro::image_resampling_size(65_531 + 4, 1 + 4, 4, 65_535 * 5 * 4, 1.0, 1.0, 65_535 * 5 - 1), None);
-        assert_eq!(hayro::image_resampling_size(65_532 + 4, 1 + 4, 4, 65_536 * 5 * 4, 1.0, 1.0, 1 << 28), None);
+        assert_eq!(hayro::image_resampling_size(65_531 + 4, 1 + 4, 4, 65_535 * 5 * 4, 1.0, 1.0, 65_535 * 5, true), Some((65_535, 5)));
+        assert_eq!(hayro::image_resampling_size(65_531 + 4, 1 + 4, 4, 65_535 * 5 * 4, 1.0, 1.0, 65_535 * 5 - 1, true), None);
+        assert_eq!(hayro::image_resampling_size(65_532 + 4, 1 + 4, 4, 65_536 * 5 * 4, 1.0, 1.0, 1 << 28, true), None);
     }
+
+    /// Nearest-neighbour copies source pixels and needs no filter tables, so a source wider than the
+    /// Catmull-Rom side cap still shrinks. The pixel budget applies to it all the same.
+    #[test]
+    fn image_resampling_nearest_accepts_wide_sources_the_filter_refuses() {
+        let wide: u32 = (1 << 20) + 1;
+        assert_eq!(hayro::image_resampling_size(wide, 1, 1, wide as usize, 1.0 / 4096.0, 1.0, 1 << 28, true), None);
+        assert_eq!(hayro::image_resampling_size(wide, 1, 1, wide as usize, 1.0 / 4096.0, 1.0, 1 << 28, false), Some((257, 1)));
+        assert_eq!(hayro::image_resampling_size(wide, 1, 1, wide as usize, 1.0 / 4096.0, 1.0, 256, false), None);
+    }
+
     fn strip_image_pdf(width: u32, body: &str, space: &str, encoded: &str, alpha: Option<&str>) -> Vec<u8> {
         let (mask_ref, mask_obj) = match alpha {
             Some(data) => (
@@ -2193,6 +2204,23 @@ mod tests {
         assert_eq!(&page.rgba[(20 + 3) * 4..][..4], &[255, 128, 128, 255]);
     }
 
+    /// A source wider than the filter's 2^20-pixel side cap is shrunk by nearest-neighbour rather
+    /// than refused and skipped (the default, `/Interpolate` omitted, is nearest).
+    #[test]
+    fn wide_non_interpolated_sources_draw_after_shrinking() {
+        let data = "7f".repeat(1_100_000);
+        let pdf = strip_image_pdf(1_100_000, "q 16 0 0 1 2 2 cm /Im0 Do Q\n", "DeviceGray", &data, None);
+        let mut renderer = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!((page.width, page.height), (20, 4));
+        let pixel = |x: usize| &page.rgba[(20 + x) * 4..][..4];
+        assert_eq!(pixel(1), &[255, 255, 255, 255]);
+        assert_eq!(pixel(3), &[127, 127, 127, 255], "source image was not dropped");
+        assert_eq!(pixel(17), &[127, 127, 127, 255]);
+        assert_eq!(pixel(19), &[255, 255, 255, 255]);
+    }
+
     #[test]
     fn image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement() {
         let data = "ff0000".repeat(16);
@@ -3842,6 +3870,152 @@ trailer << /Root 1 0 R >>
         }
     }
 
+    /// Item 1 of storytold/pdfcraft#623: a page's content used to be cut at `MAX_DECODED_STREAM`,
+    /// so everything after the cut was lost (the text and the title block of the A1 sample). Content
+    /// that expands by a few times over is read to its end, however large it is.
+    #[test]
+    fn page_content_past_the_old_cap_renders() {
+        let limit = hayro::hayro_syntax::MAX_DECODED_STREAM;
+        // Blocks of a comment and a run of blanks. Each compresses about thirty times over, well
+        // within the budget that `ContentReader` allows.
+        let mut content = Vec::with_capacity(limit + (8 << 20));
+        let mut state = 0x2545_f491_4f6c_dd1d_u64;
+        while content.len() < limit + (8 << 20) {
+            content.push(b'%');
+            for _ in 0..3 {
+                state = state.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1);
+                content.push(b'a' + ((state >> 33) % 26) as u8);
+            }
+            content.push(b'\n');
+            content.resize(content.len() + 128, b' ');
+        }
+        content.extend_from_slice(b"1 0 0 rg 0 0 4 4 re f");
+        let mut z = flate2::write::ZlibEncoder::new(Vec::new(), flate2::Compression::default());
+        std::io::Write::write_all(&mut z, &content).unwrap();
+        let stream = z.finish().unwrap();
+        assert!(content.len() < 64 * stream.len(), "the content expands by less than the budget allows");
+
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Filter /FlateDecode /Length {} >> stream\n", stream.len()).as_bytes());
+        pdf.extend_from_slice(&stream);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(120)).expect("a large page must render");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert!(!page.warnings.contains(&RenderWarning::ContentTruncated), "nothing was cut");
+        assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255], "the square after the old cap draws");
+    }
+
+    /// The content stream is interpreted a window at a time. An inline image with more data than
+    /// a window is read whole, and what follows it is still drawn.
+    #[test]
+    fn inline_images_longer_than_a_window_are_read_whole() {
+        let mut content = b"q 300 0 0 300 0 0 cm BI /W 300 /H 300 /BPC 8 /CS /G ID ".to_vec();
+        content.extend(std::iter::repeat_n(0x80_u8, 300 * 300));
+        content.extend_from_slice(b" EI Q 1 0 0 rg 0 0 4 4 re f");
+        let pdf = one_page_pdf(&content, "");
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("an inline image must not stall the renderer");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        let pixel = |x: u32, y: u32| {
+            let offset = ((y * page.width + x) * 4) as usize;
+            [page.rgba[offset], page.rgba[offset + 1], page.rgba[offset + 2], page.rgba[offset + 3]]
+        };
+        assert_eq!(pixel(1, 38), [255, 0, 0, 255], "the square after the image draws");
+        let grey = pixel(30, 5);
+        assert!(grey[0] == grey[1] && grey[1] == grey[2] && grey[0] < 255, "the image covers the page: {grey:?}");
+    }
+
+    /// A one-page PDF whose content is the stream `stream`, with the entries `dict` in its
+    /// dictionary.
+    fn one_page_pdf(stream: &[u8], dict: &str) -> Vec<u8> {
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << {dict} /Length {} >> stream\n", stream.len()).as_bytes());
+        pdf.extend_from_slice(stream);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        pdf
+    }
+
+    /// A page whose content expands far beyond its compressed stream stops at the expansion budget,
+    /// which is 64 times the compressed size and at least `MAX_DECODED_STREAM`, and the page says so.
+    #[test]
+    fn content_bombs_stop_at_the_budget_and_say_so() {
+        let bomb = zlib_zeros(hayro::hayro_syntax::MAX_DECODED_STREAM + (32 << 20));
+        let pdf = one_page_pdf(&bomb, "/Filter /FlateDecode");
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let mut r = PageRenderer::new(Arc::new(pdf), RenderConfig::default());
+            let _ = tx.send(r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 }));
+        });
+        let page = rx.recv_timeout(std::time::Duration::from_secs(60)).expect("a content bomb must not stall the renderer");
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert!(page.warnings.contains(&RenderWarning::ContentTruncated), "the cut content is observable");
+    }
+
+    /// A stream read in pieces of any size gives the same bytes: stored and dynamic blocks, and in
+    /// a `/Contents` array a stream that is not Flate-coded, between two that are.
+    #[test]
+    fn content_reader_returns_the_same_bytes_in_any_pieces() {
+        use hayro::hayro_syntax::Pdf;
+        use std::io::Write;
+        let mut plain = Vec::new();
+        for i in 0..40_000_u32 {
+            plain.extend_from_slice(format!("{} {} l\n", i % 977, i % 613).as_bytes());
+        }
+        let zlib = |data: &[u8], level| {
+            let mut z = flate2::write::ZlibEncoder::new(Vec::new(), level);
+            z.write_all(data).unwrap();
+            z.finish().unwrap()
+        };
+        let read = |pdf: Vec<u8>, piece: usize| {
+            let doc = Pdf::new(pdf).expect("parses");
+            let page = doc.pages().first().expect("one page");
+            let mut content = page.content_reader();
+            let mut out = Vec::new();
+            while content.read_into(&mut out, piece) > 0 {}
+            out
+        };
+        let pieces = [1, 3, 64, 4096, 65_536, 1_000_000];
+
+        for level in [flate2::Compression::none(), flate2::Compression::best()] {
+            let pdf = one_page_pdf(&zlib(&plain, level), "/Filter /FlateDecode");
+            for piece in pieces {
+                assert!(read(pdf.clone(), piece) == plain, "piece {piece}");
+            }
+        }
+
+        // A `/Contents` array: Flate, then ASCIIHex (decoded whole), then Flate. As before, each
+        // stream is followed by a space.
+        let hex: String = plain[..100].iter().map(|b| format!("{b:02x}")).collect::<String>() + ">";
+        let first = zlib(&plain, flate2::Compression::default());
+        let last = zlib(&plain[..50], flate2::Compression::default());
+        let mut expected = plain.clone();
+        expected.push(b' ');
+        expected.extend_from_slice(&plain[..100]);
+        expected.push(b' ');
+        expected.extend_from_slice(&plain[..50]);
+        expected.push(b' ');
+        let mut pdf = b"%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents [4 0 R 5 0 R 6 0 R] >> endobj\n".to_vec();
+        pdf.extend_from_slice(format!("4 0 obj << /Filter /FlateDecode /Length {} >> stream\n", first.len()).as_bytes());
+        pdf.extend_from_slice(&first);
+        pdf.extend_from_slice(format!("\nendstream endobj\n5 0 obj << /Filter /ASCIIHexDecode /Length {} >> stream\n", hex.len()).as_bytes());
+        pdf.extend_from_slice(hex.as_bytes());
+        pdf.extend_from_slice(format!("\nendstream endobj\n6 0 obj << /Filter /FlateDecode /Length {} >> stream\n", last.len()).as_bytes());
+        pdf.extend_from_slice(&last);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        for piece in pieces {
+            assert!(read(pdf.clone(), piece) == expected, "the array: piece {piece}");
+        }
+    }
+
     /// Zlib data that inflates to `len` zero bytes.
     fn zlib_zeros(len: usize) -> Vec<u8> {
         use std::io::Write;
@@ -4355,6 +4529,180 @@ trailer << /Root 1 0 R >>
         assert_eq!(&page.rgba[((38 * 40 + 1) * 4)..][..4], &[255, 0, 0, 255]);
     }
 
+    /// Hex-encodes `bytes` for an `/ASCIIHexDecode` stream.
+    fn hex(bytes: &[u8]) -> String {
+        bytes.iter().map(|b| format!("{b:02x}")).collect()
+    }
+
+    /// An 8×4 source of 2×2 blocks: block column `x / 2` and row `y / 2` takes `levels[(y / 2) * 4 + x / 2]`.
+    fn block_source<T: Copy>(levels: [T; 8]) -> Vec<T> {
+        (0..32).map(|i| levels[(i / 16) * 4 + (i % 8) / 2]).collect()
+    }
+
+    /// Draws one `size` image of colour space `space` (`data` as raw samples, with an optional gray
+    /// `/SMask` of the same size) at 1:1 on a `device`-sized page, writing `/Interpolate` when given.
+    fn draw_minified_image(
+        space: &str,
+        size: (u32, u32),
+        interpolate: Option<bool>,
+        data: &[u8],
+        alpha: Option<&[u8]>,
+        device: (u32, u32),
+    ) -> RenderedPage {
+        let (width, height) = size;
+        let interp = interpolate.map_or_else(String::new, |value| format!("/Interpolate {value} "));
+        let (smask, mask) = match alpha {
+            Some(alpha) => (
+                "/SMask 6 0 R ",
+                format!(
+                    "6 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height {height} /ColorSpace /DeviceGray /BitsPerComponent 8 /Filter /ASCIIHexDecode /Length {} >> stream\n{}>\nendstream endobj\n",
+                    hex(alpha).len() + 1,
+                    hex(alpha)
+                ),
+            ),
+            None => ("", String::new()),
+        };
+        let image = hex(data);
+        let content = format!("q {} 0 0 {} 0 0 cm /Im0 Do Q", device.0, device.1);
+        let pdf = format!(
+            "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+             2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+             3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 {} {}] /Contents 4 0 R /Resources << /XObject << /Im0 5 0 R >> >> >> endobj\n\
+             4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+             5 0 obj << /Type /XObject /Subtype /Image /Width {width} /Height {height} /ColorSpace /{space} /BitsPerComponent 8 {interp}{smask}/Filter /ASCIIHexDecode /Length {} >> stream\n{image}>\nendstream endobj\n\
+             {mask}trailer << /Root 1 0 R >>\n%%EOF\n",
+            device.0,
+            device.1,
+            content.len(),
+            image.len() + 1
+        );
+        let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+        let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+        assert!(page.error.is_none(), "{:?}", page.error);
+        assert_eq!((page.width, page.height), device);
+        page
+    }
+
+    /// Issue #624: an image drawn below its source resolution was pre-resampled with Catmull-Rom
+    /// even when `/Interpolate` was false (or absent, whose PDF default is false). That blends
+    /// neighboring samples before the renderer's later non-interpolating image sampler sees them,
+    /// making scans, screenshots and rasterized text look soft.
+    #[test]
+    fn non_interpolated_images_are_not_smoothed_when_minified() {
+        // Top band K W R G, bottom band B Y M C. Nearest 8×4 → 4×2 sampling picks each block's
+        // pixel, so every device pixel is one palette colour; Catmull-Rom blends across blocks.
+        let palette: [[u8; 3]; 8] = [[0, 0, 0], [255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [255, 255, 0], [255, 0, 255], [0, 255, 255]];
+        let rgb: Vec<u8> = block_source(palette).concat();
+        let exact: Vec<[u8; 4]> = palette.iter().map(|c| [c[0], c[1], c[2], 255]).collect();
+        let pixels = |p: &RenderedPage| p.rgba.as_chunks::<4>().0.to_vec();
+
+        // `/Interpolate` defaults to false, and explicit false is equivalent.
+        let omitted = draw_minified_image("DeviceRGB", (8, 4), None, &rgb, None, (4, 2));
+        assert_eq!(pixels(&omitted), exact, "default interpolation");
+        let disabled = draw_minified_image("DeviceRGB", (8, 4), Some(false), &rgb, None, (4, 2));
+        assert_eq!(&omitted.rgba[..], &disabled.rgba[..], "/Interpolate false must match the default");
+
+        // The fix must not disable interpolation: the same source asking for it blends blocks.
+        let enabled = draw_minified_image("DeviceRGB", (8, 4), Some(true), &rgb, None, (4, 2));
+        assert_ne!(pixels(&enabled), exact, "/Interpolate true should still blend");
+        assert!(pixels(&enabled).iter().any(|px| px[..3].iter().any(|&c| (32..=223).contains(&c))), "/Interpolate true made no mid-tone");
+    }
+
+    #[test]
+    fn non_interpolated_gray_images_are_not_smoothed_when_minified() {
+        let levels = [0u8, 255, 85, 170, 40, 200, 120, 230];
+        let page = draw_minified_image("DeviceGray", (8, 4), None, &block_source(levels), None, (4, 2));
+        let expected: Vec<[u8; 4]> = levels.iter().map(|&v| [v, v, v, 255]).collect();
+        assert_eq!(page.rgba.as_chunks::<4>().0.to_vec(), expected);
+    }
+
+    #[test]
+    fn non_integer_minification_samples_the_same_columns() {
+        // Ten columns drawn six pixels wide: centre sampling reads columns 0, 2, 4, 5, 7 and 9.
+        let ramp = [10u8, 20, 30, 40, 50, 60, 70, 80, 90, 100];
+        let page = draw_minified_image("DeviceGray", (10, 1), None, &ramp, None, (6, 1));
+        let grays: Vec<u8> = page.rgba.as_chunks::<4>().0.iter().map(|px| px[0]).collect();
+        assert_eq!(grays, [10, 30, 50, 60, 80, 100]);
+    }
+
+    #[test]
+    fn non_integer_minification_samples_colour_and_mask_from_the_same_columns() {
+        // Ten gray columns with a soft mask, drawn six pixels wide: columns 0, 2, 4, 5, 7 and 9 are
+        // sampled, so the mask must pick the same columns as the colours.
+        let ramp = [10u8, 20, 30, 40, 50, 60, 70, 80, 90, 100];
+        let mask = [255u8, 0, 0, 0, 255, 255, 0, 0, 0, 255];
+        let page = draw_minified_image("DeviceGray", (10, 1), None, &ramp, Some(&mask), (6, 1));
+        // Opaque columns keep their gray; transparent columns show the white page.
+        assert_eq!(
+            page.rgba.as_chunks::<4>().0.to_vec(),
+            vec![[10, 10, 10, 255], [255, 255, 255, 255], [50, 50, 50, 255], [60, 60, 60, 255], [255, 255, 255, 255], [100, 100, 100, 255]]
+        );
+    }
+
+    #[test]
+    fn non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified() {
+        let palette: [[u8; 3]; 8] = [[0, 0, 0], [255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [255, 255, 0], [255, 0, 255], [0, 255, 255]];
+        let rgb: Vec<u8> = block_source(palette).concat();
+        let alpha = block_source([255u8, 0, 128, 255, 0, 255, 64, 128]);
+        let page = draw_minified_image("DeviceRGB", (8, 4), None, &rgb, Some(&alpha), (4, 2));
+        // Premultiplied colours composited over the white page: alpha 0 shows the page.
+        let expected = vec![
+            [0, 0, 0, 255],
+            [255, 255, 255, 255],
+            [255, 127, 127, 255],
+            [0, 255, 0, 255],
+            [255, 255, 255, 255],
+            [255, 255, 0, 255],
+            [255, 191, 255, 255],
+            [127, 255, 255, 255],
+        ];
+        assert_eq!(page.rgba.as_chunks::<4>().0.to_vec(), expected);
+    }
+
+    /// Type 3 glyph images used to be sampled bicubically (`ImageQuality::High`) whatever their
+    /// `/Interpolate`, which blends the nearest pre-resize back in. The glyph is 4.6 × 2.3 pixels
+    /// and its image pre-resizes to 5 × 3, so the final draw samples fractionally and bicubic
+    /// filtering would blend palette colours. Interior pixels must stay palette colours unless the
+    /// image asks for interpolation.
+    #[test]
+    fn non_interpolated_type3_glyph_images_are_not_smoothed_when_minified() {
+        let palette: [[u8; 3]; 8] = [[0, 0, 0], [255, 255, 255], [255, 0, 0], [0, 255, 0], [0, 0, 255], [255, 255, 0], [255, 0, 255], [0, 255, 255]];
+        let data = hex(&block_source(palette).concat());
+        let render = |interp: &str| {
+            let content = "BT /F1 1 Tf 0 0.7 Td (A) Tj ET";
+            let glyph = "4.6 0 d0 q 4.6 0 0 2.3 0 0 cm /Im0 Do Q";
+            let pdf = format!(
+                "%PDF-1.4\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n\
+                 2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n\
+                 3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 5 3] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj\n\
+                 4 0 obj << /Length {} >> stream\n{content}\nendstream endobj\n\
+                 5 0 obj << /Type /Font /Subtype /Type3 /FontBBox [0 0 10 10] /FontMatrix [1 0 0 1 0 0] /FirstChar 65 /LastChar 65 /Widths [5] /Encoding << /Differences [65 /a] >> /CharProcs << /a 6 0 R >> /Resources << /XObject << /Im0 7 0 R >> >> >> endobj\n\
+                 6 0 obj << /Length {} >> stream\n{glyph}\nendstream endobj\n\
+                 7 0 obj << /Type /XObject /Subtype /Image /Width 8 /Height 4 /ColorSpace /DeviceRGB /BitsPerComponent 8 {interp}/Filter /ASCIIHexDecode /Length {} >> stream\n{data}>\nendstream endobj\n\
+                 trailer << /Root 1 0 R >>\n%%EOF\n",
+                content.len(),
+                glyph.len(),
+                data.len() + 1
+            );
+            let mut renderer = PageRenderer::new(Arc::new(pdf.into_bytes()), RenderConfig::default());
+            let page = renderer.render(RenderRequest { page: 0, kind: RequestKind::Pixels, scale: 1.0, ..Default::default() });
+            assert!(page.error.is_none(), "{:?}", page.error);
+            assert_eq!((page.width, page.height), (5, 3));
+            page
+        };
+        // The glyph fully covers columns 0–3 and rows 0–1.
+        let interior = |p: &RenderedPage| -> Vec<[u8; 3]> {
+            (0..2).flat_map(|y| (0..4).map(move |x| (y * 5 + x) * 4)).map(|i| [p.rgba[i], p.rgba[i + 1], p.rgba[i + 2]]).collect()
+        };
+
+        let omitted = render("");
+        for px in interior(&omitted) {
+            assert!(palette.contains(&px), "non-interpolated glyph image was smoothed to {px:?}");
+        }
+        let enabled = render("/Interpolate true ");
+        assert!(interior(&enabled).iter().any(|px| !palette.contains(px)), "/Interpolate true glyph image should still be sampled bicubically");
+    }
+
     /// From `cargo xtask fuzz`: a CID font whose /W range spans every u32 inserted billions of
     /// widths (vendored hayro-interpret patch: `MAX_CID`). Must finish quickly.
     #[test]
@@ -4825,6 +5173,159 @@ trailer << /Root 1 0 R >>
         }
     }
 
+    /// InDesign fades are luminosity soft masks whose group is one extended axial `sh`: a
+    /// gradient over the whole page. hayro 0.7 sampled each one pixel by pixel through the
+    /// shading function, so a report page with 40 of them took 15 s at 144 dpi. Vendored hayro
+    /// patch (backport of hayro 0.8): axial and radial shadings that a native gradient can
+    /// represent exactly are drawn as one, with stops placed at stitching-function bounds.
+    #[test]
+    fn axial_and_radial_shadings_draw_as_native_gradients() {
+        use hayro::hayro_interpret::font::Glyph;
+        use hayro::hayro_interpret::hayro_syntax::Pdf;
+        use hayro::hayro_interpret::pattern::Pattern;
+        use hayro::hayro_interpret::{
+            BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, Paint, PathDrawMode, SoftMask, TransformExt, interpret_page,
+        };
+        use kurbo::{Affine, BezPath, Rect, Shape};
+
+        /// For every shading painted, the offsets of its native gradient stops, or `None` when
+        /// it has to be sampled pixel by pixel.
+        #[derive(Default)]
+        struct Gradients(Vec<Option<Vec<f32>>>);
+        impl<'a> Device<'a> for Gradients {
+            fn set_soft_mask(&mut self, _: Option<SoftMask<'a>>) {}
+            fn set_blend_mode(&mut self, _: BlendMode) {}
+            fn draw_path(&mut self, path: &BezPath, transform: Affine, paint: &Paint<'a>, _: &PathDrawMode) {
+                if let Paint::Pattern(pattern) = paint
+                    && let Pattern::Shading(s) = pattern.as_ref()
+                {
+                    let bbox = (transform * path.clone()).bounding_box();
+                    let native = s.encode().as_svg_gradient(bbox, 0.01);
+                    self.0.push(native.map(|g| g.stops.iter().map(|stop| stop.offset).collect()));
+                }
+            }
+            fn push_clip_path(&mut self, _: &ClipPath) {}
+            fn push_transparency_group(&mut self, _: f32, _: Option<SoftMask<'a>>, _: BlendMode) {}
+            fn draw_glyph(&mut self, _: &Glyph<'a>, _: Affine, _: Affine, _: &Paint<'a>, _: &GlyphDrawMode) {}
+            fn draw_image(&mut self, _: Image<'a, '_>, _: Affine) {}
+            fn pop_clip_path(&mut self) {}
+            fn pop_transparency_group(&mut self) {}
+        }
+
+        // A 40 × 20 pt page painting `/Sh0 sh`, with optional extra objects from 6 0 obj on.
+        let pdf = |shading: &str, extra: &str| {
+            let content = "/Sh0 sh";
+            format!(
+                "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 20] /Contents 4 0 R /Resources << /Shading << /Sh0 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj {shading} endobj
+{extra}trailer << /Root 1 0 R >>
+%%EOF",
+                content.len()
+            )
+            .into_bytes()
+        };
+        let gradients = |bytes: &[u8]| {
+            let parsed = Pdf::new(Arc::new(bytes.to_vec())).expect("parses");
+            let page = &parsed.pages()[0];
+            let cache = InterpreterCache::new();
+            let initial = page.initial_transform(true).to_kurbo();
+            let mut ctx = Context::new(initial, Rect::new(0.0, 0.0, 40.0, 20.0), &cache, page.xref(), InterpreterSettings::default());
+            let mut device = Gradients::default();
+            interpret_page(page, &mut ctx, &mut device);
+            device.0
+        };
+        let render = |bytes: Vec<u8>| {
+            let mut r = PageRenderer::new(Arc::new(bytes), RenderConfig::default());
+            let p = r.render(RenderRequest { page: 0, kind: RequestKind::Pixels, tile: None, scale: 1.0, tag: 0 });
+            assert!(p.error.is_none(), "{:?}", p.error);
+            p
+        };
+        let grey = |p: &RenderedPage, x: u32| i32::from(p.rgba[((10 * p.width + x) * 4) as usize]);
+        let ramp = "/FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1";
+        // A function-based shading (always sampled) that draws the same picture is the reference;
+        // its /Range clamps to 0..1.
+        let sampled = |code: &str| {
+            let extra =
+                format!("6 0 obj << /FunctionType 4 /Domain [0 40 0 20] /Range [0 1] /Length {} >> stream\n{code}\nendstream endobj\n", code.len());
+            pdf("<< /ShadingType 1 /ColorSpace /DeviceGray /Domain [0 40 0 20] /Function 6 0 R >>", &extra)
+        };
+
+        // A steep extended axial ramp, x 10 to 14: one stop at each end, drawn at pixel centres
+        // (a half-pixel shift would move each pixel 32 levels) and padded on both sides.
+        let axial = pdf(&format!("<< /ShadingType 2 /ColorSpace /DeviceGray /Coords [10 0 14 0] /Extend [true true] /Function << {ramp} >> >>"), "");
+        assert_eq!(gradients(&axial), vec![Some(vec![0.0, 1.0])], "an extended axial shading is a native gradient");
+        let native = render(axial);
+        let reference = render(sampled("{ pop 10 sub 4 div }"));
+        for (x, expected) in [(2, 0), (9, 0), (10, 32), (11, 96), (12, 159), (13, 223), (14, 255), (30, 255)] {
+            assert!((grey(&native, x) - expected).abs() <= 4, "axial, x {x}: {} instead of {expected}", grey(&native, x));
+            assert!(
+                (grey(&native, x) - grey(&reference, x)).abs() <= 4,
+                "axial, x {x}: native {} vs sampled {}",
+                grey(&native, x),
+                grey(&reference, x)
+            );
+        }
+
+        // An extended radial shading matches the sampled one everywhere.
+        let radial =
+            pdf(&format!("<< /ShadingType 3 /ColorSpace /DeviceGray /Coords [20 10 0 20 10 8] /Extend [true true] /Function << {ramp} >> >>"), "");
+        assert!(matches!(gradients(&radial).as_slice(), [Some(_)]), "an extended radial shading is a native gradient");
+        let native = render(radial);
+        let reference = render(sampled("{ 10 sub dup mul exch 20 sub dup mul add sqrt 8 div }"));
+        let worst = native.rgba.iter().zip(reference.rgba.iter()).map(|(a, b)| a.abs_diff(*b)).max();
+        assert!(worst.is_some_and(|d| d <= 4), "radial: native and sampled differ by {worst:?} levels");
+
+        // A stitched function peaking at a quarter of the way gets a stop exactly at its bound.
+        let stitched = pdf(
+            "<< /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Extend [true true] /Function << /FunctionType 3 /Domain [0 1] /Bounds [0.25] /Encode [0 1 0 1] /Functions [<< /FunctionType 2 /Domain [0 1] /C0 [0] /C1 [1] /N 1 >> << /FunctionType 2 /Domain [0 1] /C0 [1] /C1 [0] /N 1 >>] >> >>",
+            "",
+        );
+        let stops = gradients(&stitched);
+        assert!(matches!(stops.as_slice(), [Some(offsets)] if offsets.contains(&0.25)), "a stop at the stitching bound: {stops:?}");
+        let native = render(stitched);
+        for (x, expected) in [(0, 13), (9, 242), (10, 250), (39, 4)] {
+            assert!((grey(&native, x) - expected).abs() <= 4, "stitched, x {x}: {} instead of {expected}", grey(&native, x));
+        }
+
+        // Without /Extend the area beyond the axis keeps the background, which a native gradient
+        // can't leave out: still sampled. Function-based shadings are always sampled.
+        let unextended = pdf(&format!("<< /ShadingType 2 /ColorSpace /DeviceGray /Coords [10 0 14 0] /Function << {ramp} >> >>"), "");
+        assert_eq!(gradients(&unextended), vec![None], "an axial shading without /Extend that covers more than its axis");
+        assert_eq!(gradients(&sampled("{ pop pop 0.5 }")), vec![None], "a function-based shading");
+
+        // The report's case: a luminosity soft mask whose group is one extended axial `sh` over
+        // the page. Red through a mask fading in from x 0 to 40 over white: 255, 255 − t, 255 − t.
+        let content = "/M gs 1 0 0 rg 0 0 40 20 re f";
+        let masked = format!(
+            "%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 20] /Contents 4 0 R /Resources << /ExtGState << /M 5 0 R >> >> >> endobj
+4 0 obj << /Length {} >> stream
+{content}
+endstream endobj
+5 0 obj << /Type /ExtGState /SMask << /Type /Mask /S /Luminosity /G 6 0 R >> >> endobj
+6 0 obj << /Type /XObject /Subtype /Form /BBox [-32768 -32768 32767 32767] /Group << /S /Transparency /CS /DeviceGray >> /Resources << /Shading << /Sh0 << /ShadingType 2 /ColorSpace /DeviceGray /Coords [0 0 40 0] /Extend [true true] /Function << {ramp} >> >> >> >> /Length 7 >> stream
+/Sh0 sh
+endstream endobj
+trailer << /Root 1 0 R >>
+%%EOF",
+            content.len()
+        );
+        let p = render(masked.into_bytes());
+        for x in [2u32, 20, 37] {
+            let px = &p.rgba[((10 * p.width + x) * 4) as usize..][..4];
+            let faded = 255 - (255.0 * (f64::from(x) + 0.5) / 40.0).round() as i32;
+            assert!(px[0] == 255 && (i32::from(px[1]) - faded).abs() <= 4 && px[1] == px[2], "masked, x {x}: {px:?}, green and blue {faded}");
+        }
+    }
+
     /// An alpha soft mask whose transparency group has no /CS (as Chrome writes gradient text)
     /// must still mask. Regression test for the vendored hayro-interpret patch.
     #[test]
diff --git a/crates/render/src/structure.rs b/crates/render/src/structure.rs
index 79ff3159..018de5a6 100644
--- a/crates/render/src/structure.rs
+++ b/crates/render/src/structure.rs
@@ -115,9 +115,9 @@ impl Structure for lopdf::Document {
     fn encrypted(&self) -> bool {
         self.is_encrypted() || self.was_encrypted() || self.trailer.has(b"Encrypt")
     }
-    fn get_pages(&self) -> BTreeMap<u32, ObjectId> {
-        self.get_pages()
-    }
+    // `get_pages` is not overridden: lopdf's own page-tree walk trusts /Count and pre-allocates
+    // by it, so a hostile /Count (a fuzz finding: 4294967295) aborted the process with a 48 GiB
+    // allocation. The trait's bounded default walk counts the real pages instead.
     fn get_page_fonts(&self, page: ObjectId) -> Result<BTreeMap<Vec<u8>, &Dictionary>> {
         self.get_page_fonts(page)
     }
@@ -207,6 +207,29 @@ fn convert(object: &CosObject, depth: usize) -> Result<Object> {
 mod tests {
     use super::*;
 
+    /// A hostile page-tree /Count must not abort the process: lopdf's own `get_pages`
+    /// pre-allocates by it (fuzz finding: /Count 4294967295 -> a 48 GiB allocation),
+    /// the bounded default walk counts the real pages instead.
+    #[test]
+    fn a_hostile_page_count_does_not_abort_inspection() {
+        let pdf = b"%PDF-1.7
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R >>
+endobj
+2 0 obj
+<< /Type /Pages /Kids [3 0 R] /Count 4294967295 >>
+endobj
+3 0 obj
+<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 200] >>
+endobj
+trailer
+<< /Size 4 /Root 1 0 R >>
+%%EOF";
+        let doc = lopdf::Document::load_mem(&pdf[..]).unwrap();
+        let pages = Structure::get_pages(&doc);
+        assert_eq!(pages.len(), 1, "the walk counts the one real page, not /Count");
+    }
+
     #[test]
     fn inspection_loads_only_requested_objects_in_a_compressed_document() {
         let mut source = lopdf::Document::with_version("1.7");
diff --git a/crates/render/src/text.rs b/crates/render/src/text.rs
index 8c47af21..5b70b17c 100644
--- a/crates/render/src/text.rs
+++ b/crates/render/src/text.rs
@@ -14,6 +14,7 @@ use hayro::hayro_interpret::{
     BlendMode, ClipPath, Context, Device, GlyphDrawMode, Image, InterpreterCache, InterpreterSettings, Paint, PathDrawMode, SoftMask, interpret_page,
 };
 use kurbo::{Affine, BezPath, Rect, Shape};
+use std::collections::HashMap;
 
 /// One glyph on the page.
 #[derive(Clone, Debug, PartialEq)]
@@ -37,7 +38,7 @@ pub struct TextGlyph {
 /// combining dot (two characters) and leaves `ı` alone, so neither `İSTANBUL` nor `IRMAK` could
 /// be found by typing `istanbul` or `ırmak`. Search can't know the document's language, so the
 /// four are treated as one letter; this only adds matches where an `ı` or `İ` is involved.
-fn fold_case(s: &str) -> String {
+pub fn fold_case(s: &str) -> String {
     let mut out = String::with_capacity(s.len());
     for c in s.chars() {
         match c {
@@ -658,16 +659,341 @@ fn is_cjk(c: char) -> bool {
     matches!(c as u32, 0x2E80..=0x9FFF | 0xAC00..=0xD7AF | 0xF900..=0xFAFF | 0xFF00..=0xFFEF | 0x20000..=0x3134F | 0x1100..=0x11FF)
 }
 
+/// Glyphs `start..end` of the glyph list [`arrange`] lays out, drawn one after another.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct Run {
+    start: usize,
+    end: usize,
+}
+
+impl Run {
+    fn len(self) -> usize {
+        self.end.saturating_sub(self.start)
+    }
+
+    fn range(self) -> std::ops::Range<usize> {
+        self.start..self.end
+    }
+}
+
+/// Marks an absent link in a union-find or run list.
+const NONE: usize = usize::MAX;
+
+/// A segment: runs drawn on one baseline, placed together. Its glyph order is worked out when it is emitted, so a
+/// segment holds run ranges and geometry only.
 struct Seg {
-    idx: Vec<usize>,
+    /// The first run. Merged segments keep their other runs in `extra`.
+    first: Run,
+    /// The other runs of a merged segment. Boxed, and absent for most segments.
+    extra: Option<Box<SegExtra>>,
     bbox: [f32; 4],
     h: f32,
 }
 
+#[derive(Default)]
+struct SegExtra {
+    more: Vec<Run>,
+}
+
 impl Seg {
+    fn new(first: Run, bbox: [f32; 4], h: f32) -> Self {
+        Seg { first, extra: None, bbox, h }
+    }
+
     fn cy(&self) -> f32 {
         (self.bbox[1] + self.bbox[3]) / 2.0
     }
+
+    fn runs(&self) -> impl Iterator<Item = Run> + '_ {
+        std::iter::once(self.first).chain(self.extra.iter().flat_map(|e| e.more.iter().copied()))
+    }
+
+    fn merge(&mut self, other: Seg) {
+        union(&mut self.bbox, &other.bbox);
+        self.h = self.h.max(other.h);
+        let extra = self.extra.get_or_insert_with(Default::default);
+        extra.more.push(other.first);
+        if let Some(o) = other.extra {
+            extra.more.extend(o.more);
+        }
+    }
+}
+
+/// Two glyphs of different runs that overlap by more than this fraction of the line height collide.
+const RUN_COLLISION: f32 = 0.25;
+/// A run that starts inside the runs before it by more than this fraction of the line height starts a new word.
+const RUN_OVERLAP_SPACE: f32 = 0.5;
+/// Earlier runs with the same key that a run is checked against for a redraw, newest first. A run past this limit is kept,
+/// so a page costs at most this many checks per run, however many runs share a key.
+const REDRAW_CANDIDATES: usize = 32;
+/// Pair tests that the collision sweep may make per glyph of a segment. Ordinary text overlaps each glyph with about one
+/// neighbour, so it stays far below this. A segment that needs more is dense, and [`collide`] joins its runs instead.
+const COLLIDE_PAIRS_PER_GLYPH: usize = 16;
+
+/// Reusable buffers, so a page allocates them once rather than per segment. Glyph placement works in them, one
+/// segment at a time, when the segment is emitted.
+#[derive(Default)]
+struct Scratch {
+    /// The glyphs of the text runs, each with its run, in x order.
+    owner: Vec<(usize, usize)>,
+    /// The text runs of the segment (runs that are not all zero-width).
+    text: Vec<Run>,
+    /// The glyphs of the zero-width runs, in run order.
+    marks: Vec<usize>,
+    /// Union-find parents over `text`, and for each root the list of its runs through `next`.
+    parent: Vec<usize>,
+    head: Vec<usize>,
+    next: Vec<usize>,
+    /// The runs of one colliding component, by left edge.
+    rows: Vec<Row>,
+    /// The glyphs of one colliding component: each run's glyphs in x order, in run order.
+    group: Vec<usize>,
+    /// The units to place, and their glyphs in `flat`.
+    units: Vec<Unit>,
+    flat: Vec<usize>,
+    /// The current segment's glyphs in visual reading order, and its forced word breaks.
+    placed: Vec<usize>,
+    breaks: Vec<usize>,
+    /// The gaps between the current segment's glyphs, and its glyphs in logical order when it has right-to-left text.
+    gaps: Vec<f32>,
+    logical: Vec<usize>,
+    /// `placed` with the marks merged in, built before it is swapped in.
+    merged: Vec<usize>,
+}
+
+/// One run of a colliding component.
+struct Row {
+    left: f32,
+    right: f32,
+    /// The run's first glyph in content order, which is its smallest index.
+    first: usize,
+    /// The run's glyph with the smallest x, where a word break is recorded.
+    lead: usize,
+    /// The run's glyphs in `Scratch::group`.
+    glyphs: std::ops::Range<usize>,
+}
+
+/// A part of a segment placed as one: a free glyph, or a colliding component.
+struct Unit {
+    left: f32,
+    first: usize,
+    /// The unit's glyphs in `Scratch::flat`.
+    glyphs: std::ops::Range<usize>,
+}
+
+fn union_find(parent: &mut [usize], mut r: usize) -> usize {
+    while parent[r] != r {
+        parent[r] = parent[parent[r]];
+        r = parent[r];
+    }
+    r
+}
+
+/// A 64-bit fingerprint of a run's glyph texts. Each text is hashed with its length, so ["ab", "c"] and
+/// ["a", "bc"] differ. Equal fingerprints are only candidates: `redraws` decides.
+fn fingerprint(glyphs: &[&TextGlyph], run: Run) -> u64 {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    for g in run.range().filter_map(|i| glyphs.get(i)) {
+        for b in (g.text.len() as u64).to_le_bytes().into_iter().chain(g.text.bytes()) {
+            h = (h ^ u64::from(b)).wrapping_mul(0x0000_0100_0000_01b3);
+        }
+    }
+    h
+}
+
+/// Whether run `b` redraws run `a` glyph for glyph: the same text, each glyph within a fifth of its
+/// height of the same glyph in `a`.
+fn redraws(glyphs: &[&TextGlyph], a: Run, b: Run) -> bool {
+    a.len() == b.len()
+        && a.range().zip(b.range()).all(|(i, j)| match (glyphs.get(i), glyphs.get(j)) {
+            (Some(p), Some(g)) => {
+                let tol = 0.2 * (g.rect[3] - g.rect[1]).max(0.1);
+                p.text == g.text && (p.rect[0] - g.rect[0]).abs() < tol && (p.rect[1] - g.rect[1]).abs() < tol
+            }
+            _ => false,
+        })
+}
+
+/// Puts a segment's glyphs in visual reading order into `sc.placed`, and its forced word breaks into `sc.breaks`.
+///
+/// Glyphs are placed by x. Runs that collide, meaning that glyphs of different runs overprint each other, stay whole
+/// and are placed by their left edge. Runs that only interleave along the line, such as symbols between letters, keep
+/// their glyph-by-glyph order, so the common case is one sort. A run of zero-width glyphs (a combining mark) has no
+/// extent of its own, so it goes next to the glyph it starts at.
+fn place_glyphs(glyphs: &[&TextGlyph], height: &dyn Fn(usize) -> f32, s: &Seg, sc: &mut Scratch) {
+    let x0 = |i: usize| glyphs[i].rect[0];
+    let zero_width = |i: usize| glyphs[i].rect[2] - glyphs[i].rect[0] <= 0.05 * height(i);
+    sc.text.clear();
+    sc.marks.clear();
+    sc.placed.clear();
+    sc.breaks.clear();
+    for run in s.runs() {
+        if run.range().all(&zero_width) {
+            sc.marks.extend(run.range());
+        } else {
+            sc.text.push(run);
+        }
+    }
+    if sc.text.len() <= 1 {
+        // A single run cannot collide with itself: its glyphs only need sorting by x.
+        sc.placed.extend(sc.text.iter().flat_map(|run| run.range()));
+        sc.placed.sort_unstable_by(|a, b| x0(*a).total_cmp(&x0(*b)).then(a.cmp(b)));
+    } else {
+        collide(glyphs, height, s.h, sc);
+    }
+    // Each mark goes before the first placed glyph whose x is greater than its own. Marks are visited in x order, and
+    // that position never moves back, so one pass over `placed` puts all of them in.
+    sc.marks.sort_by(|a, b| x0(*a).total_cmp(&x0(*b)));
+    if !sc.marks.is_empty() {
+        sc.merged.clear();
+        let mut next = 0;
+        for &m in &sc.marks {
+            while next < sc.placed.len() && x0(sc.placed[next]) <= x0(m) {
+                sc.merged.push(sc.placed[next]);
+                next += 1;
+            }
+            sc.merged.push(m);
+        }
+        sc.merged.extend_from_slice(&sc.placed[next..]);
+        std::mem::swap(&mut sc.placed, &mut sc.merged);
+    }
+}
+
+/// `place_glyphs` for a segment of two or more text runs. `h` is the segment's line height. Returns whether the segment
+/// was too dense to sweep ([`COLLIDE_PAIRS_PER_GLYPH`]), in which case all its text runs form one component.
+///
+/// The sweep tests each glyph against the glyphs after it that start before its right edge. Its work is bounded by the
+/// budget, so a page costs O(glyphs) pair tests plus the sorts. A dense segment is joined with one pass over its runs,
+/// which keeps each run whole. It may keep runs whole that do not overprint, but never interleaves overprinted glyphs.
+fn collide(glyphs: &[&TextGlyph], height: &dyn Fn(usize) -> f32, h: f32, sc: &mut Scratch) -> bool {
+    let x0 = |i: usize| glyphs[i].rect[0];
+    let runs = sc.text.len();
+    sc.owner.clear();
+    for (r, run) in sc.text.iter().enumerate() {
+        sc.owner.extend(run.range().map(|i| (i, r)));
+    }
+    sc.owner.sort_unstable_by(|a, b| x0(a.0).total_cmp(&x0(b.0)).then(a.0.cmp(&b.0)));
+    sc.parent.clear();
+    sc.parent.extend(0..runs);
+    let mut budget = COLLIDE_PAIRS_PER_GLYPH.saturating_mul(sc.owner.len());
+    let mut collided = false;
+    let mut dense = false;
+    'sweep: for a in 0..sc.owner.len() {
+        let (i, ri) = sc.owner[a];
+        let (x1, hi) = (glyphs[i].rect[2], height(i));
+        for b in a + 1..sc.owner.len() {
+            let (j, rj) = sc.owner[b];
+            if x0(j) >= x1 {
+                break;
+            }
+            if budget == 0 {
+                dense = true;
+                break 'sweep;
+            }
+            budget -= 1;
+            let (ra, rb) = (union_find(&mut sc.parent, ri), union_find(&mut sc.parent, rj));
+            let overlap = x1.min(glyphs[j].rect[2]) - x0(j);
+            if ra != rb && overlap > RUN_COLLISION * hi.min(height(j)) {
+                sc.parent[ra] = rb;
+                collided = true;
+            }
+        }
+    }
+    if dense {
+        // Run 0 is its own root, so every run now has it as its root.
+        sc.parent.iter_mut().for_each(|p| *p = 0);
+        collided = true;
+    }
+    if !collided {
+        sc.placed.extend(sc.owner.iter().map(|&(i, _)| i));
+        return dense;
+    }
+
+    // Link each component's runs, so they can be walked without a map.
+    sc.head.clear();
+    sc.head.resize(runs, NONE);
+    sc.next.clear();
+    sc.next.resize(runs, NONE);
+    for r in 0..runs {
+        let root = union_find(&mut sc.parent, r);
+        sc.next[r] = sc.head[root];
+        sc.head[root] = r;
+    }
+    sc.units.clear();
+    sc.flat.clear();
+    for root in 0..runs {
+        if union_find(&mut sc.parent, root) != root {
+            continue;
+        }
+        let head = sc.head[root];
+        if sc.next[head] == NONE {
+            // A run that collides with nothing is placed glyph by glyph.
+            for i in sc.text[head].range() {
+                let at = sc.flat.len();
+                sc.flat.push(i);
+                sc.units.push(Unit { left: x0(i), first: i, glyphs: at..at + 1 });
+            }
+            continue;
+        }
+        sc.rows.clear();
+        sc.group.clear();
+        let mut m = head;
+        while m != NONE {
+            let run = sc.text[m];
+            let start = sc.group.len();
+            sc.group.extend(run.range());
+            sc.group[start..].sort_unstable_by(|a, b| x0(*a).total_cmp(&x0(*b)).then(a.cmp(b)));
+            let left = sc.group[start..].iter().map(|&i| x0(i)).fold(f32::INFINITY, f32::min);
+            let right = sc.group[start..].iter().map(|&i| glyphs[i].rect[2]).fold(f32::NEG_INFINITY, f32::max);
+            let lead = sc.group[start];
+            sc.rows.push(Row { left, right, first: run.start, lead, glyphs: start..sc.group.len() });
+            m = sc.next[m];
+        }
+        sc.rows.sort_unstable_by(|a, b| a.left.total_cmp(&b.left).then(a.first.cmp(&b.first)));
+        let start = sc.flat.len();
+        let mut reach = f32::NEG_INFINITY;
+        for row in &sc.rows {
+            if row.left < reach - h * RUN_OVERLAP_SPACE {
+                sc.breaks.push(row.lead);
+            }
+            reach = reach.max(row.right);
+            sc.flat.extend_from_slice(&sc.group[row.glyphs.clone()]);
+        }
+        let left = sc.rows.iter().map(|r| r.left).fold(f32::INFINITY, f32::min);
+        let first = sc.rows.iter().map(|r| r.first).min().unwrap_or(0);
+        sc.units.push(Unit { left, first, glyphs: start..sc.flat.len() });
+    }
+    sc.units.sort_unstable_by(|a, b| a.left.total_cmp(&b.left).then(a.first.cmp(&b.first)));
+    for unit in &sc.units {
+        sc.placed.extend_from_slice(&sc.flat[unit.glyphs.clone()]);
+    }
+    // Sorted, so that each glyph's membership is a binary search rather than a scan of the breaks.
+    sc.breaks.sort_unstable();
+    dense
+}
+
+/// Reverses each right-to-left span of `idx` (visual → logical order). A space between two right-to-left glyphs
+/// belongs to the span.
+/// Reverse right-to-left runs of `idx` (visual → logical), and the word gaps between their glyphs
+/// with them: `spaces[w]` is a gap left of `idx[w]` (#1062).
+fn reverse_rtl(glyphs: &[&TextGlyph], idx: &mut [usize], spaces: &mut [bool]) {
+    let rtl = |i: usize| glyphs[i].text.chars().any(is_rtl);
+    let mut k = 0;
+    while k < idx.len() {
+        if rtl(idx[k]) {
+            let mut e = k;
+            while e + 1 < idx.len() && (rtl(idx[e + 1]) || (glyphs[idx[e + 1]].text.trim().is_empty() && e + 2 < idx.len() && rtl(idx[e + 2]))) {
+                e += 1;
+            }
+            idx[k..=e].reverse();
+            if let Some(gaps) = spaces.get_mut(k + 1..=e) {
+                gaps.reverse();
+            }
+            k = e + 1;
+        } else {
+            k += 1;
+        }
+    }
 }
 
 fn union(a: &mut [f32; 4], b: &[f32; 4]) {
@@ -720,24 +1046,68 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
     let height = |i: usize| (glyphs[i].rect[3] - glyphs[i].rect[1]).max(0.1);
     let cy = |i: usize| (glyphs[i].rect[1] + glyphs[i].rect[3]) / 2.0;
 
-    // 1. Segments in content order.
+    // 1. Segments in content order. Every run is a range of consecutive glyphs.
     let mut segs: Vec<Seg> = Vec::new();
     for i in 0..n {
         let g = glyphs[i].rect;
         let cont = segs.last().is_some_and(|s| {
-            let Some(&p) = s.idx.last() else { return false };
+            let Some(p) = s.first.end.checked_sub(1) else { return false };
             let ph = height(p).min(height(i));
             let gap = g[0] - glyphs[p].rect[2];
             (cy(i) - cy(p)).abs() < ph * 0.5 && gap < ph * 3.0 && g[0] > glyphs[p].rect[0] - ph * 2.0
         });
         if cont && let Some(s) = segs.last_mut() {
-            s.idx.push(i);
+            s.first.end = i + 1;
             union(&mut s.bbox, &g);
             s.h = s.h.max(height(i));
         } else {
-            segs.push(Seg { idx: vec![i], bbox: g, h: height(i) });
+            segs.push(Seg::new(Run { start: i, end: i + 1 }, g, height(i)));
         }
     }
+    // A run that redraws an earlier run at the same place (doubled or shadowed text) is dropped, as a doubled glyph is
+    // above. Runs are keyed by a fingerprint of their glyph texts and a grid cell a fifth of a line high. A key leads to
+    // the latest retained run with it, and `older[k]` links each retained run to the previous one with the same key, so
+    // the earlier candidates are checked newest first, up to `REDRAW_CANDIDATES`. Both exist only for this pass.
+    let retained = {
+        let candidates = segs.iter().filter(|s| s.first.len() >= 2).count();
+        let mut latest: HashMap<(u64, i32, i32), usize> = HashMap::with_capacity(candidates);
+        let mut older = vec![NONE; segs.len()];
+        let mut kept_runs = 0;
+        for i in 0..segs.len() {
+            let run = segs[i].first;
+            if run.len() >= 2 {
+                let tol = 0.2 * segs[i].h;
+                let (cx, cy_) = ((glyphs[run.start].rect[0] / tol).floor() as i32, (glyphs[run.start].rect[1] / tol).floor() as i32);
+                let fp = fingerprint(&glyphs, run);
+                let mut checks = REDRAW_CANDIDATES;
+                let twin = (-1..=1i32).any(|dx| {
+                    (-1..=1i32).any(|dy| {
+                        let mut link = latest.get(&(fp, cx.saturating_add(dx), cy_.saturating_add(dy))).copied();
+                        while let Some(k) = link {
+                            let Some(prev) = segs.get(k) else { break };
+                            if checks == 0 {
+                                return false;
+                            }
+                            checks -= 1;
+                            if redraws(&glyphs, prev.first, run) {
+                                return true;
+                            }
+                            link = older.get(k).copied().filter(|&o| o != NONE);
+                        }
+                        false
+                    })
+                });
+                if twin {
+                    continue;
+                }
+                older[kept_runs] = latest.insert((fp, cx, cy_), kept_runs).unwrap_or(NONE);
+            }
+            segs.swap(kept_runs, i);
+            kept_runs += 1;
+        }
+        kept_runs
+    };
+    segs.truncate(retained);
     // Merge same-baseline segments that nearly touch.
     let mut merged = true;
     while merged {
@@ -753,19 +1123,13 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
                 if (sa.cy() - sb.cy()).abs() < h * 0.3 && (sa.h / sb.h - 1.0).abs() < 0.35 && gap < h * 1.2 {
                     let sb = segs.remove(b);
                     let a = if b < a { a - 1 } else { a };
-                    let sa = &mut segs[a];
-                    sa.idx.extend(sb.idx);
-                    union(&mut sa.bbox, &sb.bbox);
-                    sa.h = sa.h.max(sb.h);
+                    segs[a].merge(sb);
                     merged = true;
                     break 'outer;
                 }
             }
         }
     }
-    for s in &mut segs {
-        s.idx.sort_by(|a, b| glyphs[*a].rect[0].total_cmp(&glyphs[*b].rect[0]));
-    }
 
     // 2. Blocks.
     let mut by_top: Vec<usize> = (0..segs.len()).collect();
@@ -810,56 +1174,52 @@ fn arrange(glyphs: &[TextGlyph]) -> (Vec<usize>, Vec<u32>, Vec<bool>) {
         block_order.push(pick);
     }
 
-    // 4. Emit glyphs in reading order with line numbers and word gaps.
+    // 4. Emit each segment in block order. Its glyphs are placed here, into scratch that every segment reuses, and
+    // appended straight to the output. Blocks and their order use only segment boxes, so placement can wait until now.
     let mut order: Vec<usize> = Vec::with_capacity(n);
-    let mut line_of = Vec::with_capacity(n);
-    let mut space_before = Vec::with_capacity(n);
+    let mut line_of: Vec<u32> = Vec::with_capacity(n);
+    let mut space_before: Vec<bool> = Vec::with_capacity(n);
     let mut line = 0u32;
+    let mut sc = Scratch::default();
+    // `spaces[w]`: a word gap left of the w-th glyph of the segment, by position on the line, not by drawing order
+    // (#1062). Reused by every segment.
+    let mut spaces: Vec<bool> = Vec::new();
     for b in block_order {
-        for si in &blocks[b].0 {
-            let s = &segs[*si];
-            let mut idx = s.idx.clone();
-            // Reverse right-to-left runs (visual → logical).
-            let rtl = |i: usize| glyphs[i].text.chars().any(is_rtl);
-            let mut k = 0;
-            while k < idx.len() {
-                if rtl(idx[k]) {
-                    let mut e = k;
-                    while e + 1 < idx.len()
-                        && (rtl(idx[e + 1]) || (glyphs[idx[e + 1]].text.trim().is_empty() && e + 2 < idx.len() && rtl(idx[e + 2])))
-                    {
-                        e += 1;
-                    }
-                    idx[k..=e].reverse();
-                    k = e + 1;
-                } else {
-                    k += 1;
-                }
-            }
+        for &si in &blocks[b].0 {
+            place_glyphs(&glyphs, &height, &segs[si], &mut sc);
+            let h = segs[si].h;
             // Word gaps relative to this line's typical letter gap (handles tracking).
-            let mut gaps: Vec<f32> = s.idx.windows(2).map(|w| glyphs[w[1]].rect[0] - glyphs[w[0]].rect[2]).collect();
-            gaps.sort_by(f32::total_cmp);
-            let typical = gaps.get(gaps.len() / 3).copied().unwrap_or(0.0).max(0.0);
-            let threshold = (typical + s.h * WORD_GAP).max(s.h * WORD_GAP);
-            let mut spaces = vec![false; idx.len()];
-            for w in 1..s.idx.len() {
-                let (p, c) = (s.idx[w - 1], s.idx[w]);
+            sc.gaps.clear();
+            sc.gaps.extend(sc.placed.windows(2).map(|w| glyphs[w[1]].rect[0] - glyphs[w[0]].rect[2]));
+            sc.gaps.sort_by(f32::total_cmp);
+            let typical = sc.gaps.get(sc.gaps.len() / 3).copied().unwrap_or(0.0).max(0.0);
+            let threshold = (typical + h * WORD_GAP).max(h * WORD_GAP);
+            spaces.clear();
+            spaces.resize(sc.placed.len(), false);
+            for (w, pair) in sc.placed.windows(2).enumerate() {
+                let &[p, c] = pair else { continue };
                 let gap = glyphs[c].rect[0] - glyphs[p].rect[2];
                 let (pt, ct) = (&glyphs[p].text, &glyphs[c].text);
-                let cjk = pt.chars().any(is_cjk) && ct.chars().any(is_cjk) && gap < s.h * 0.5;
-                let tight_cluster = (pt.chars().any(is_complex) || ct.chars().any(is_complex)) && gap < s.h * 0.6;
-                if gap > threshold && !cjk && !tight_cluster && !pt.trim().is_empty() && !ct.trim().is_empty() {
-                    // Mark the space before glyph `c` wherever it ended up after RTL reversal.
-                    if let Some(pos) = idx.iter().position(|x| *x == c.max(p)) {
-                        spaces[pos] = true;
-                    }
+                let cjk = pt.chars().any(is_cjk) && ct.chars().any(is_cjk) && gap < h * 0.5;
+                let tight_cluster = (pt.chars().any(is_complex) || ct.chars().any(is_complex)) && gap < h * 0.6;
+                let run_start = sc.breaks.binary_search(&c).is_ok();
+                if let Some(space) = spaces.get_mut(w + 1) {
+                    *space = (gap > threshold || run_start) && !cjk && !tight_cluster && !pt.trim().is_empty() && !ct.trim().is_empty();
                 }
             }
-            for (k, g) in idx.iter().enumerate() {
-                order.push(*g);
-                line_of.push(line);
-                space_before.push(k > 0 && spaces[k]);
+            // Right-to-left spans are reversed (visual → logical) with their gaps, and only then is a second copy made.
+            let has_rtl = sc.placed.iter().any(|&i| glyphs[i].text.chars().any(is_rtl));
+            if has_rtl {
+                sc.logical.clear();
+                sc.logical.extend_from_slice(&sc.placed);
+                reverse_rtl(&glyphs, &mut sc.logical, &mut spaces);
             }
+            let idx: &[usize] = if has_rtl { &sc.logical } else { &sc.placed };
+            order.extend_from_slice(idx);
+            line_of.resize(order.len(), line);
+            // `spaces[0]` stays false: the first glyph of a segment never takes a space.
+            space_before.extend(spaces.iter().take(idx.len()));
+            space_before.resize(order.len(), false);
             line += 1;
         }
     }
@@ -1158,6 +1518,21 @@ mod tests {
         assert_eq!(layout(v).plain_text(), "每个字");
     }
 
+    /// #1062: the word gap stays between the runs when the right-hand run is drawn first, and
+    /// between the words of a right-to-left line.
+    #[test]
+    fn word_gaps_follow_position_not_drawing_order() {
+        let mut v = Vec::new();
+        word(&mut v, "19.4", 40.0, 10.0, 6.0);
+        word(&mut v, "20.0", 10.0, 10.0, 6.0);
+        assert_eq!(layout(v).plain_text(), "20.0 19.4");
+        let mut v = Vec::new();
+        // "שלום עולם" drawn visually: עולם reversed on the left, שלום reversed on the right.
+        word(&mut v, "םלוע", 10.0, 10.0, 6.0);
+        word(&mut v, "םולש", 40.0, 10.0, 6.0);
+        assert_eq!(layout(v).plain_text(), "שלום עולם");
+    }
+
     /// Two lines, "ab cd" and "e fg": words stop at blank glyphs, word gaps and line ends.
     #[test]
     fn words_and_lines_around_a_glyph() {
@@ -1298,6 +1673,231 @@ mod tests {
         assert!((slant - 10.0).abs() < 1e-3, "the skewed glyph's upright edge leans by half its 20 pt height: {skewed:?}");
     }
 
+    /// The operators drawing each `(text, text matrix)` run in Helvetica 12 pt, one text object per run.
+    fn run_ops(runs: &[(&str, &str)]) -> String {
+        runs.iter().map(|(text, tm)| format!("BT /F1 12 Tf {tm} Tm ({text}) Tj ET\n")).collect()
+    }
+
+    fn page_glyphs(ops: &str) -> PageText {
+        extract_page(&text_page(ops), 0, &InterpreterSettings::default()).unwrap()
+    }
+
+    #[test]
+    fn runs_printed_over_each_other_stay_whole_at_any_angle() {
+        // Two runs that start at one point (exact overprint), that start 40 pt along and 3 pt down
+        // (shifted), and that are 14 pt apart (clear): at 0° and at 37°, each run comes out whole.
+        let tm = |angle: f32, along: f32, down: f32| {
+            let (s, c) = angle.to_radians().sin_cos();
+            let (x, y) = (100.0 + along * c - down * s, 200.0 + along * s + down * c);
+            format!("{c:.6} {s:.6} {:.6} {c:.6} {x:.4} {y:.4}", -s)
+        };
+        let (alpha, delta) = ("Alpha beta gamma", "Delta epsilon zeta");
+        for angle in [0.0, 37.0] {
+            for (along, down) in [(0.0, 0.0), (40.0, -3.0), (0.0, -14.0)] {
+                let text = page_glyphs(&run_ops(&[(alpha, &tm(angle, 0.0, 0.0)), (delta, &tm(angle, along, down))]));
+                for run in [alpha, delta] {
+                    assert!(
+                        !text.find(run).is_empty(),
+                        "{run:?} whole at {angle}° with the second run {along} pt along and {down} pt across: {:?}",
+                        text.plain_text()
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn a_run_drawn_over_a_line_leaves_the_line_whole() {
+        // "XX" is drawn over the middle of "beta" after the line, so it is a run of its own that
+        // overlaps the line. The line must still come out as one whole line.
+        let text = page_glyphs(&run_ops(&[("Alpha beta gamma", "1 0 0 1 100 200"), ("XX", "1 0 0 1 136 200")]));
+        let flat = text.plain_text();
+        assert!(flat.contains("Alpha beta gamma"), "{flat:?}");
+        assert!(flat.contains("XX") && !flat.contains('\n'), "{flat:?}");
+    }
+
+    #[test]
+    fn a_combining_mark_drawn_last_stays_with_its_letter() {
+        // "ab", then a far-off "Z", then a zero-width combining mark at the start of "b". The mark
+        // is a run of its own, but it has no extent, so it goes back next to "b".
+        let mut v = Vec::new();
+        word(&mut v, "ab", 10.0, 10.0, 6.0);
+        v.push(g("Z", 200.0, 10.0, 206.0));
+        v.push(g("\u{301}", 16.0, 10.0, 16.0));
+        let t = layout(v);
+        assert_eq!(t.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), ["a", "b", "\u{301}", "Z"]);
+    }
+
+    #[test]
+    fn runs_differing_only_in_glyph_boundaries_are_not_redraws() {
+        // "ab" + "c" and "a" + "bc" have the same letters over the same places, but the glyph
+        // boundaries differ, so the second is not a redraw of the first and both stay.
+        let mut v = vec![g("ab", 10.0, 10.0, 16.0), g("c", 16.0, 10.0, 22.0)];
+        v.push(g("Z", 200.0, 10.0, 206.0));
+        v.push(g("a", 10.0, 10.0, 16.0));
+        v.push(g("bc", 16.0, 10.0, 22.0));
+        assert_eq!(layout(v).glyphs.len(), 5);
+    }
+
+    #[test]
+    fn many_combining_marks_stay_with_their_letters() {
+        // 400 letters on one line, then a zero-width mark at the start of each one, drawn after the whole line:
+        // the marks form one run of their own, and each goes back next to its letter, in order.
+        let letters: Vec<String> = (0..400).map(|i| char::from(b'a' + (i % 26) as u8).to_string()).collect();
+        let mut v = Vec::new();
+        for (i, c) in letters.iter().enumerate() {
+            let x = 10.0 + i as f32 * 6.0;
+            v.push(g(c, x, 10.0, x + 6.0));
+        }
+        for i in 0..letters.len() {
+            let x = 10.0 + i as f32 * 6.0;
+            v.push(g("\u{301}", x, 10.0, x));
+        }
+        let t = layout(v);
+        let expected: Vec<&str> = letters.iter().flat_map(|c| [c.as_str(), "\u{301}"]).collect();
+        assert_eq!(t.glyphs.iter().map(|g| g.text.as_str()).collect::<Vec<_>>(), expected);
+        assert!(t.line_of.iter().all(|line| *line == 0));
+    }
+
+    /// `count` runs of three glyphs, each starting within 3 pt of x = 10 on one baseline, so they all overprint one
+    /// another. Every glyph has a text of its own, so no glyph is taken for a fake-bold copy. With `separated`, each run
+    /// follows a far-off glyph, which makes it a run of its own.
+    fn overprinted_runs(count: usize, separated: bool) -> Vec<TextGlyph> {
+        let mut v = Vec::new();
+        for k in 0..count {
+            let text: String = (0..3).map(|i| char::from_u32(0x4E00 + (3 * k + i) as u32).unwrap()).collect();
+            word(&mut v, &text, 10.0 + (k * 7 % 31) as f32 * 0.1, 10.0, 6.0);
+            if separated {
+                let far = char::from_u32(0x2500 + k as u32).unwrap().to_string();
+                v.push(g(&far, 500.0, 10.0, 506.0));
+            }
+        }
+        v
+    }
+
+    #[test]
+    fn a_dense_overprint_joins_its_runs_and_keeps_each_whole() {
+        // 150 runs of three glyphs: about 100 000 overlapping pairs, far more than the sweep's budget. The segment is
+        // joined as one component, so the sweep is skipped, and each run still comes out whole.
+        let v = overprinted_runs(150, false);
+        let refs: Vec<&TextGlyph> = v.iter().collect();
+        let height = |i: usize| (refs[i].rect[3] - refs[i].rect[1]).max(0.1);
+        let mut sc = Scratch { text: (0..150).map(|k| Run { start: 3 * k, end: 3 * k + 3 }).collect(), ..Default::default() };
+        assert!(collide(&refs, &height, 10.0, &mut sc), "more pairs than the budget");
+        assert_eq!(sc.units.len(), 1, "one component");
+
+        let v = overprinted_runs(150, true);
+        let runs: Vec<String> = (0..150).map(|k| v[4 * k..4 * k + 3].iter().map(|g| g.text.as_str()).collect()).collect();
+        let t = layout(v);
+        assert_eq!(t.glyphs.len(), 600);
+        for run in &runs {
+            assert!(!t.find(run).is_empty(), "{run:?} whole in {:?}", t.plain_text());
+        }
+    }
+
+    #[test]
+    fn overlapping_rows_each_start_a_word() {
+        // 60 rows of three glyphs, each row starting 2 pt right of the one before and overprinting it, so every row
+        // is a forced word break. The rows are separated by far-off glyphs, which makes each one a run of its own.
+        // Every glyph has a text of its own, so no glyph is taken for a fake-bold copy.
+        let mut v = Vec::new();
+        let mut rows = Vec::new();
+        for k in 0..60 {
+            let text: String = (0..3).map(|i| char::from_u32(0x0400 + (3 * k + i) as u32).unwrap()).collect();
+            word(&mut v, &text, 10.0 + 2.0 * k as f32, 10.0, 6.0);
+            v.push(g(&char::from_u32(0x0500 + k as u32).unwrap().to_string(), 500.0, 10.0, 506.0));
+            rows.push(text);
+        }
+        let t = layout(v);
+        let expected: String = rows.join(" ");
+        assert!(t.plain_text().starts_with(&expected), "{:?}", t.plain_text());
+    }
+
+    #[test]
+    fn a_long_line_keeps_every_word_gap() {
+        // 1500 five-letter words on one line, a word gap after each: every gap is found, and only those.
+        let mut v = Vec::new();
+        let mut words = Vec::new();
+        for w in 0..1500 {
+            let text: String = (0..5).map(|i| char::from(b'a' + ((w * 7 + i * 3) % 26) as u8)).collect();
+            word(&mut v, &text, 10.0 + w as f32 * 36.0, 10.0, 6.0);
+            words.push(text);
+        }
+        assert_eq!(layout(v).plain_text(), words.join(" "));
+    }
+
+    #[test]
+    fn a_redraw_is_found_among_look_alike_runs_up_to_the_candidate_limit() {
+        // 40 runs of "abc" share a text and a grid cell, but each differs from every other by more than a fifth of a
+        // line in its second or third glyph, so none redraws another. A run of "abc" at the place of the newest run is
+        // found, as the newest candidates are checked first. One at the place of the oldest run is 40 candidates back,
+        // past the limit, so it is kept.
+        let abc = |v: &mut Vec<TextGlyph>, k: usize| {
+            let (b, c) = (16.0 + 2.5 * (k % 4) as f32, 22.0 + 2.5 * (k / 4) as f32);
+            v.push(g("a", 10.0, 10.0, 16.0));
+            v.push(g("b", b, 10.0, b + 6.0));
+            v.push(g("c", c, 10.0, c + 6.0));
+        };
+        let far = |v: &mut Vec<TextGlyph>| {
+            for _ in 0..4 {
+                let x = 500.0 + 10.0 * v.len() as f32;
+                v.push(g("|", x, 10.0, x + 6.0));
+            }
+        };
+        let mut v = Vec::new();
+        for k in 0..40 {
+            abc(&mut v, k);
+            far(&mut v);
+        }
+        abc(&mut v, 39);
+        far(&mut v);
+        assert_eq!(layout(v.clone()).glyphs.iter().filter(|g| g.text == "a").count(), 40);
+        abc(&mut v, 0);
+        assert_eq!(layout(v).glyphs.iter().filter(|g| g.text == "a").count(), 41);
+    }
+
+    #[test]
+    fn a_run_redrawn_at_the_same_place_is_printed_once() {
+        // "Hello world" drawn again 0.1 pt away (doubled text) prints once. The same words far
+        // below are a separate line, as they are not a redraw.
+        let ops = run_ops(&[("Hello world", "1 0 0 1 100 200"), ("Hello world", "1 0 0 1 100.1 200.1"), ("Hello world", "1 0 0 1 100 100")]);
+        assert_eq!(page_text(&ops), "Hello world\nHello world");
+    }
+
+    #[test]
+    fn a_redraw_is_found_past_an_earlier_run_with_the_same_key() {
+        // Two "Hello" runs share a text and a grid cell but do not redraw each other: the second is
+        // tracked wider. A third run redraws the second and is dropped. A far-off "Z" keeps each run
+        // a segment of its own.
+        let mut v = Vec::new();
+        word(&mut v, "Hello", 10.0, 10.0, 6.0);
+        v.push(g("Z", 200.0, 10.0, 206.0));
+        word(&mut v, "Hello", 10.5, 10.0, 9.0);
+        v.push(g("Z", 300.0, 10.0, 306.0));
+        word(&mut v, "Hello", 10.6, 10.0, 9.0);
+        let t = layout(v);
+        assert_eq!(t.glyphs.iter().filter(|g| g.text == "H").count(), 2, "{:?}", t.plain_text());
+        assert_eq!(t.glyphs.len(), 12);
+    }
+
+    #[test]
+    fn runs_that_only_touch_or_overlap_slightly_still_join() {
+        // "beta" is drawn first, then "Alpha" to its left: 2 pt apart (touching) or 2 pt overlapping
+        // (negative spacing). Both come out as one line in reading order. Where the word space goes
+        // for reversed fragments is not asserted here.
+        let mut v = Vec::new();
+        word(&mut v, "beta", 42.0, 10.0, 6.0);
+        word(&mut v, "Alpha", 10.0, 10.0, 6.0);
+        let t = layout(v);
+        assert_eq!(t.plain_text().replace(' ', ""), "Alphabeta");
+        assert!(t.line_of.iter().all(|line| *line == 0));
+        let mut v = Vec::new();
+        word(&mut v, "beta", 38.0, 10.0, 6.0);
+        word(&mut v, "Alpha", 10.0, 10.0, 6.0);
+        let t = layout(v);
+        assert_eq!(t.plain_text(), "Alphabeta");
+    }
+
     /// A three-row table, "Name Qty / Apple 12 / Pear 7": the columns sit far enough apart that
     /// reading order takes one column, then the other.
     fn table() -> PageText {
diff --git a/crates/sign/README.md b/crates/sign/README.md
index 78fb8d72..c3462fa9 100644
--- a/crates/sign/README.md
+++ b/crates/sign/README.md
@@ -20,7 +20,9 @@ for s in signatures(&doc, &bytes, &trust) {                                // li
   no fix, so `rsa` is only used to verify). ECDSA signs with deterministic nonces (RFC 6979).
 - **Signing:** PAdES B-B (`ETSI.CAdES.detached`, signing-certificate-v2, SHA-256/384, no SHA-1).
   An existing unsigned field or a new one (visible with Acrobat's name-and-details appearance,
-  or invisible); certification with DocMDP P=1/2/3. The document is written incrementally
+  or invisible); certification with DocMDP P=1/2/3. A visible signature can show a `Graphic`
+  where the large name would be: drawn strokes, filled outlines (a typed signature) or RGBA
+  pixels (an image XObject with a soft mask), checked and size-capped first. The document is written incrementally
   with a zero-filled `/Contents` and fixed-width `/ByteRange`, which are then patched in
   place. Encrypted documents are refused for now.
 - **Timestamps (PAdES B-T):** the `timestamp` module builds and parses RFC 3161 requests,
diff --git a/crates/sign/src/graphic.rs b/crates/sign/src/graphic.rs
new file mode 100644
index 00000000..5d50c6f7
--- /dev/null
+++ b/crates/sign/src/graphic.rs
@@ -0,0 +1,178 @@
+//! A picture in a visible signature, where the signer's name would be large (Acrobat: Configure
+//! Signature Appearance ▸ Draw or Image, and typed signatures). Drawn as Fill & Sign draws its
+//! signatures: ink smoothed and stroked with round ends, typed outlines filled even-odd, images
+//! with their alpha as a soft mask.
+
+use std::sync::Arc;
+
+use pdfcraft_annot::appearance::smooth_segments;
+use pdfcraft_cos::{Dict, Document, ObjRef, Object, Stream};
+
+use crate::SignError;
+
+/// Bounds the content stream a graphic from settings or an agent can produce. A typed name in
+/// the script font stays under 262,144 points.
+const MAX_POINTS: usize = 300_000;
+/// Image limits: a side and the whole picture (the UI keeps signature images under 4 MP).
+const MAX_SIDE: u32 = 8192;
+const MAX_PIXELS: u64 = 1 << 24;
+
+#[derive(Clone, PartialEq)]
+pub enum Graphic {
+    /// Drawn strokes, y up, in units where the drawing pad is 1 wide (as Fill & Sign saves them).
+    Strokes(Vec<Vec<[f64; 2]>>),
+    /// Closed outlines, y up, filled even-odd: a typed signature in the script font.
+    Outlines(Vec<Vec<[f64; 2]>>),
+    /// Straight (not premultiplied) RGBA pixels, rows from the top.
+    Image { width: u32, height: u32, rgba: Arc<Vec<u8>> },
+}
+
+/// Sizes only: a graphic can hold megabytes of pixels or points.
+impl std::fmt::Debug for Graphic {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Graphic::Strokes(s) => write!(f, "Strokes({} strokes, {} points)", s.len(), s.iter().map(Vec::len).sum::<usize>()),
+            Graphic::Outlines(c) => write!(f, "Outlines({} contours, {} points)", c.len(), c.iter().map(Vec::len).sum::<usize>()),
+            Graphic::Image { width, height, rgba } => write!(f, "Image({width}x{height}, {} bytes)", rgba.len()),
+        }
+    }
+}
+
+fn bad(why: &str) -> SignError {
+    SignError::Pdf(format!("the signature graphic {why}"))
+}
+
+/// The drawing's bounds `[x0, y0, x1, y1]` over `points`, refusing non-finite or unbounded ones.
+fn bounds<'a>(points: impl Iterator<Item = &'a [f64; 2]>) -> Result<[f64; 4], SignError> {
+    let mut b = [f64::INFINITY, f64::INFINITY, f64::NEG_INFINITY, f64::NEG_INFINITY];
+    for p in points {
+        if !p.iter().all(|v| v.is_finite()) {
+            return Err(bad("has a point that isn't a number"));
+        }
+        b = [b[0].min(p[0]), b[1].min(p[1]), b[2].max(p[0]), b[3].max(p[1])];
+    }
+    if !b.iter().all(|v| v.is_finite()) {
+        return Err(bad("is empty"));
+    }
+    if !((b[2] - b[0]).is_finite() && (b[3] - b[1]).is_finite()) {
+        return Err(bad("is too large"));
+    }
+    Ok(b)
+}
+
+/// `(scale, x, y)` placing `b` as large as fits in `area` (`[x, y, w, h]`), centred.
+fn fit(b: [f64; 4], area: [f64; 4]) -> (f64, f64, f64) {
+    // A dot or a straight line has no extent on an axis; it is placed by the other one.
+    let (bw, bh) = ((b[2] - b[0]).max(1e-9), (b[3] - b[1]).max(1e-9));
+    let k = (area[2] / bw).min(area[3] / bh);
+    (k, area[0] + (area[2] - (b[2] - b[0]) * k) / 2.0, area[1] + (area[3] - (b[3] - b[1]) * k) / 2.0)
+}
+
+impl Graphic {
+    fn check(&self) -> Result<(), SignError> {
+        let points = match self {
+            Graphic::Strokes(s) => s.iter().map(Vec::len).sum::<usize>(),
+            Graphic::Outlines(c) => {
+                if !c.iter().any(|c| c.len() > 2) {
+                    return Err(bad("has no outline that encloses anything"));
+                }
+                c.iter().map(Vec::len).sum()
+            }
+            Graphic::Image { width, height, rgba } => {
+                if *width == 0 || *height == 0 || *width > MAX_SIDE || *height > MAX_SIDE || u64::from(*width) * u64::from(*height) > MAX_PIXELS {
+                    return Err(bad(&format!("image is {width} x {height} pixels; at most {MAX_SIDE} per side and 16 megapixels")));
+                }
+                let expected = (*width as usize).checked_mul(*height as usize).and_then(|n| n.checked_mul(4));
+                if expected != Some(rgba.len()) {
+                    return Err(bad("image's pixels don't match its size"));
+                }
+                return Ok(());
+            }
+        };
+        if points > MAX_POINTS {
+            return Err(bad(&format!("has {points} points; at most {MAX_POINTS}")));
+        }
+        Ok(())
+    }
+
+    /// Check the graphic and draw it into `area` (`[x, y, w, h]` in the appearance's space):
+    /// content operators, and the image XObject added to `doc` that they name `/Im1`.
+    pub(crate) fn draw(&self, doc: &mut Document, area: [f64; 4]) -> Result<(String, Option<ObjRef>), SignError> {
+        self.check()?;
+        let n = crate::pdf::fmt;
+        match self {
+            Graphic::Strokes(strokes) => {
+                let curves: Vec<Vec<[(f64, f64); 3]>> =
+                    strokes.iter().map(|s| smooth_segments(&s.iter().map(|p| (p[0], p[1])).collect::<Vec<_>>())).collect();
+                // Curves stay within their points and control points.
+                let controls: Vec<[f64; 2]> = curves.iter().flatten().flat_map(|[a, b, _]| [[a.0, a.1], [b.0, b.1]]).collect();
+                let b = bounds(strokes.iter().flatten().chain(&controls))?;
+                // Fill & Sign draws 1.5 pt ink on a 150 pt wide pad: 1% of the pad's width.
+                let probe = fit(b, area).0;
+                let width = (probe * 0.01).clamp(0.3, 4.0);
+                let inset = [area[0] + width / 2.0, area[1] + width / 2.0, (area[2] - width).max(0.0), (area[3] - width).max(0.0)];
+                let (k, x, y) = fit(b, inset);
+                let at = |p: (f64, f64)| format!("{} {}", n(x + (p.0 - b[0]) * k), n(y + (p.1 - b[1]) * k));
+                let mut c = format!("q 0 G {} w 1 J 1 j\n", n(width));
+                for (s, segments) in strokes.iter().zip(&curves) {
+                    let Some(first) = s.first() else { continue };
+                    let start = at((first[0], first[1]));
+                    c.push_str(&format!("{start} m\n"));
+                    if segments.is_empty() {
+                        // A dot: a zero-length line, which round caps draw as a disc.
+                        c.push_str(&format!("{start} l\n"));
+                    }
+                    for [p, q, e] in segments {
+                        c.push_str(&format!("{} {} {} c\n", at(*p), at(*q), at(*e)));
+                    }
+                    c.push_str("S\n");
+                }
+                c.push_str("Q\n");
+                Ok((c, None))
+            }
+            Graphic::Outlines(contours) => {
+                let closed: Vec<&Vec<[f64; 2]>> = contours.iter().filter(|c| c.len() > 2).collect();
+                let b = bounds(closed.iter().copied().flatten())?;
+                let (k, x, y) = fit(b, area);
+                let mut c = String::from("q 0 g\n");
+                for contour in closed {
+                    for (i, p) in contour.iter().enumerate() {
+                        c.push_str(&format!("{} {} {}\n", n(x + (p[0] - b[0]) * k), n(y + (p[1] - b[1]) * k), if i == 0 { "m" } else { "l" }));
+                    }
+                    c.push_str("h\n");
+                }
+                c.push_str("f*\nQ\n");
+                Ok((c, None))
+            }
+            Graphic::Image { width, height, rgba } => {
+                let (w, h) = (f64::from(*width), f64::from(*height));
+                let (k, x, y) = fit([0.0, 0.0, w, h], area);
+                let image = image_xobject(doc, *width, *height, rgba);
+                Ok((format!("q {} 0 0 {} {} {} cm /Im1 Do Q\n", n(w * k), n(h * k), n(x), n(y)), Some(image)))
+            }
+        }
+    }
+}
+
+/// An RGB image XObject, with a soft mask when any pixel isn't opaque. `rgba` is checked.
+fn image_xobject(doc: &mut Document, width: u32, height: u32, rgba: &[u8]) -> ObjRef {
+    let dict = |space: &str| {
+        let mut d = Dict::new();
+        d.set(b"Type".to_vec(), Object::name("XObject"));
+        d.set(b"Subtype".to_vec(), Object::name("Image"));
+        d.set(b"Width".to_vec(), Object::Int(i64::from(width)));
+        d.set(b"Height".to_vec(), Object::Int(i64::from(height)));
+        d.set(b"ColorSpace".to_vec(), Object::name(space));
+        d.set(b"BitsPerComponent".to_vec(), Object::Int(8));
+        d
+    };
+    let (pixels, _) = rgba.as_chunks::<4>();
+    let rgb: Vec<u8> = pixels.iter().flat_map(|p| [p[0], p[1], p[2]]).collect();
+    let mut d = dict("DeviceRGB");
+    if pixels.iter().any(|p| p[3] != 255) {
+        let alpha: Vec<u8> = pixels.iter().map(|p| p[3]).collect();
+        let mask = doc.add(Object::Stream(Stream::flate(dict("DeviceGray"), &alpha)));
+        d.set(b"SMask".to_vec(), Object::Ref(mask));
+    }
+    doc.add(Object::Stream(Stream::flate(d, &rgb)))
+}
diff --git a/crates/sign/src/keychain.rs b/crates/sign/src/keychain.rs
index 4d52031b..601f1b97 100644
--- a/crates/sign/src/keychain.rs
+++ b/crates/sign/src/keychain.rs
@@ -49,7 +49,9 @@ pub fn find(reference_or_name: &str) -> Result<DigitalId, SignError> {
 }
 
 /// The signing identities in the user's keychains (or only in the keychain file `keychain`).
-/// Identities with keys PdfCraft can't use (other curves, Ed25519) are left out.
+/// Without a keychain file, smart cards macOS reads through CryptoTokenKit (a CAC or PIV card
+/// in a reader) are searched too; their keys stay on the card, which asks for its PIN when
+/// signing. Identities with keys PdfCraft can't use (other curves, Ed25519) are left out.
 pub fn identities(keychain: Option<&Path>) -> Result<Vec<DigitalId>, SignError> {
     let mut search = ItemSearchOptions::new();
     search.class(ItemClass::identity()).load_refs(true).limit(Limit::All);
@@ -58,7 +60,25 @@ pub fn identities(keychain: Option<&Path>) -> Result<Vec<DigitalId>, SignError>
         kc = SecKeychain::open(p).map_err(|e| SignError::Crypto(format!("{}: {e}", p.display())))?;
         search.keychains(std::slice::from_ref(&kc));
     }
-    let found = match search.search() {
+    let mut out = collect(search.search(), false)?;
+    if keychain.is_none() {
+        let mut tokens = ItemSearchOptions::new();
+        tokens.class(ItemClass::identity()).load_refs(true).limit(Limit::All).access_group_token();
+        // A smart card that can't be searched (none inserted, reader unplugged) only means
+        // there are no card identities; the Keychain's own identities still count.
+        for id in collect(tokens.search(), true).unwrap_or_default() {
+            if !out.iter().any(|o| o.certificate.raw == id.certificate.raw) {
+                out.push(id);
+            }
+        }
+    }
+    Ok(out)
+}
+
+/// The usable identities in one search's results. `card` marks them as smart card identities
+/// in their friendly name.
+fn collect(found: Result<Vec<SearchResult>, security_framework::base::Error>, card: bool) -> Result<Vec<DigitalId>, SignError> {
+    let found = match found {
         Ok(f) => f,
         // "The specified item could not be found in the keychain."
         Err(e) if e.code() == -25300 => return Ok(Vec::new()),
@@ -69,9 +89,16 @@ pub fn identities(keychain: Option<&Path>) -> Result<Vec<DigitalId>, SignError>
         let SearchResult::Ref(Reference::Identity(id)) = r else { continue };
         let (Ok(cert), Ok(key)) = (id.certificate(), id.private_key()) else { continue };
         let Ok(certificate) = Certificate::parse(&cert.to_der()) else { continue };
+        // A CAC carries an encryption-only certificate beside its signing ones; a signature
+        // made with it would fail validation, so only offer certificates allowed to sign
+        // (key usage digitalSignature or nonRepudiation).
+        if card && certificate.key_usage.is_some_and(|u| u & 0b11 == 0) {
+            continue;
+        }
         let rsa = matches!(certificate.public_key, PublicKey::Rsa { .. });
         let key = PrivateKey::external(certificate.public_key.clone(), Arc::new(KeychainKey { key, rsa }));
-        let friendly_name = Some(certificate.display_name());
+        let name = certificate.display_name();
+        let friendly_name = Some(if card { format!("{name} (smart card)") } else { name });
         out.push(DigitalId { key, certificate, chain: Vec::new(), friendly_name });
     }
     Ok(out)
diff --git a/crates/sign/src/lib.rs b/crates/sign/src/lib.rs
index 9cb57c03..2954de28 100644
--- a/crates/sign/src/lib.rs
+++ b/crates/sign/src/lib.rs
@@ -11,6 +11,7 @@ pub mod cms;
 pub mod der;
 pub mod dss;
 mod ec512;
+pub mod graphic;
 #[cfg(target_os = "macos")]
 pub mod keychain;
 pub mod keys;
@@ -24,10 +25,11 @@ pub mod windows;
 pub mod x509;
 
 pub use der::Time;
+pub use graphic::Graphic;
 pub use keys::{DigestAlg, PrivateKey, PublicKey};
 pub use pdf::{
-    Appearance, DigestCache, Modification, SignOptions, SignatureInfo, Status, TrustStore, list as signatures, sign, sign_with_timestamp,
-    timestamp_document, validate,
+    Appearance, AppearanceLabels, Detail, DigestCache, Fill, Modification, SignOptions, SignatureInfo, Status, TrustStore, WORDINGS, Words,
+    in_english, kind, list as signatures, sign, sign_with_timestamp, timestamp_document, validate,
 };
 pub use pkcs12::DigitalId;
 pub use timestamp::{TimestampAuthority, TimestampQuery, TimestampToken};
diff --git a/crates/sign/src/pdf.rs b/crates/sign/src/pdf.rs
index f6715635..4ba11e9d 100644
--- a/crates/sign/src/pdf.rs
+++ b/crates/sign/src/pdf.rs
@@ -212,17 +212,200 @@ pub enum Status {
     Invalid,
 }
 
+/// What a change made after signing is called: the words [`Modification`] lists it by, and the
+/// vocabulary a signature's details speak of changes in.
+///
+/// They are words of ours, not the document's, so an interface reading in another language
+/// translates each of them; [`ALL`](kind::ALL) is the whole vocabulary.
+pub mod kind {
+    pub const PAGE_CONTENT: &str = "page content";
+    pub const FORM_FILL: &str = "form fill";
+    pub const COMMENTS: &str = "comments";
+    pub const SIGNATURE: &str = "signature";
+    pub const SECURITY_STORE: &str = "document security store";
+    pub const METADATA: &str = "metadata";
+    pub const LINKS: &str = "links";
+    pub const STRUCTURE: &str = "document structure";
+    pub const PAGES: &str = "pages added or removed";
+    pub const OTHER: &str = "other changes";
+    /// Not a change but the reason there is nothing to compare: the signed revision itself could not
+    /// be read, so what came after it cannot be allowed.
+    pub const UNREADABLE: &str = "the signed version could not be read";
+
+    /// Every word above, for an interface to translate.
+    pub const ALL: &[&str] = &[PAGE_CONTENT, FORM_FILL, COMMENTS, SIGNATURE, SECURITY_STORE, METADATA, LINKS, STRUCTURE, PAGES, OTHER, UNREADABLE];
+}
+
 /// Changes made after signing.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum Modification {
     /// The signature covers the whole file.
     None,
-    /// Later revisions only make changes the signature permits (listed).
-    Allowed(Vec<String>),
-    /// Later revisions make changes it doesn't permit (listed).
-    Disallowed(Vec<String>),
+    /// Later revisions only make changes the signature permits, listed in the words of [`kind`].
+    Allowed(Vec<&'static str>),
+    /// Later revisions make changes it doesn't permit, listed in the words of [`kind`].
+    Disallowed(Vec<&'static str>),
 }
 
+/// One of the sentences that explain a signature's verdict.
+///
+/// [`message`](Detail::message) is the sentence in English, ready to read. An interface that reads in
+/// another language says it with [`Detail::said`] instead, out of [`pattern`](Detail::pattern) —
+/// wording of ours, listed in [`WORDINGS`] — and [`fill`](Detail::fill), whatever goes in it.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Detail {
+    /// The sentence in English.
+    pub message: String,
+    /// The sentence as it is worded here, with `{}` where the fill goes.
+    pub pattern: &'static str,
+    pub fill: Fill,
+}
+
+/// What goes where a [`Detail`]'s pattern has `{}`.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum Fill {
+    /// Nothing: the pattern is the whole sentence.
+    Nothing,
+    /// The changes made after signing, as [`Modification`] lists them: words of ours, each one in
+    /// [`kind::ALL`], said one after another.
+    Changes(Vec<&'static str>),
+    /// What a reader could not make of the signature, in its own words. It goes in as it stands: it
+    /// names the structure that is wrong, which is a developer's business and reads the same
+    /// everywhere.
+    Reason(String),
+    /// A value out of the signature itself — a time, the evidence a revocation came from — written
+    /// as it stands, the way a certificate's name or date is.
+    Value(String),
+    /// Two certificates' own names, for the wording that says one was not used to vouch for the
+    /// other. They go in the order the wording puts its two holes in, which a language may reverse.
+    Names(String, String),
+}
+
+impl Detail {
+    /// The sentence said in the language `words` translates into.
+    ///
+    /// The wording is translated, and what fills it goes in afterwards — the changes translated too —
+    /// so nothing put in can be mistaken for a hole of its own. With [`in_english`] this is
+    /// [`message`](Detail::message).
+    pub fn said(&self, words: Words) -> String {
+        let said = words(self.pattern);
+        match &self.fill {
+            Fill::Nothing => said,
+            Fill::Changes(c) => said.replacen("{}", &c.iter().map(|k| words(k)).collect::<Vec<_>>().join(", "), 1),
+            Fill::Reason(r) | Fill::Value(r) => said.replacen("{}", r, 1),
+            // Both holes are cut out of the wording first, so neither name can be taken for the other's.
+            Fill::Names(a, b) => {
+                let mut parts = said.splitn(3, "{}");
+                match (parts.next(), parts.next(), parts.next()) {
+                    (Some(p0), Some(p1), Some(p2)) => format!("{p0}{a}{p1}{b}{p2}"),
+                    // A wording with one hole, or none: say it as it is rather than guess.
+                    _ => said,
+                }
+            }
+        }
+    }
+
+    /// The whole sentence, with no hole in it.
+    pub(crate) fn plain(pattern: &'static str) -> Detail {
+        Detail::of(pattern, Fill::Nothing)
+    }
+
+    /// The sentence and what fills its hole. The English is said once, here, so it and
+    /// [`Detail::said`] cannot drift apart.
+    pub(crate) fn of(pattern: &'static str, fill: Fill) -> Detail {
+        let mut d = Detail { message: String::new(), pattern, fill };
+        d.message = d.said(&in_english);
+        d
+    }
+}
+
+/// How an interface says one of this crate's wordings in its own language: it is handed the English
+/// and gives back what it reads. [`in_english`] is the one that keeps the English.
+pub type Words<'a> = &'a dyn Fn(&str) -> String;
+
+/// [`Words`] that leaves the English as it is.
+pub fn in_english(wording: &str) -> String {
+    wording.to_owned()
+}
+
+/// Every sentence this crate says about a signature: what [`SignatureInfo::details`] can hold, and
+/// the summaries [`SignatureInfo::summary`] chooses between.
+///
+/// An interface reading in another language translates these and the words in [`kind::ALL`], which
+/// go into the two sentences that list changes. The rest of what it shows comes from elsewhere and
+/// goes through as it stands: the certificate's names and dates, and a reader's own detail in
+/// [`Fill::Reason`]. A test in this crate keeps the list in step with the code.
+pub const WORDINGS: &[&str] = &[
+    // What the signature's own structure says, before anything is verified.
+    "The signature has no valid byte range.",
+    "The signature's byte range does not match the file.",
+    "The signature's byte range does not exclude exactly its contents.",
+    "The signature contents are not hexadecimal.",
+    "The signature could not be read ({}).",
+    "PdfCraft can't check this signature yet: {}.",
+    "The signature uses the legacy adbe.x509.rsa_sha1 format.",
+    // What was read leniently on the way, each sentence worded where the reading happens.
+    "The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.",
+    "The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.",
+    "The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.",
+    "The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway.",
+    "The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.",
+    "The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.",
+    "The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.",
+    // What a signature that validates with an old hash still does not prove.
+    "This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.",
+    "This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.",
+    // Whether the signed bytes and the signature still agree.
+    "The document has been altered or corrupted since the signature was applied.",
+    "The signer's certificate is not in the signature.",
+    "The signature value does not match the signer's certificate: the signature is corrupt.",
+    "The signature could not be checked ({}).",
+    "The signature could not be verified ({}).",
+    // What came after the signature.
+    "This document has not been modified since this signature was applied.",
+    "The document has been modified since this signature was applied, but the changes are permitted ({}).",
+    "The document has been altered since this signature was applied in ways it does not permit ({}).",
+    // Who signed, and when.
+    "The signer's certificate was not valid at the time of signing.",
+    "The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation).",
+    "The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).",
+    "The signer's certificate has critical extensions PdfCraft does not recognize ({}).",
+    // Why a certificate that matched the issuer was not used to build the chain.
+    "The certificate of {} is not a CA certificate that may issue certificates, so it is not used to vouch for {}.",
+    "The certificate of {} does not allow this many CA certificates below it (path length), so it is not used to vouch for {}.",
+    "The certificate of {} was not valid at the time of signing, so it is not used to vouch for {}.",
+    "The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.",
+    "The signer's identity is valid.",
+    "The signature includes an embedded timestamp.",
+    "Signing time is from the clock on the signer's computer.",
+    // What the signature's own timestamp token proves, if it carries one.
+    "The signature's timestamp token does not cover the signature value.",
+    "The signature's timestamp token could not be verified ({}).",
+    "The embedded timestamp token is valid and its authority is trusted; trusted time is {}.",
+    "The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.",
+    // What the document's own revocation evidence says about the signer.
+    "The signer's certificate has been revoked ({}).",
+    "The document's embedded revocation information shows that the signer's certificate has not been revoked.",
+    // A standalone document timestamp, which is checked on its own.
+    "The timestamp has no valid byte range.",
+    "The timestamp's byte range does not match the file.",
+    "The timestamp's byte range does not exclude exactly its contents.",
+    "The timestamp contents are not hexadecimal.",
+    "The timestamp token could not be read ({}).",
+    "The document has been altered or corrupted since the timestamp was applied.",
+    "The timestamp authority's certificate was not valid at the time of timestamping.",
+    "This document has not been modified since this timestamp was applied.",
+    "The document has been modified since this timestamp was applied, but the changes are permitted ({}).",
+    "The document has been altered since this timestamp was applied in ways it does not permit ({}).",
+    "The timestamp token is valid and its authority is trusted.",
+    "The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.",
+    // The one line that stands for all of it.
+    "Unsigned signature field",
+    "Signature is valid",
+    "Signature validity is unknown",
+    "Signature is invalid",
+];
+
 /// One signature field.
 #[derive(Clone, Debug)]
 pub struct SignatureInfo {
@@ -263,12 +446,14 @@ pub struct SignatureInfo {
     pub timestamp_time: Option<Time>,
     pub status: Status,
     pub modification: Modification,
-    /// Acrobat-style sentences explaining the verdict.
-    pub details: Vec<String>,
+    /// Acrobat-style sentences explaining the verdict, each one ready to read in English and ready to
+    /// be said in another language (see [`Detail`]).
+    pub details: Vec<Detail>,
 }
 
 impl SignatureInfo {
-    /// The one-line summary under the signature in the Signatures panel.
+    /// The one-line summary under the signature in the Signatures panel, in English and listed in
+    /// [`WORDINGS`] for an interface to say in its own language.
     pub fn summary(&self) -> &'static str {
         if !self.signed {
             return "Unsigned signature field";
@@ -507,23 +692,23 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
         .map(|r| {
             r.get(b"TransformParams").map(|p| doc.resolve(p)).and_then(|p| p.as_dict().and_then(|p| p.int(b"P"))).unwrap_or(2).clamp(1, 3) as u8
         });
-    let invalid = |info: &mut SignatureInfo, why: &str| {
+    let invalid = |info: &mut SignatureInfo, why: Detail| {
         info.status = Status::Invalid;
-        info.details.push(why.to_string());
+        info.details.push(why);
     };
     // Byte ranges: [0 a b c] with the gap holding exactly the hex /Contents.
     let Some(br) = nums(doc, v, b"ByteRange").filter(|b| b.len() == 4 && b.iter().all(|x| *x >= 0.0)) else {
-        return invalid(info, "The signature has no valid byte range.");
+        return invalid(info, Detail::plain("The signature has no valid byte range."));
     };
     let [o0, l0, o1, l1] = [br[0] as usize, br[1] as usize, br[2] as usize, br[3] as usize];
     if o0 != 0 || o1 < l0 || o1.checked_add(l1).is_none_or(|end| end > bytes.len()) || o1 - l0 < 2 {
-        return invalid(info, "The signature's byte range does not match the file.");
+        return invalid(info, Detail::plain("The signature's byte range does not match the file."));
     }
     let gap = &bytes[l0..o1];
     if gap.first() != Some(&b'<') || gap.last() != Some(&b'>') {
-        return invalid(info, "The signature's byte range does not exclude exactly its contents.");
+        return invalid(info, Detail::plain("The signature's byte range does not exclude exactly its contents."));
     }
-    let Some(contents) = unhex(&gap[1..gap.len() - 1]) else { return invalid(info, "The signature contents are not hexadecimal.") };
+    let Some(contents) = unhex(&gap[1..gap.len() - 1]) else { return invalid(info, Detail::plain("The signature contents are not hexadecimal.")) };
     let covered = o1 + l1;
     info.signed_len = covered;
     // The signed revision's number: its cross-reference sections (1 for a reconstructed file).
@@ -532,7 +717,8 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
     // is "invalid".
     let unsupported = |info: &mut SignatureInfo, why: &str| {
         info.status = Status::Unknown;
-        info.details.push(format!("PdfCraft can't check this signature yet: {why}."));
+        // What is not supported yet is named by the reader, in its own words.
+        info.details.push(Detail::of("PdfCraft can't check this signature yet: {}.", Fill::Reason(why.to_owned())));
     };
     if info.sub_filter.as_deref() == Some("adbe.x509.rsa_sha1") {
         return validate_x509_rsa_sha1(doc, bytes, trust, v, info, cache, (l0, o1, covered), &contents);
@@ -540,10 +726,12 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
     let sd = match SignedData::parse(&contents) {
         Ok(sd) => sd,
         Err(SignError::Unsupported(e)) => return unsupported(info, &e),
-        Err(e) => return invalid(info, &format!("The signature could not be read ({e}).")),
+        // What the reader made of it goes in as it stands: it is a developer's detail, not a sentence.
+        Err(e) => return invalid(info, Detail::of("The signature could not be read ({}).", Fill::Reason(e.to_string()))),
     };
     let s = &sd.signer;
-    info.details.extend(sd.quirks.iter().map(|q| q.to_string()));
+    // A quirk is a whole sentence the reader words for itself, so it goes on the list in `WORDINGS`.
+    info.details.extend(sd.quirks.iter().copied().map(Detail::plain));
     info.digest = Some(s.digest);
     info.timestamp = s.timestamp;
     let mut unverified_time = None;
@@ -552,7 +740,7 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
             Ok(t) => {
                 let imprint = t.digest.digest(&[&s.signature]);
                 if imprint != t.imprint {
-                    info.details.push("The signature's timestamp token does not cover the signature value.".into());
+                    info.details.push(Detail::plain("The signature's timestamp token does not cover the signature value."));
                 } else {
                     // Only a token from a trusted authority (valid when it stamped) is trusted
                     // time; otherwise its time is reported but validation uses the signer's
@@ -569,7 +757,7 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
                     }
                 }
             }
-            Err(e) => info.details.push(format!("The signature's timestamp token could not be verified ({e}).")),
+            Err(e) => info.details.push(Detail::of("The signature's timestamp token could not be verified ({}).", Fill::Reason(e.to_string()))),
         }
     }
     // The digest the signature commits to.
@@ -577,7 +765,7 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
         // adbe.pkcs7.sha1: the document's SHA-1 digest is the signed content.
         Some(c) => {
             if *c != cache.digest(DigestAlg::Sha1, bytes, l0, o1, covered) {
-                return invalid(info, "The document has been altered or corrupted since the signature was applied.");
+                return invalid(info, Detail::plain("The document has been altered or corrupted since the signature was applied."));
             }
             s.digest.digest(&[c])
         }
@@ -586,19 +774,20 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
     if let Some(md) = &s.message_digest
         && *md != content_digest
     {
-        return invalid(info, "The document has been altered or corrupted since the signature was applied.");
+        return invalid(info, Detail::plain("The document has been altered or corrupted since the signature was applied."));
     }
     let Some(cert) = sd.signer_certificate().cloned() else {
-        return invalid(info, "The signer's certificate is not in the signature.");
+        return invalid(info, Detail::plain("The signer's certificate is not in the signature."));
     };
     info.algorithm = Some(format!("{} with {}", cert.public_key.describe(), s.scheme_digest.unwrap_or(s.digest).name()));
     info.signer = Some(cert.display_name());
     let mut notes = Vec::new();
     match sd.verify_signature_noting(&cert, &content_digest, &mut notes) {
-        Ok(true) => info.details.extend(notes.into_iter().map(String::from)),
+        // A note is a whole sentence the reader words for itself, like a quirk.
+        Ok(true) => info.details.extend(notes.into_iter().map(Detail::plain)),
         Ok(false) => {
             info.certificate = Some(cert);
-            return invalid(info, "The signature value does not match the signer's certificate: the signature is corrupt.");
+            return invalid(info, Detail::plain("The signature value does not match the signer's certificate: the signature is corrupt."));
         }
         Err(SignError::Unsupported(e)) => {
             info.certificate = Some(cert);
@@ -606,7 +795,7 @@ fn validate_into(doc: &Document, bytes: &[u8], trust: &TrustStore, v: &Dict, inf
         }
         Err(e) => {
             info.certificate = Some(cert);
-            return invalid(info, &format!("The signature could not be checked ({e})."));
+            return invalid(info, Detail::of("The signature could not be checked ({}).", Fill::Reason(e.to_string())));
         }
     }
     finish_validation(doc, bytes, trust, info, cache, covered, cert, &sd.certificates, s.signing_time, unverified_time);
@@ -653,22 +842,28 @@ fn finish_validation(
         classify_changes(doc, cache.revision(bytes, covered), info.certify)
     };
     let mut problems = false;
+    // The changes are handed over as the words they are, not stitched into the sentence, so an
+    // interface can say both in its own language.
     match &info.modification {
-        Modification::None => info.details.push("This document has not been modified since this signature was applied.".into()),
-        Modification::Allowed(kinds) => info
-            .details
-            .push(format!("The document has been modified since this signature was applied, but the changes are permitted ({}).", kinds.join(", "))),
+        Modification::None => info.details.push(Detail::plain("This document has not been modified since this signature was applied.")),
+        Modification::Allowed(kinds) => info.details.push(Detail::of(
+            "The document has been modified since this signature was applied, but the changes are permitted ({}).",
+            Fill::Changes(kinds.clone()),
+        )),
         Modification::Disallowed(kinds) => {
+            let said = Detail::of(
+                "The document has been altered since this signature was applied in ways it does not permit ({}).",
+                Fill::Changes(kinds.clone()),
+            );
             info.status = Status::Invalid;
-            info.details
-                .push(format!("The document has been altered since this signature was applied in ways it does not permit ({}).", kinds.join(", ")));
+            info.details.push(said);
             problems = true;
         }
     }
     if let Some(t) = info.timestamp_time.or(info.signing_time)
         && !cert.valid_at(t)
     {
-        info.details.push("The signer's certificate was not valid at the time of signing.".into());
+        info.details.push(Detail::plain("The signer's certificate was not valid at the time of signing."));
         // A verified revocation already made the signature invalid; keep it that way.
         if !problems && !revoked {
             info.status = Status::Unknown;
@@ -683,29 +878,30 @@ fn finish_validation(
         problems = true;
     }
     if !trusted {
-        info.details.push(
-            "The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates."
-                .into(),
-        );
+        info.details.push(Detail::plain(
+            "The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.",
+        ));
         if !problems && !revoked {
             info.status = Status::Unknown;
         }
     } else {
-        info.details.push("The signer's identity is valid.".into());
+        info.details.push(Detail::plain("The signer's identity is valid."));
         if !problems && !revoked {
             info.status = Status::Valid;
         }
     }
     if info.timestamp {
-        info.details.push("The signature includes an embedded timestamp.".into());
+        info.details.push(Detail::plain("The signature includes an embedded timestamp."));
     } else {
-        info.details.push("Signing time is from the clock on the signer's computer.".into());
+        info.details.push(Detail::plain("Signing time is from the clock on the signer's computer."));
     }
     if let Some(t) = info.timestamp_time {
-        info.details.push(format!("The embedded timestamp token is valid and its authority is trusted; trusted time is {t}."));
+        info.details
+            .push(Detail::of("The embedded timestamp token is valid and its authority is trusted; trusted time is {}.", Fill::Value(t.to_string())));
     } else if let Some(t) = unverified_time {
-        info.details.push(format!(
-            "The signature carries an unverified timestamp ({t}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead."
+        info.details.push(Detail::of(
+            "The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.",
+            Fill::Value(t.to_string()),
         ));
     }
 }
@@ -767,11 +963,14 @@ fn check_dss_revocation(doc: &Document, signer: Option<&Certificate>, at: &Optio
     match revoked {
         Some(at) => {
             info.status = Status::Invalid;
-            info.details.push(format!("The signer's certificate has been revoked ({}, {}).", sources.join(", "), at));
+            // The evidence and the date go in together: one hole, so a reader can put the
+            // sentence's parts in whatever order its language wants.
+            info.details.push(Detail::of("The signer's certificate has been revoked ({}).", Fill::Value(format!("{}, {at}", sources.join(", ")))));
             true
         }
         None if covered => {
-            info.details.push("The document's embedded revocation information shows that the signer's certificate has not been revoked.".into());
+            info.details
+                .push(Detail::plain("The document's embedded revocation information shows that the signer's certificate has not been revoked."));
             false
         }
         None => false,
@@ -782,42 +981,44 @@ fn check_dss_revocation(doc: &Document, signer: Option<&Certificate>, at: &Optio
 /// cryptographically valid and its message imprint must cover the file's signed bytes.
 fn validate_doc_timestamp(doc: &Document, bytes: &[u8], v: &Dict, info: &mut SignatureInfo, cache: &DigestCache, trust: &TrustStore) {
     info.date = text(doc, v, b"M");
-    let invalid = |info: &mut SignatureInfo, why: &str| {
+    let invalid = |info: &mut SignatureInfo, why: Detail| {
         info.status = Status::Invalid;
-        info.details.push(why.to_string());
+        info.details.push(why);
     };
     let Some(br) = nums(doc, v, b"ByteRange").filter(|b| b.len() == 4 && b.iter().all(|x| *x >= 0.0)) else {
-        return invalid(info, "The timestamp has no valid byte range.");
+        return invalid(info, Detail::plain("The timestamp has no valid byte range."));
     };
     let [o0, l0, o1, l1] = [br[0] as usize, br[1] as usize, br[2] as usize, br[3] as usize];
     if o0 != 0 || o1 < l0 || o1.checked_add(l1).is_none_or(|end| end > bytes.len()) || o1 - l0 < 2 {
-        return invalid(info, "The timestamp's byte range does not match the file.");
+        return invalid(info, Detail::plain("The timestamp's byte range does not match the file."));
     }
     let gap = &bytes[l0..o1];
     if gap.first() != Some(&b'<') || gap.last() != Some(&b'>') {
-        return invalid(info, "The timestamp's byte range does not exclude exactly its contents.");
+        return invalid(info, Detail::plain("The timestamp's byte range does not exclude exactly its contents."));
     }
-    let Some(contents) = unhex(&gap[1..gap.len() - 1]) else { return invalid(info, "The timestamp contents are not hexadecimal.") };
+    let Some(contents) = unhex(&gap[1..gap.len() - 1]) else {
+        return invalid(info, Detail::plain("The timestamp contents are not hexadecimal."));
+    };
     let covered = o1 + l1;
     info.signed_len = covered;
     info.revision = cache.revision(bytes, covered).map_or(1, |d| d.revisions().len().max(1));
     let token = match crate::timestamp::parse_token(&contents) {
         Ok(t) => t,
-        Err(e) => return invalid(info, &format!("The timestamp token could not be read ({e}).")),
+        Err(e) => return invalid(info, Detail::of("The timestamp token could not be read ({}).", Fill::Reason(e.to_string()))),
     };
     info.digest = Some(token.digest);
     info.timestamp_time = Some(token.gen_time);
     info.algorithm = Some(format!("RFC 3161 timestamp ({})", token.digest.name()));
     let doc_digest = token.digest.digest(&[&bytes[..l0], &bytes[o1..covered]]);
     if doc_digest != token.imprint {
-        return invalid(info, "The document has been altered or corrupted since the timestamp was applied.");
+        return invalid(info, Detail::plain("The document has been altered or corrupted since the timestamp was applied."));
     }
     if let Some(cert) = token.signer_certificate() {
         info.signer = Some(cert.display_name());
         info.certificate = Some(cert.clone());
         if !cert.valid_at(token.gen_time) {
             info.status = Status::Unknown;
-            info.details.push("The timestamp authority's certificate was not valid at the time of timestamping.".into());
+            info.details.push(Detail::plain("The timestamp authority's certificate was not valid at the time of timestamping."));
         }
     }
     info.modification = if covered == bytes.len() || bytes[covered..].iter().all(|b| b.is_ascii_whitespace() || *b == 0) {
@@ -826,14 +1027,17 @@ fn validate_doc_timestamp(doc: &Document, bytes: &[u8], v: &Dict, info: &mut Sig
         classify_changes(doc, cache.revision(bytes, covered), None)
     };
     match &info.modification {
-        Modification::None => info.details.push("This document has not been modified since this timestamp was applied.".into()),
-        Modification::Allowed(kinds) => info
-            .details
-            .push(format!("The document has been modified since this timestamp was applied, but the changes are permitted ({}).", kinds.join(", "))),
+        Modification::None => info.details.push(Detail::plain("This document has not been modified since this timestamp was applied.")),
+        Modification::Allowed(kinds) => info.details.push(Detail::of(
+            "The document has been modified since this timestamp was applied, but the changes are permitted ({}).",
+            Fill::Changes(kinds.clone()),
+        )),
         Modification::Disallowed(kinds) => {
             info.status = Status::Invalid;
-            info.details
-                .push(format!("The document has been altered since this timestamp was applied in ways it does not permit ({}).", kinds.join(", ")));
+            info.details.push(Detail::of(
+                "The document has been altered since this timestamp was applied in ways it does not permit ({}).",
+                Fill::Changes(kinds.clone()),
+            ));
         }
     }
     if info.status != Status::Invalid {
@@ -847,12 +1051,13 @@ fn validate_doc_timestamp(doc: &Document, bytes: &[u8], v: &Dict, info: &mut Sig
         let trusted_tsa = token.signer_certificate().is_some_and(|c| build_chain(&c, &pool, Some(token.gen_time)).iter().any(|x| trust.trusts(x)));
         if trusted_tsa && in_validity {
             info.status = Status::Valid;
-            info.details.push("The timestamp token is valid and its authority is trusted.".into());
+            info.details.push(Detail::plain("The timestamp token is valid and its authority is trusted."));
         } else if trusted_tsa {
             info.status = Status::Unknown;
         } else {
             info.status = Status::Unknown;
-            info.details.push("The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.".into());
+            info.details
+                .push(Detail::plain("The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates."));
         }
     }
 }
@@ -907,9 +1112,9 @@ fn validate_x509_rsa_sha1(
     (l0, o1, covered): (usize, usize, usize),
     contents: &[u8],
 ) {
-    let fail = |info: &mut SignatureInfo, why: &str| {
+    let fail = |info: &mut SignatureInfo, why: Detail| {
         info.status = Status::Invalid;
-        info.details.push(why.to_string());
+        info.details.push(why);
     };
     let certs: Vec<Certificate> = match v.get(b"Cert").map(|c| doc.resolve(c)).as_deref() {
         Some(Object::Array(a)) => a.iter().filter_map(|c| doc.resolve(c).as_string().map(|s| s.bytes.clone())).collect::<Vec<_>>(),
@@ -919,10 +1124,11 @@ fn validate_x509_rsa_sha1(
     .iter()
     .filter_map(|raw| Certificate::parse(raw).ok())
     .collect();
-    let Some(cert) = certs.first().cloned() else { return fail(info, "The signer's certificate is not in the signature.") };
+    let Some(cert) = certs.first().cloned() else { return fail(info, Detail::plain("The signer's certificate is not in the signature.")) };
     let signature = match crate::der::Tlv::parse_ber(contents).and_then(|(t, _)| t.octets("signature").map(|o| o.into_owned())) {
         Ok(sig) => sig,
-        Err(e) => return fail(info, &format!("The signature could not be read ({e}).")),
+        // What the reader made of it goes in as it stands: it is a developer's detail, not a sentence.
+        Err(e) => return fail(info, Detail::of("The signature could not be read ({}).", Fill::Reason(e.to_string()))),
     };
     info.digest = Some(DigestAlg::Sha1);
     info.algorithm = Some(format!("{} with SHA-1", cert.public_key.describe()));
@@ -930,26 +1136,28 @@ fn validate_x509_rsa_sha1(
     let digest = cache.digest(DigestAlg::Sha1, bytes, l0, o1, covered);
     let mut notes = Vec::new();
     match cert.public_key.verify_noting(crate::keys::Scheme::RsaPkcs1, DigestAlg::Sha1, &digest, &signature, &mut notes) {
-        Ok(true) => info.details.extend(notes.into_iter().map(String::from)),
+        // A note is a whole sentence the reader words for itself, so it goes on the list in `WORDINGS`.
+        Ok(true) => info.details.extend(notes.into_iter().map(Detail::plain)),
         Ok(false) => {
             info.certificate = Some(cert);
-            return fail(info, "The document has been altered or corrupted since the signature was applied.");
+            return fail(info, Detail::plain("The document has been altered or corrupted since the signature was applied."));
         }
         // Only what PdfCraft doesn't support yet is "can't check"; a key or value that is
         // malformed is a signature that doesn't verify (as on the CMS path).
         Err(SignError::Unsupported(e)) => {
             info.certificate = Some(cert);
             info.status = Status::Unknown;
-            info.details.push(format!("PdfCraft can't check this signature yet: {e}."));
+            // What is not supported yet is named by the reader, in its own words.
+            info.details.push(Detail::of("PdfCraft can't check this signature yet: {}.", Fill::Reason(e.to_string())));
             return;
         }
         Err(e) => {
             info.certificate = Some(cert);
-            return fail(info, &format!("The signature could not be verified ({e})."));
+            return fail(info, Detail::of("The signature could not be verified ({}).", Fill::Reason(e.to_string())));
         }
     }
-    info.details.push("The signature uses the legacy adbe.x509.rsa_sha1 format.".into());
-    info.details.extend(DigestAlg::Sha1.weakness().map(String::from));
+    info.details.push(Detail::plain("The signature uses the legacy adbe.x509.rsa_sha1 format."));
+    info.details.extend(DigestAlg::Sha1.weakness().map(Detail::plain));
     finish_validation(doc, bytes, trust, info, cache, covered, cert, &certs, None, None);
 }
 
@@ -957,7 +1165,7 @@ fn validate_x509_rsa_sha1(
 /// an approval signature permits form fill, comments and further signatures).
 fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Modification {
     let Some(old) = old else {
-        return Modification::Disallowed(vec!["the signed version could not be read".into()]);
+        return Modification::Disallowed(vec![kind::UNREADABLE]);
     };
     let old_content: HashSet<ObjRef> = pdfcraft_annot::page_refs(&old)
         .unwrap_or_default()
@@ -976,7 +1184,13 @@ fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Mod
         .collect();
     // The signed revision's document-level XMP stream.
     let old_metadata = old.root().and_then(|root| old.get(root).as_dict().and_then(|c| c.get(b"Metadata").and_then(Object::as_ref)));
-    let (mut allowed, mut disallowed): (Vec<&str>, Vec<&str>) = (Vec::new(), Vec::new());
+    // What each object was in the signed revision: its pages, and its trailer /Info. A changed
+    // object is judged by the role it held when signed, never by the labels or keys its new,
+    // attacker-written version carries (relabelling a signed page /Type /Sig, or dropping its
+    // /Type and adding /ModDate, must not reclassify it away from page content).
+    let signed_pages: HashSet<ObjRef> = pdfcraft_annot::page_refs(&old).unwrap_or_default().into_iter().collect();
+    let old_info = old.trailer().get(b"Info").and_then(Object::as_ref);
+    let (mut allowed, mut disallowed): (Vec<&'static str>, Vec<&'static str>) = (Vec::new(), Vec::new());
     let dss = dss_parts(doc, &old);
     // Stored at the same place in both (and not edited since): the same bytes, unchanged.
     let same_place = |num: u32| -> bool {
@@ -1002,42 +1216,57 @@ fn classify_changes(doc: &Document, old: Option<Document>, p: Option<u8>) -> Mod
         if before.as_deref() == Some(&*new) {
             continue;
         }
-        let kind = match &*new {
+        let what = match &*new {
             // The Document Security Store's own arrays and dictionaries, when they only grew.
-            _ if dss.contains(&num) => "document security store",
-            Object::Dict(d) => change_kind(doc, &old, d, before.as_deref().and_then(Object::as_dict)),
+            _ if dss.contains(&num) => kind::SECURITY_STORE,
+            Object::Dict(d) => {
+                let was = before.as_deref().and_then(Object::as_dict);
+                if signed_pages.contains(&r) {
+                    // A signed page is always judged by what the page shows, whatever it is now
+                    // relabelled: a rewritten /Contents or /Resources is a page content change.
+                    page_change_kind(doc, &old, d, was)
+                } else if was.is_some() && Some(r) == old_info {
+                    // Only the signed revision's own /Info dictionary is a metadata change.
+                    kind::METADATA
+                } else {
+                    change_kind(doc, &old, d, was)
+                }
+            }
             Object::Stream(s) => {
+                // File plumbing is what the stream was when signed: the /Type it has now is
+                // written by whoever changed it, and the renderer ignores /Type (a page's Form
+                // XObject relabelled /ObjStm still draws its new content).
+                let was_plumbing = matches!(before.as_deref(), Some(Object::Stream(b)) if matches!(b.dict.name(b"Type"), Some(b"XRef" | b"ObjStm")));
                 if old_content.contains(&r) {
-                    "page content"
-                } else if s.dict.name(b"Type") == Some(b"XRef") || s.dict.name(b"Type") == Some(b"ObjStm") || before.is_none() {
+                    kind::PAGE_CONTENT
+                } else if before.is_none() || was_plumbing {
                     continue;
                 } else if s.dict.name(b"Type") == Some(b"Metadata") && Some(r) == old_metadata {
                     // Only the signed catalog's XMP stream. A /Type /Metadata label on anything
                     // else, even one it already had when signed (a page's Form XObject: the
                     // renderer ignores /Type), does not make rewriting it a metadata change.
-                    "metadata"
+                    kind::METADATA
                 } else {
-                    "other changes"
+                    kind::OTHER
                 }
             }
             _ if before.is_none() => continue,
-            _ => "other changes",
+            _ => kind::OTHER,
         };
-        let ok = match (kind, p) {
-            ("signature" | "document security store", _) => true,
-            ("form fill", Some(2 | 3) | None) => true,
-            ("comments", Some(3) | None) => true,
+        let ok = match (what, p) {
+            (kind::SIGNATURE | kind::SECURITY_STORE, _) => true,
+            (kind::FORM_FILL, Some(2 | 3) | None) => true,
+            (kind::COMMENTS, Some(3) | None) => true,
             // Every save updates /Info (ModDate), signing included.
-            ("metadata", _) => true,
+            (kind::METADATA, _) => true,
             _ => false,
         };
         let list = if ok { &mut allowed } else { &mut disallowed };
-        if !list.contains(&kind) {
-            list.push(kind);
+        if !list.contains(&what) {
+            list.push(what);
         }
     }
-    let own = |v: Vec<&str>| v.into_iter().map(str::to_string).collect::<Vec<_>>();
-    if disallowed.is_empty() { Modification::Allowed(own(allowed)) } else { Modification::Disallowed(own(disallowed)) }
+    if disallowed.is_empty() { Modification::Allowed(allowed) } else { Modification::Disallowed(disallowed) }
 }
 
 /// Where an object sits in the Document Security Store (ISO 32000-2 §12.8.4.3).
@@ -1173,11 +1402,11 @@ fn added_annots(doc: &Document, added: &[ObjRef]) -> &'static str {
         })
         .collect();
     if !kinds.is_empty() && kinds.iter().all(|(w, s)| *w && *s) {
-        "signature"
+        kind::SIGNATURE
     } else if !kinds.is_empty() && kinds.iter().all(|(w, _)| *w) {
-        "form fill"
+        kind::FORM_FILL
     } else {
-        "comments"
+        kind::COMMENTS
     }
 }
 
@@ -1203,77 +1432,101 @@ fn acroform_kind(doc: &Document, old: &Document, now: &Dict, before: Option<&Dic
         v
     };
     if strip(now) != strip(before) {
-        return "form fill";
+        return kind::FORM_FILL;
     }
     let old_fields = refs(old, before.get(b"Fields"));
     let added: Vec<ObjRef> = refs(doc, now.get(b"Fields")).into_iter().filter(|r| !old_fields.contains(r)).collect();
-    if added.is_empty() || added_annots(doc, &added) == "signature" { "signature" } else { "form fill" }
+    if added.is_empty() || added_annots(doc, &added) == kind::SIGNATURE { kind::SIGNATURE } else { kind::FORM_FILL }
+}
+
+/// Dictionary entries in a stable order, without `keys`.
+fn without(x: &Dict, keys: &[&[u8]]) -> Vec<(Vec<u8>, Object)> {
+    let mut v: Vec<(Vec<u8>, Object)> = x.iter().filter(|(k, _)| !keys.contains(&k.as_slice())).map(|(k, o)| (k.to_vec(), o.clone())).collect();
+    v.sort_by(|a, b| a.0.cmp(&b.0));
+    v
+}
+
+/// Whether a dictionary was a signature object: a signature or timestamp value, a signature
+/// reference or its transform parameters, or a signature form field. Used to decide from the
+/// signed revision, so a later relabel of some other object cannot pose as a signature change.
+fn is_signature_dict(d: &Dict) -> bool {
+    matches!(d.name(b"Type"), Some(b"Sig" | b"DocTimeStamp" | b"SigRef" | b"TransformParams")) || d.name(b"FT") == Some(b"Sig")
+}
+
+/// A changed object that was a page in the signed revision, judged by what the page shows rather
+/// than by any `/Type` its new version carries. Only added annotations are permitted; any other
+/// difference (content, resources, a relabelled or dropped `/Type`) is a page content change.
+fn page_change_kind(doc: &Document, old: &Document, d: &Dict, before: Option<&Dict>) -> &'static str {
+    match before {
+        Some(b) if without(d, &[b"Annots"]) != without(b, &[b"Annots"]) => kind::PAGE_CONTENT,
+        Some(b) => {
+            let was = refs(old, b.get(b"Annots"));
+            let added: Vec<ObjRef> = refs(doc, d.get(b"Annots")).into_iter().filter(|r| !was.contains(r)).collect();
+            added_annots(doc, &added)
+        }
+        None => kind::PAGE_CONTENT,
+    }
 }
 
 fn change_kind(doc: &Document, old: &Document, d: &Dict, before: Option<&Dict>) -> &'static str {
     let ty = d.name(b"Type");
-    let without = |x: &Dict, keys: &[&[u8]]| -> Vec<(Vec<u8>, Object)> {
-        let mut v: Vec<(Vec<u8>, Object)> = x.iter().filter(|(k, _)| !keys.contains(&k.as_slice())).map(|(k, o)| (k.to_vec(), o.clone())).collect();
-        v.sort_by(|a, b| a.0.cmp(&b.0));
-        v
-    };
+    // A later revision cannot make an existing object a signature by relabelling it: a signature
+    // change is only a brand-new object, or one that was already a signature object when signed.
+    let signature_ok = before.is_none_or(is_signature_dict);
     match ty {
-        Some(b"Sig" | b"DocTimeStamp" | b"SigRef" | b"TransformParams") => return "signature",
+        Some(b"Sig" | b"DocTimeStamp" | b"SigRef" | b"TransformParams") if signature_ok => return kind::SIGNATURE,
         Some(b"Catalog") => {
             let keys: &[&[u8]] = &[b"AcroForm", b"DSS", b"Perms", b"Metadata", b"NeedsRendering"];
             return match before {
-                Some(b) if without(d, keys) != without(b, keys) => "document structure",
+                Some(b) if without(d, keys) != without(b, keys) => kind::STRUCTURE,
                 Some(b) => {
                     if d.get(b"AcroForm") != b.get(b"AcroForm") {
                         // Compare the forms themselves, inline or not.
                         let now = acroform(doc).unwrap_or_default();
                         acroform_kind(doc, old, &now, None)
                     } else if b.get(b"Perms") != d.get(b"Perms") {
-                        "signature"
+                        kind::SIGNATURE
                     } else {
-                        "metadata"
+                        kind::METADATA
                     }
                 }
-                None => "form fill",
+                None => kind::FORM_FILL,
             };
         }
         Some(b"Page") => {
             return match before {
-                Some(b) if without(d, &[b"Annots"]) != without(b, &[b"Annots"]) => "page content",
+                Some(b) if without(d, &[b"Annots"]) != without(b, &[b"Annots"]) => kind::PAGE_CONTENT,
                 Some(b) => {
                     let was = refs(old, b.get(b"Annots"));
                     let added: Vec<ObjRef> = refs(doc, d.get(b"Annots")).into_iter().filter(|r| !was.contains(r)).collect();
                     added_annots(doc, &added)
                 }
-                None => "comments",
+                None => kind::COMMENTS,
             };
         }
-        Some(b"Pages") => return if before.is_some() { "pages added or removed" } else { "document structure" },
+        Some(b"Pages") => return if before.is_some() { kind::PAGES } else { kind::STRUCTURE },
         _ => {}
     }
     match d.name(b"Subtype") {
-        Some(b"Widget") => return if d.name(b"FT") == Some(b"Sig") { "signature" } else { "form fill" },
-        Some(b"Link") => return "links",
-        Some(_) if ty == Some(b"Annot") || d.contains(b"Rect") => return "comments",
+        Some(b"Widget") => return if d.name(b"FT") == Some(b"Sig") && signature_ok { kind::SIGNATURE } else { kind::FORM_FILL },
+        Some(b"Link") => return kind::LINKS,
+        Some(_) if ty == Some(b"Annot") || d.contains(b"Rect") => return kind::COMMENTS,
         _ => {}
     }
-    if d.name(b"FT") == Some(b"Sig") {
-        return "signature";
+    if d.name(b"FT") == Some(b"Sig") && signature_ok {
+        return kind::SIGNATURE;
     }
     if d.contains(b"Fields") {
         return acroform_kind(doc, old, d, before);
     }
     if d.contains(b"FT") || (d.contains(b"T") && d.contains(b"Kids")) || d.contains(b"DR") {
-        return "form fill";
-    }
-    if d.contains(b"Producer") || d.contains(b"ModDate") || d.contains(b"CreationDate") {
-        return "metadata";
+        return kind::FORM_FILL;
     }
     if before.is_none() {
         // New objects referenced by changed ones (fonts, appearance resources).
-        return "form fill";
+        return kind::FORM_FILL;
     }
-    "other changes"
+    kind::OTHER
 }
 
 // ── signing ─────────────────────────────────────────────────────────────────────────────────
@@ -1295,6 +1548,31 @@ impl Default for Appearance {
     }
 }
 
+/// The words of the labels of a visible signature.
+///
+/// They are stamped into the document, so the caller chooses them: an interface that speaks
+/// another language passes them in that language. The defaults are the English ones.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AppearanceLabels {
+    pub signed_by: String,
+    pub distinguished_name: String,
+    pub reason: String,
+    pub location: String,
+    pub date: String,
+}
+
+impl Default for AppearanceLabels {
+    fn default() -> Self {
+        Self {
+            signed_by: "Digitally signed by".into(),
+            distinguished_name: "DN: ".into(),
+            reason: "Reason: ".into(),
+            location: "Location: ".into(),
+            date: "Date: ".into(),
+        }
+    }
+}
+
 #[derive(Clone, Debug, Default)]
 pub struct SignOptions {
     /// Sign this existing, unsigned signature field.
@@ -1312,6 +1590,10 @@ pub struct SignOptions {
     /// Certify with these DocMDP permissions (1 no changes, 2 form fill and signing, 3 also comments).
     pub certify: Option<u8>,
     pub appearance: Appearance,
+    /// The words of the labels the visible signature shows.
+    pub appearance_labels: AppearanceLabels,
+    /// A drawing, typed signature or image shown where the large name would be.
+    pub graphic: Option<crate::graphic::Graphic>,
 }
 
 /// What an encrypted document's permissions (ISO 32000-2 §7.6.4.2, Table 22) allow when it was
@@ -1505,7 +1787,7 @@ fn sign_inner(
         }
     }
     // The appearance.
-    let ap = appearance(rect, &name, &id.certificate, opts);
+    let ap = appearance(&mut doc, rect, &name, &id.certificate, opts)?;
     let ap_ref = doc.add(Object::Stream(ap));
     let mut apd = Dict::new();
     apd.set(b"N".to_vec(), Object::Ref(ap_ref));
@@ -1625,42 +1907,55 @@ pub fn display_date(pdf: &str) -> String {
     format!("{}.{}.{} {}:{}:{}{tz}", g(0..4), g(4..6), g(6..8), g(8..10), g(10..12), g(12..14))
 }
 
-/// The visible signature: the signer's name large on the left, the details on the right
-/// (Acrobat's standard layout), in Helvetica.
-fn appearance(rect: [f64; 4], name: &str, cert: &Certificate, opts: &SignOptions) -> Stream {
+/// The visible signature: the signer's name large on the left, or the graphic in its place, and
+/// the details on the right (Acrobat's standard layout), in Helvetica. A graphic with no details
+/// beside it fills the box.
+fn appearance(doc: &mut Document, rect: [f64; 4], name: &str, cert: &Certificate, opts: &SignOptions) -> Result<Stream, SignError> {
     use pdfcraft_fonts::{helvetica_width, literal, win_ansi, wrap};
     let (w, h) = ((rect[2] - rect[0]).max(0.0), (rect[3] - rect[1]).max(0.0));
     let a = &opts.appearance;
     let mut lines: Vec<String> = Vec::new();
     let label = |l: &str, v: &str| if a.labels { format!("{l}{v}") } else { v.to_string() };
+    // The labels are the caller's words, so a signature signed in another language reads in it.
+    let wording = &opts.appearance_labels;
     if a.name {
-        lines.push(if a.labels { "Digitally signed by".into() } else { String::new() });
+        lines.push(if a.labels { wording.signed_by.clone() } else { String::new() });
         lines.push(name.to_string());
     }
     if a.distinguished_name {
-        lines.push(label("DN: ", &cert.subject.display()));
+        lines.push(label(&wording.distinguished_name, &cert.subject.display()));
     }
     if a.reason
         && let Some(r) = opts.reason.as_deref().filter(|r| !r.is_empty())
     {
-        lines.push(label("Reason: ", r));
+        lines.push(label(&wording.reason, r));
     }
     if a.location
         && let Some(l) = opts.location.as_deref().filter(|l| !l.is_empty())
     {
-        lines.push(label("Location: ", l));
+        lines.push(label(&wording.location, l));
     }
     if a.date {
-        lines.push(label("Date: ", &display_date(&opts.date)));
+        lines.push(label(&wording.date, &display_date(&opts.date)));
     }
     lines.retain(|l| !l.is_empty());
     let mut out = Vec::new();
+    let mut image = None;
     if w > 1.0 && h > 1.0 {
         let pad = (h * 0.06).clamp(1.0, 6.0);
-        let (left_w, right_x) = if a.name { (w * 0.5, w * 0.5 + pad) } else { (0.0, pad) };
+        let (left_w, right_x) = match (&opts.graphic, a.name) {
+            (Some(_), _) if lines.is_empty() => (w, pad),
+            (Some(_), _) | (None, true) => (w * 0.5, w * 0.5 + pad),
+            (None, false) => (0.0, pad),
+        };
         let right_w = (w - right_x - pad).max(1.0);
+        if let Some(g) = &opts.graphic {
+            let (ops, im) = g.draw(doc, [pad, pad, (left_w - 2.0 * pad).max(0.0), (h - 2.0 * pad).max(0.0)])?;
+            out.extend(ops.bytes());
+            image = im;
+        }
         out.extend_from_slice(b"BT\n0 g\n");
-        if a.name {
+        if a.name && opts.graphic.is_none() {
             // The name fills the left half.
             let mut size = (h * 0.4).min(36.0);
             let fit = (left_w - 2.0 * pad).max(1.0);
@@ -1707,11 +2002,16 @@ fn appearance(rect: [f64; 4], name: &str, cert: &Certificate, opts: &SignOptions
     fonts.set(b"Helv".to_vec(), Object::Dict(font));
     let mut res = Dict::new();
     res.set(b"Font".to_vec(), Object::Dict(fonts));
+    if let Some(im) = image {
+        let mut xobjects = Dict::new();
+        xobjects.set(b"Im1".to_vec(), Object::Ref(im));
+        res.set(b"XObject".to_vec(), Object::Dict(xobjects));
+    }
     d.set(b"Resources".to_vec(), Object::Dict(res));
-    Stream::flate(d, &out)
+    Ok(Stream::flate(d, &out))
 }
 
-fn fmt(v: f64) -> String {
+pub(crate) fn fmt(v: f64) -> String {
     let s = format!("{v:.2}");
     s.trim_end_matches('0').trim_end_matches('.').to_string()
 }
diff --git a/crates/sign/src/x509.rs b/crates/sign/src/x509.rs
index 1c453739..e3e784ba 100644
--- a/crates/sign/src/x509.rs
+++ b/crates/sign/src/x509.rs
@@ -4,6 +4,7 @@
 use crate::SignError;
 use crate::der::{self, Time, Tlv, tag};
 use crate::keys::{self, DigestAlg, PrivateKey, PublicKey};
+use crate::pdf::{Detail, Fill};
 
 const CN: &str = "2.5.4.3";
 const C: &str = "2.5.4.6";
@@ -355,18 +356,25 @@ impl Certificate {
     /// Why this certificate may not sign documents, if it may not (RFC 5280 §4.2.1.3,
     /// §4.2.1.12, §4.2): a key usage without digitalSignature or nonRepudiation, an extended key
     /// usage without a document-signing purpose, or a critical extension PdfCraft doesn't process.
-    pub fn signing_problem(&self) -> Option<String> {
+    /// The sentences are wordings of this crate's, listed in [`WORDINGS`](crate::pdf::WORDINGS), so an
+    /// interface reading in another language says them in it; only the extensions' own OIDs go in as
+    /// they stand.
+    pub fn signing_problem(&self) -> Option<Detail> {
         /// keyUsage bits 0 (digitalSignature) and 1 (nonRepudiation).
         const SIGNING_BITS: u16 = 0b11;
         if self.key_usage.is_some_and(|u| u & SIGNING_BITS == 0) {
-            Some(
-                "The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation)."
-                    .into(),
-            )
+            Some(Detail::plain(
+                "The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation).",
+            ))
         } else if self.extended_key_usage.as_ref().is_some_and(|e| !e.iter().any(|o| DOCUMENT_SIGNING_EKUS.contains(&o.as_str()))) {
-            Some("The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).".into())
+            Some(Detail::plain(
+                "The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).",
+            ))
         } else if !self.unknown_critical.is_empty() {
-            Some(format!("The signer's certificate has critical extensions PdfCraft does not recognize ({}).", self.unknown_critical.join(", ")))
+            Some(Detail::of(
+                "The signer's certificate has critical extensions PdfCraft does not recognize ({}).",
+                Fill::Value(self.unknown_critical.join(", ")),
+            ))
         } else {
             None
         }
@@ -481,7 +489,11 @@ pub fn build_chain<'a>(leaf: &'a Certificate, pool: &'a [Certificate], at: Optio
 
 /// [`build_chain`], and why it stopped where it did if a certificate that matched the issuer by
 /// name and signature was refused.
-pub fn build_chain_noted<'a>(leaf: &'a Certificate, pool: &'a [Certificate], at: Option<Time>) -> (Vec<&'a Certificate>, Option<String>) {
+///
+/// The reason is a whole sentence of ours, listed in [`WORDINGS`](crate::pdf::WORDINGS), with the two
+/// certificates' own names put in afterwards, so an interface reading in another language says it in
+/// it.
+pub fn build_chain_noted<'a>(leaf: &'a Certificate, pool: &'a [Certificate], at: Option<Time>) -> (Vec<&'a Certificate>, Option<Detail>) {
     let mut chain = vec![leaf];
     let mut refused = None;
     while chain.len() < 10 {
@@ -493,12 +505,14 @@ pub fn build_chain_noted<'a>(leaf: &'a Certificate, pool: &'a [Certificate], at:
         let below = chain.len() - 1;
         let mut found = None;
         for c in pool.iter().filter(|c| c.subject.raw == last.issuer.raw && !chain.contains(c) && last.signed_by(&c.public_key)) {
+            // Each reason is a whole sentence, not a phrase stitched into one: a language puts the
+            // two names where it needs them.
             let why = if !c.may_issue() {
-                Some("is not a CA certificate that may issue certificates")
+                Some("The certificate of {} is not a CA certificate that may issue certificates, so it is not used to vouch for {}.")
             } else if c.path_len.is_some_and(|n| below > n as usize) {
-                Some("does not allow this many CA certificates below it (path length)")
+                Some("The certificate of {} does not allow this many CA certificates below it (path length), so it is not used to vouch for {}.")
             } else if at.is_some_and(|t| !c.valid_at(t)) {
-                Some("was not valid at the time of signing")
+                Some("The certificate of {} was not valid at the time of signing, so it is not used to vouch for {}.")
             } else {
                 None
             };
@@ -507,9 +521,7 @@ pub fn build_chain_noted<'a>(leaf: &'a Certificate, pool: &'a [Certificate], at:
                     found = Some(c);
                     break;
                 }
-                Some(why) => {
-                    refused = Some(format!("The certificate of {} {why}, so it is not used to vouch for {}.", c.display_name(), last.display_name()))
-                }
+                Some(why) => refused = Some(Detail::of(why, Fill::Names(c.display_name(), last.display_name()))),
             }
         }
         let Some(issuer) = found else { break };
diff --git a/crates/sign/tests/chain.rs b/crates/sign/tests/chain.rs
index 6385a516..e8fd0127 100644
--- a/crates/sign/tests/chain.rs
+++ b/crates/sign/tests/chain.rs
@@ -113,7 +113,7 @@ fn an_end_entity_certificate_cannot_issue() {
     let pool = [e.cert.clone(), r.cert.clone()];
     let (chain, why) = build_chain_noted(&forged.cert, &pool, None);
     assert_eq!(names(&chain), ["Bank AG"], "the subscriber certificate does not vouch for what it signed");
-    assert!(why.is_some_and(|w| w.contains("not a CA")), "the reason is reported");
+    assert!(why.is_some_and(|w| w.message.contains("not a CA")), "the reason is reported");
     // Neither does one without basicConstraints (not a v1 root: it has an issuer).
     let plain = issue("No Constraints", Some(&r), FOREVER, &[]);
     let under_plain = end_entity("Under Plain", &plain);
@@ -159,7 +159,7 @@ fn issuers_must_have_been_valid_when_it_matters() {
     assert_eq!(names(&build_chain(&l.cert, &pool, Some(time(2021)))), ["Leaf", "Short Lived CA", "Test Root"]);
     let (chain, why) = build_chain_noted(&l.cert, &pool, Some(time(2023)));
     assert_eq!(names(&chain), ["Leaf"], "expired by then");
-    assert!(why.is_some_and(|w| w.contains("not valid")));
+    assert!(why.is_some_and(|w| w.message.contains("not valid")));
     assert_eq!(names(&build_chain(&l.cert, &pool, Some(time(2019)))), ["Leaf"], "not yet valid");
     // With no time to judge by, nothing is refused on validity.
     assert_eq!(names(&build_chain(&l.cert, &pool, None)).len(), 3);
@@ -191,7 +191,9 @@ fn verdict(leaf: Party, embedded: Vec<Certificate>, anchor: &Certificate) -> (St
     let signed = pdfcraft_sign::sign(&doc, &id, &opts).unwrap();
     let trust = TrustStore { certs: vec![anchor.clone()] };
     let s = signatures(&Document::open(Arc::new(signed.clone())).unwrap(), &signed, &trust).into_iter().rfind(|s| s.signed).unwrap();
-    (s.status, s.details)
+    // The details as they read in English; what an interface says in another language is checked in
+    // `tests/pdf.rs`.
+    (s.status, s.details.iter().map(|d| d.message.clone()).collect())
 }
 
 #[test]
@@ -242,19 +244,19 @@ fn the_signer_certificate_must_allow_document_signing() {
     let r = root();
     let problem = |exts: &[Vec<u8>]| signer_with("Signer", &r, exts).cert.signing_problem();
     // Key usage without digitalSignature or nonRepudiation.
-    assert!(problem(&[key_usage(KEY_CERT_SIGN)]).is_some_and(|w| w.contains("key usage")));
+    assert!(problem(&[key_usage(KEY_CERT_SIGN)]).is_some_and(|w| w.message.contains("key usage")));
     assert!(problem(&[key_usage(KEY_ENCIPHERMENT)]).is_some());
     assert!(problem(&[key_usage(DIGITAL_SIGNATURE)]).is_none());
     // nonRepudiation alone is enough.
     assert!(problem(&[key_usage(0x40)]).is_none());
     // Extended key usage without a document-signing purpose.
-    assert!(problem(&[extended_key_usage(&[SERVER_AUTH])]).is_some_and(|w| w.contains("extended key usage")));
+    assert!(problem(&[extended_key_usage(&[SERVER_AUTH])]).is_some_and(|w| w.message.contains("extended key usage")));
     for ok in ["2.5.29.37.0", "1.3.6.1.5.5.7.3.4", "1.3.6.1.5.5.7.3.36", "1.2.840.113583.1.1.5", "1.3.6.1.4.1.311.10.3.12"] {
         assert!(problem(&[extended_key_usage(&[SERVER_AUTH, ok])]).is_none(), "{ok}");
     }
     // An unknown critical extension refuses; the same extension non-critical does not.
     let unknown = "1.2.3.4.5.6";
-    assert!(problem(&[ext(unknown, &der::octets(&[0]))]).is_some_and(|w| w.contains(unknown)));
+    assert!(problem(&[ext(unknown, &der::octets(&[0]))]).is_some_and(|w| w.message.contains(unknown)));
     assert!(problem(&[der::seq(&[&der::oid(unknown), &der::octets(&der::octets(&[0]))])]).is_none());
     // Critical extensions PdfCraft knows, or may accept as they are, don't refuse.
     assert!(problem(&[ext("2.5.29.32", &der::seq(&[]))]).is_none());
diff --git a/crates/sign/tests/pdf.rs b/crates/sign/tests/pdf.rs
index 20b7f088..bb0d3b48 100644
--- a/crates/sign/tests/pdf.rs
+++ b/crates/sign/tests/pdf.rs
@@ -3,7 +3,9 @@
 use std::sync::Arc;
 
 use pdfcraft_cos::{Document, Object, PdfString, SaveOptions, write_incremental};
-use pdfcraft_sign::{Modification, SignError, SignOptions, Status, Time, TimestampAuthority, TrustStore, der, pkcs12, signatures};
+use pdfcraft_sign::{
+    Detail, Modification, SignError, SignOptions, Status, Time, TimestampAuthority, TrustStore, WORDINGS, der, in_english, kind, pkcs12, signatures,
+};
 
 fn data(name: &str) -> Vec<u8> {
     std::fs::read(format!("{}/tests/data/{name}", env!("CARGO_MANIFEST_DIR"))).unwrap()
@@ -89,7 +91,7 @@ fn signing_then_validating_with_and_without_trust() {
         assert_eq!(s.signer.as_deref(), id.certificate.subject.common_name());
         assert_eq!((s.reason.as_deref(), s.location.as_deref(), s.page), (Some("I approve this document"), Some("London"), Some(0)));
         assert!(s.visible && s.signed_len == signed.len() && s.revision == 2);
-        assert!(s.details.iter().any(|d| d.contains("identity is unknown")));
+        assert!(s.details.iter().any(|d| d.message.contains("identity is unknown")));
         // The unsigned field is listed too.
         assert!(sigs.iter().any(|s| s.field == "Approval" && !s.signed));
         // Trusting the signer (or its root) makes it valid.
@@ -104,7 +106,7 @@ fn signing_then_validating_with_and_without_trust() {
         tampered[i] = b'K';
         let s = signatures(&open(&tampered), &tampered, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
         assert_eq!(s.status, Status::Invalid);
-        assert!(s.details[0].contains("altered or corrupted"), "{:?}", s.details);
+        assert!(s.details[0].message.contains("altered or corrupted"), "{:?}", s.details);
     }
 }
 
@@ -120,7 +122,7 @@ fn signing_an_existing_field_and_counter_signing() {
     assert!(a.signed);
     assert_eq!(a.rect, Some([150.0, 20.0, 280.0, 70.0]));
     assert_eq!(a.revision, 2);
-    assert_eq!(a.modification, Modification::Allowed(vec!["signature".into()]), "{:?}", a.details);
+    assert_eq!(a.modification, Modification::Allowed(vec![kind::SIGNATURE]), "{:?}", a.details);
     assert_eq!(a.status, Status::Unknown);
     let b = sigs.iter().find(|s| s.field == "Signature1").unwrap();
     assert_eq!((b.revision, b.modification.clone()), (3, Modification::None));
@@ -169,10 +171,10 @@ fn later_changes_are_classified_under_the_signature_permissions() {
     let signed = pdfcraft_sign::sign(&open(&fixture()), &id, &opts()).unwrap();
     let s = check(&edit_after(&signed, add_comment));
     assert_eq!(s.status, Status::Valid, "{:?}", s.details);
-    assert_eq!(s.modification, Modification::Allowed(vec!["comments".into()]));
+    assert_eq!(s.modification, Modification::Allowed(vec![kind::COMMENTS]));
     let s = check(&edit_after(&signed, change_text));
     assert_eq!(s.status, Status::Invalid);
-    assert_eq!(s.modification, Modification::Disallowed(vec!["page content".into()]));
+    assert_eq!(s.modification, Modification::Disallowed(vec![kind::PAGE_CONTENT]));
     // Certified with "no changes allowed": even a comment invalidates it.
     let certified = pdfcraft_sign::sign(&open(&fixture()), &id, &SignOptions { certify: Some(1), ..opts() }).unwrap();
     let s = check(&certified);
@@ -193,6 +195,110 @@ fn invisible_signatures_and_refusals() {
     assert_eq!(pdfcraft_sign::pdf::display_date("D:20261002120000+01'00'"), "2026.10.02 12:00:00 +01'00'");
 }
 
+/// The normal appearance of the signature field `name`: its decoded content and resources.
+fn appearance_of(bytes: &[u8], name: &str) -> (String, pdfcraft_cos::Dict) {
+    appearance_in(&open(bytes), name)
+}
+
+fn appearance_in(doc: &Document, name: &str) -> (String, pdfcraft_cos::Dict) {
+    let catalog = doc.get(doc.root().unwrap()).as_dict().cloned().unwrap();
+    let form = doc.resolve(catalog.get(b"AcroForm").unwrap()).as_dict().cloned().unwrap();
+    let fields = doc.resolve(form.get(b"Fields").unwrap()).as_array().cloned().unwrap();
+    let field = fields
+        .iter()
+        .filter_map(|f| doc.resolve(f).as_dict().cloned())
+        .find(|f| matches!(f.get(b"T"), Some(Object::String(s)) if s.bytes == name.as_bytes()))
+        .unwrap();
+    let ap = doc.resolve(field.get(b"AP").unwrap()).as_dict().cloned().unwrap();
+    let Object::Stream(s) = &*doc.resolve(ap.get(b"N").unwrap()) else { panic!("no normal appearance") };
+    let res = doc.resolve(s.dict.get(b"Resources").unwrap()).as_dict().cloned().unwrap();
+    (String::from_utf8_lossy(&s.decoded().unwrap()).into_owned(), res)
+}
+
+/// A 40 x 10 image, opaque or with one translucent pixel.
+fn picture(translucent: bool) -> pdfcraft_sign::Graphic {
+    let mut rgba: Vec<u8> = (0..400).flat_map(|_| [10, 20, 30, 255]).collect();
+    if translucent {
+        rgba[3] = 128;
+    }
+    pdfcraft_sign::Graphic::Image { width: 40, height: 10, rgba: Arc::new(rgba) }
+}
+
+#[test]
+fn visible_signatures_show_a_drawn_typed_or_image_graphic() {
+    use pdfcraft_sign::{Appearance, Graphic};
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let name = format!("({})", id.certificate.display_name());
+    let plain = pdfcraft_sign::sign(&open(&fixture()), &id, &opts()).unwrap();
+    // Without a graphic the name is large on the left and in the details.
+    assert_eq!(appearance_of(&plain, "Signature1").0.matches(&name).count(), 2);
+    let strokes = Graphic::Strokes(vec![vec![[0.0, 0.0], [0.3, 0.2], [0.6, 0.0], [1.0, 0.2]], vec![[0.5, 0.1]]]);
+    let typed = Graphic::Outlines(vec![vec![[0.0, 0.0], [1.0, 0.0], [1.0, 0.5], [0.0, 0.5]], vec![[0.2, 0.1], [0.8, 0.1], [0.5, 0.4]]]);
+    for (graphic, drawn) in [
+        (strokes, " c\n"),
+        (typed, "f*\n"),
+        // 40 x 10 in the left half (94 x 44 inside the padding): 94 wide, centred vertically.
+        (picture(true), "q 94 0 0 23.5 3 13.25 cm /Im1 Do Q"),
+    ] {
+        let signed = pdfcraft_sign::sign(&open(&fixture()), &id, &SignOptions { graphic: Some(graphic.clone()), ..opts() }).unwrap();
+        let s = signatures(&open(&signed), &signed, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
+        assert_eq!((s.status, s.modification), (Status::Unknown, Modification::None), "{graphic:?}: {:?}", s.details);
+        let (content, res) = appearance_of(&signed, "Signature1");
+        assert!(content.contains(drawn), "{graphic:?}: {content}");
+        // The graphic takes the name's place on the left; the details still name the signer.
+        assert_eq!(content.matches(&name).count(), 1, "{content}");
+        assert_eq!(res.get(b"XObject").is_some(), matches!(graphic, Graphic::Image { .. }));
+    }
+    // Translucent images keep their alpha as a soft mask; opaque ones need none.
+    for translucent in [true, false] {
+        let signed = pdfcraft_sign::sign(&open(&fixture()), &id, &SignOptions { graphic: Some(picture(translucent)), ..opts() }).unwrap();
+        let doc = open(&signed);
+        let (_, res) = appearance_of(&signed, "Signature1");
+        let xobjects = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+        let Object::Stream(im) = &*doc.resolve(xobjects.get(b"Im1").unwrap()) else { panic!() };
+        assert_eq!((im.dict.int(b"Width"), im.dict.int(b"Height")), (Some(40), Some(10)));
+        assert_eq!(im.decoded().unwrap().len(), 40 * 10 * 3);
+        assert_eq!(im.dict.get(b"SMask").is_some(), translucent);
+    }
+    // With no text at all, the graphic has the whole box (194 x 44): 176 x 44, centred.
+    let bare = Appearance { name: false, date: false, reason: false, location: false, distinguished_name: false, labels: false };
+    let signed = pdfcraft_sign::sign(&open(&fixture()), &id, &SignOptions { graphic: Some(picture(false)), appearance: bare, ..opts() }).unwrap();
+    assert!(appearance_of(&signed, "Signature1").0.contains("q 176 0 0 44 12 3 cm /Im1 Do Q"));
+    // An invisible signature has nothing to show: no image is embedded.
+    let invisible = pdfcraft_sign::sign(&open(&fixture()), &id, &SignOptions { rect: None, graphic: Some(picture(false)), ..opts() }).unwrap();
+    assert!(!invisible.windows(6).any(|w| w == b"/Image"));
+}
+
+#[test]
+fn malformed_signature_graphics_are_refused_not_drawn() {
+    use pdfcraft_sign::Graphic;
+    let id = pkcs12::open(&data("ec-p256.p12"), "test").unwrap();
+    let huge = vec![vec![[0.0, 0.0]; 300_001]];
+    for graphic in [
+        Graphic::Strokes(vec![]),
+        Graphic::Strokes(vec![vec![]]),
+        Graphic::Strokes(vec![vec![[0.0, 0.0], [f64::NAN, 1.0]]]),
+        Graphic::Strokes(vec![vec![[-1e308, 0.0], [1e308, 1.0]]]),
+        Graphic::Strokes(huge),
+        // Outlines need three points to enclose anything.
+        Graphic::Outlines(vec![vec![[0.0, 0.0], [1.0, 1.0]]]),
+        Graphic::Outlines(vec![vec![[0.0, 0.0], [1.0, f64::INFINITY], [1.0, 0.0]]]),
+        Graphic::Image { width: 40, height: 10, rgba: Arc::new(vec![0; 399]) },
+        Graphic::Image { width: 0, height: 10, rgba: Arc::new(vec![]) },
+        Graphic::Image { width: u32::MAX, height: u32::MAX, rgba: Arc::new(vec![]) },
+    ] {
+        let what = format!("{graphic:?}");
+        assert!(what.len() < 200, "Debug never dumps pixels or points: {what}");
+        let r = pdfcraft_sign::sign(&open(&fixture()), &id, &SignOptions { graphic: Some(graphic), ..opts() });
+        assert!(matches!(r, Err(SignError::Pdf(ref m)) if m.contains("signature graphic")), "{what}: {r:?}");
+    }
+    // A single dot is a (tiny) drawing, not an error.
+    let dot = Graphic::Strokes(vec![vec![[0.5, 0.5]]]);
+    let signed = pdfcraft_sign::sign(&open(&fixture()), &id, &SignOptions { graphic: Some(dot), ..opts() }).unwrap();
+    let (content, _) = appearance_of(&signed, "Signature1");
+    assert!(!content.contains("NaN") && !content.contains("inf"), "{content}");
+}
+
 /// A deterministic TSA: signs an RFC 3161 response locally with a test digital ID at a fixed
 /// time. No sockets; the whole stamping path runs in-process.
 struct TestTsa {
@@ -231,13 +337,13 @@ fn signing_with_a_timestamp_embeds_a_verified_rfc3161_token() {
     assert_eq!(s.status, Status::Valid, "{:?}", s.details);
     assert!(s.timestamp, "{:?}", s.details);
     assert_eq!(s.timestamp_time, Some(tsa.time), "the token's generation time, verified over the signature value");
-    assert!(s.details.iter().any(|d| d.contains("trusted time")), "{:?}", s.details);
+    assert!(s.details.iter().any(|d| d.message.contains("trusted time")), "{:?}", s.details);
     // A trusted signer with an untrusted TSA: still valid, but the token's time is unverified.
     let s = signatures(&open(&signed), &signed, &TrustStore { certs: vec![anchor] }).into_iter().find(|s| s.signed).unwrap();
     assert_eq!(s.status, Status::Valid, "{:?}", s.details);
     assert!(s.timestamp);
     assert_eq!(s.timestamp_time, None);
-    assert!(s.details.iter().any(|d| d.contains("unverified timestamp")), "{:?}", s.details);
+    assert!(s.details.iter().any(|d| d.message.contains("unverified timestamp")), "{:?}", s.details);
     // Untrusted, the signature stays intact-but-unknown; the timestamp is still noted.
     let s = signatures(&open(&signed), &signed, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
     assert_eq!(s.status, Status::Unknown);
@@ -288,7 +394,7 @@ fn a_document_timestamp_covers_the_file_and_validates() {
         Modification::Allowed(k) => k,
         other => panic!("{other:?}"),
     };
-    assert!(allowed.contains(&"signature".to_string()), "{allowed:?}");
+    assert!(allowed.contains(&kind::SIGNATURE), "{allowed:?}");
     let stamp = all.iter().find(|s| s.doc_timestamp).unwrap();
     assert_eq!(stamp.status, Status::Valid, "{:?}", stamp.details);
 }
@@ -360,7 +466,7 @@ fn embedding_ltv_evidence_adds_a_dss_and_keeps_signatures_valid() {
         Modification::Allowed(k) => k,
         other => panic!("{other:?}"),
     };
-    assert!(allowed.contains(&"document security store".to_string()), "{allowed:?}");
+    assert!(allowed.contains(&kind::SECURITY_STORE), "{allowed:?}");
     // Embedding twice keeps one certificate (byte-identical dedup) and stays valid.
     let twice = dss::embed(&doc, &evidence).unwrap();
     let doc2 = open(&twice);
@@ -389,8 +495,8 @@ fn sign_then_ltv_then_timestamp_makes_a_b_lta_file() {
         Modification::Allowed(k) => k,
         other => panic!("{other:?}"),
     };
-    assert!(allowed.contains(&"document security store".to_string()) && allowed.contains(&"signature".to_string()), "{allowed:?}");
-    assert!(!allowed.contains(&"page content".to_string()), "{allowed:?}");
+    assert!(allowed.contains(&kind::SECURITY_STORE) && allowed.contains(&kind::SIGNATURE), "{allowed:?}");
+    assert!(!allowed.contains(&kind::PAGE_CONTENT), "{allowed:?}");
     let stamp = all.iter().find(|s| s.doc_timestamp).unwrap();
     assert_eq!(stamp.status, Status::Valid, "{:?}", stamp.details);
 }
@@ -421,7 +527,7 @@ fn an_embedded_verified_revocation_invalidates_the_signature() {
     let ltv = dss::embed(&open(&signed), &Evidence { certs: Vec::new(), ocsps: Vec::new(), crls: vec![crl] }).unwrap();
     let s = signatures(&open(&ltv), &ltv, &TrustStore::default()).into_iter().find(|s| s.signed && !s.doc_timestamp).unwrap();
     assert_eq!(s.status, Status::Invalid, "{:?}", s.details);
-    assert!(s.details.iter().any(|d| d.contains("revoked") && d.contains("CRL")), "{:?}", s.details);
+    assert!(s.details.iter().any(|d| d.message.contains("revoked") && d.message.contains("CRL")), "{:?}", s.details);
 }
 
 #[test]
@@ -440,7 +546,7 @@ fn validates_a_signature_made_by_openssl() {
     // A later comment is allowed for this approval signature.
     let edited = edit_after(&bytes, add_comment);
     let s = signatures(&open(&edited), &edited, &TrustStore::default()).into_iter().next().unwrap();
-    assert_eq!(s.modification, Modification::Allowed(vec!["comments".into()]));
+    assert_eq!(s.modification, Modification::Allowed(vec![kind::COMMENTS]));
 }
 
 #[test]
@@ -585,7 +691,7 @@ fn declaring_a_form_xfa_does_not_excuse_replacing_the_pages() {
         assert_eq!(check(&signed).status, Status::Valid);
         let s = check(&edit_after(&signed, xfa_page_swap));
         assert_eq!(s.status, Status::Invalid, "{certify:?}: {:?}", s.details);
-        assert!(matches!(&s.modification, Modification::Disallowed(k) if k.contains(&"document structure".to_string())), "{:?}", s.modification);
+        assert!(matches!(&s.modification, Modification::Disallowed(k) if k.contains(&kind::STRUCTURE)), "{:?}", s.modification);
     }
 }
 
@@ -628,7 +734,7 @@ fn validates_signatures_written_with_ber_indefinite_lengths() {
         let anchor = id.certificate.clone();
         let s = signatures(&open(&signed), &signed, &TrustStore { certs: vec![anchor] }).into_iter().find(|s| s.signed).unwrap();
         assert_eq!(s.status, Status::Valid, "{file}: {:?}", s.details);
-        assert!(s.details.iter().any(|d| d.contains("BER")), "the tolerance is reported: {:?}", s.details);
+        assert!(s.details.iter().any(|d| d.message.contains("BER")), "the tolerance is reported: {:?}", s.details);
         // Tampering is still caught: the digest check is not relaxed.
         let mut tampered = signed.clone();
         let i = tampered.windows(13).position(|w| w == b"Contract text").unwrap();
@@ -746,7 +852,7 @@ fn assert_refused_at_every_level(base: &[u8], kind: &str, attack: impl Fn(&mut D
         assert_eq!(check(&signed).status, Status::Valid, "{certify:?}: untouched");
         let s = check(&edit_after(&signed, &attack));
         assert_eq!(s.status, Status::Invalid, "{certify:?}: {:?} {:?}", s.modification, s.details);
-        assert!(matches!(&s.modification, Modification::Disallowed(k) if k.iter().any(|k| k == kind)), "{certify:?}: {:?}", s.modification);
+        assert!(matches!(&s.modification, Modification::Disallowed(k) if k.contains(&kind)), "{certify:?}: {:?}", s.modification);
     }
 }
 
@@ -912,7 +1018,7 @@ fn the_catalogs_own_xmp_stream_may_still_be_rewritten_after_signing() {
             doc.set(pdfcraft_cos::ObjRef { num: 7, generation: 0 }, Object::Stream(pdfcraft_cos::Stream::from_raw(d, b"<x:xmpmeta />".to_vec())));
         });
         let s = signatures(&open(&edited), &edited, &trust).into_iter().find(|s| s.signed).unwrap();
-        assert!(matches!(&s.modification, Modification::Allowed(k) if k.iter().any(|k| k == "metadata")), "{certify:?}: {:?}", s.modification);
+        assert!(matches!(&s.modification, Modification::Allowed(k) if k.contains(&kind::METADATA)), "{certify:?}: {:?}", s.modification);
         assert_eq!(s.status, Status::Valid, "{certify:?}: {:?}", s.details);
     }
 }
@@ -956,14 +1062,14 @@ fn a_signed_store_may_grow_but_not_lose_or_swap_entries() {
         });
         let s = check(&grown);
         assert_eq!(s.status, Status::Valid, "{certify:?}: {:?} {:?}", s.modification, s.details);
-        assert!(matches!(&s.modification, Modification::Allowed(k) if k.iter().any(|k| k == "document security store")), "{:?}", s.modification);
+        assert!(matches!(&s.modification, Modification::Allowed(k) if k.contains(&kind::SECURITY_STORE)), "{:?}", s.modification);
         // Dropping what was signed is a change, not an addition.
         let dropped = edit_after(&signed, |doc| {
             doc.set(pdfcraft_cos::ObjRef { num: certs, generation: 0 }, Object::Array(vec![]));
         });
         let s = check(&dropped);
         assert_eq!(s.status, Status::Invalid, "{certify:?}: {:?}", s.modification);
-        assert!(matches!(&s.modification, Modification::Disallowed(k) if k.iter().any(|k| k == "other changes")), "{:?}", s.modification);
+        assert!(matches!(&s.modification, Modification::Disallowed(k) if k.contains(&kind::OTHER)), "{:?}", s.modification);
     }
 }
 
@@ -984,7 +1090,7 @@ fn a_form_xobject_relabelled_metadata_is_not_a_metadata_change() {
     let edited = edit_after(&signed, relabel);
     let s = signatures(&open(&edited), &edited, &trust).into_iter().find(|s| s.signed).unwrap();
     assert_eq!(s.status, Status::Invalid, "{:?}", s.details);
-    assert!(matches!(&s.modification, Modification::Disallowed(k) if !k.contains(&"metadata".to_string())), "{:?}", s.modification);
+    assert!(matches!(&s.modification, Modification::Disallowed(k) if !k.contains(&kind::METADATA)), "{:?}", s.modification);
     // The catalog's own XMP stream may still be updated.
     let with_xmp = edit_after(&fixture_with_xobject(), |doc| {
         let xmp = b"<x:xmpmeta xmlns:x=\"adobe:ns:meta/\"/>".to_vec();
@@ -1009,7 +1115,105 @@ fn a_form_xobject_relabelled_metadata_is_not_a_metadata_change() {
     });
     let s = signatures(&open(&rewrite_xmp), &rewrite_xmp, &trust).into_iter().find(|s| s.signed).unwrap();
     assert_eq!(s.status, Status::Valid, "{:?}", s.details);
-    assert_eq!(s.modification, Modification::Allowed(vec!["metadata".into()]));
+    assert_eq!(s.modification, Modification::Allowed(vec!["metadata"]));
+}
+
+#[test]
+fn a_form_xobject_relabelled_as_file_plumbing_is_still_judged() {
+    // Whether a changed stream is an xref or object stream is what it was when signed: a
+    // drawn Form XObject rewritten after signing and labelled /ObjStm or /XRef still shows its
+    // new content (the renderer ignores /Type), so it must not be skipped.
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let trust = TrustStore { certs: vec![id.certificate.clone()] };
+    for certify in LEVELS {
+        let signed = pdfcraft_sign::sign(&open(&fixture_with_xobject()), &id, &SignOptions { certify, ..opts() }).unwrap();
+        for label in ["ObjStm", "XRef"] {
+            let edited = edit_after(&signed, |doc| {
+                let mut d = pdfcraft_cos::Dict::new();
+                d.set(b"Type".to_vec(), Object::name(label));
+                d.set(b"Subtype".to_vec(), Object::name("Form"));
+                d.set(b"BBox".to_vec(), Object::Array(vec![Object::Int(0), Object::Int(0), Object::Int(300), Object::Int(300)]));
+                let body = b"BT /F1 14 Tf 20 250 Td (Forged text) Tj ET".to_vec();
+                d.set(b"Length".to_vec(), Object::Int(body.len() as i64));
+                doc.set(pdfcraft_cos::ObjRef { num: 7, generation: 0 }, Object::Stream(pdfcraft_cos::Stream::from_raw(d, body)));
+            });
+            let s = signatures(&open(&edited), &edited, &trust).into_iter().find(|s| s.signed).unwrap();
+            assert_eq!(s.status, Status::Invalid, "{certify:?} /{label}: {:?}", s.details);
+            assert!(matches!(&s.modification, Modification::Disallowed(k) if k.contains(&"other changes")), "{:?}", s.modification);
+        }
+    }
+}
+
+/// `fixture()` with a document information dictionary (object 7) named by the trailer's `/Info`.
+fn fixture_with_info() -> Vec<u8> {
+    let objs: Vec<&[u8]> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [6 0 R] >> >>",
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>",
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 300 300] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> /Annots [6 0 R] >>",
+        b"<< /Length 44 >>\nstream\nBT /F1 14 Tf 20 250 Td (Contract text) Tj ET\nendstream",
+        b"<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>",
+        b"<< /Type /Annot /Subtype /Widget /FT /Sig /T (Approval) /Rect [150 20 280 70] /P 3 0 R /F 4 >>",
+        b"<< /Producer (PdfCraft) /CreationDate (D:20260101000000Z) >>",
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n", i + 1).as_bytes());
+        out.extend_from_slice(o);
+        out.extend_from_slice(b"\nendobj\n");
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R /Info 7 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+#[test]
+fn a_signed_page_relabelled_or_stripped_of_type_is_still_page_content() {
+    // A page is judged by the role it had when signed, not by the /Type its new version carries.
+    // A hand-written incremental revision that rewrites the signed page's /Contents while
+    // relabelling it /Type /Sig (permitted at every level) or dropping /Type and adding /ModDate
+    // (read as a metadata change) must still be a disallowed page content change at every level.
+    let forge_page = |ty: Option<&'static str>| {
+        move |doc: &mut Document| {
+            let forged = doc.add(stream_of(b"BT /F1 14 Tf 20 250 Td (Amount due: 999999 EUR) Tj ET"));
+            let mut entries = vec![
+                ("Parent", oref(2)),
+                ("MediaBox", Object::Array(vec![Object::Int(0), Object::Int(0), Object::Int(300), Object::Int(300)])),
+                ("Contents", Object::Ref(forged)),
+                ("Resources", Object::Dict(dict_of(vec![("Font", Object::Dict(dict_of(vec![("F1", oref(5))])))]))),
+                ("Annots", Object::Array(vec![oref(6)])),
+            ];
+            match ty {
+                Some(name) => entries.insert(0, ("Type", Object::name(name))),
+                None => entries.push(("ModDate", Object::String(PdfString::literal("D:20261003000000Z")))),
+            }
+            doc.set(pdfcraft_cos::ObjRef { num: 3, generation: 0 }, Object::Dict(dict_of(entries)));
+        }
+    };
+    assert_refused_at_every_level(&fixture(), "page content", forge_page(Some("Sig")));
+    assert_refused_at_every_level(&fixture(), "page content", forge_page(None));
+
+    // Positive control: an ordinary /Info /ModDate bump on the signed revision's own information
+    // dictionary stays a permitted metadata change.
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let trust = TrustStore { certs: vec![id.certificate.clone()] };
+    for certify in LEVELS {
+        let signed = pdfcraft_sign::sign(&open(&fixture_with_info()), &id, &SignOptions { certify, ..opts() }).unwrap();
+        let bumped = edit_after(&signed, |doc| {
+            doc.update_dict(pdfcraft_cos::ObjRef { num: 7, generation: 0 }, |d| {
+                d.set(b"ModDate".to_vec(), Object::String(PdfString::literal("D:20261003120000Z")));
+            })
+            .unwrap();
+        });
+        let s = signatures(&open(&bumped), &bumped, &trust).into_iter().find(|s| s.signed).unwrap();
+        assert_eq!(s.status, Status::Valid, "{certify:?}: {:?}", s.details);
+        assert!(matches!(&s.modification, Modification::Allowed(k) if k.contains(&"metadata")), "{certify:?}: {:?}", s.modification);
+    }
 }
 
 /// A self-signed CRL from `id` revoking its own certificate, valid from `this` to `next`.
@@ -1040,9 +1244,9 @@ fn a_revoked_certificate_stays_invalid_when_it_was_also_expired_at_signing() {
     let anchor = id.chain.first().cloned().unwrap_or_else(|| id.certificate.clone());
     for trust in [TrustStore::default(), TrustStore { certs: vec![anchor] }] {
         let s = signatures(&open(&ltv), &ltv, &trust).into_iter().find(|s| s.signed && !s.doc_timestamp).unwrap();
-        assert!(s.details.iter().any(|d| d.contains("not valid at the time of signing")), "{:?}", s.details);
+        assert!(s.details.iter().any(|d| d.message.contains("not valid at the time of signing")), "{:?}", s.details);
         assert_eq!(s.status, Status::Invalid, "{:?}", s.details);
-        assert!(s.details.iter().any(|d| d.contains("revoked")), "{:?}", s.details);
+        assert!(s.details.iter().any(|d| d.message.contains("revoked")), "{:?}", s.details);
     }
 }
 
@@ -1061,9 +1265,9 @@ fn an_untrusted_timestamp_does_not_set_the_validation_time() {
     let s = signatures(&open(&signed), &signed, &TrustStore { certs: vec![anchor.clone()] }).into_iter().find(|s| s.signed).unwrap();
     assert_ne!(s.status, Status::Valid, "{:?}", s.details);
     assert_eq!(s.timestamp_time, None, "an untrusted token's time is not a trusted time");
-    assert!(s.details.iter().any(|d| d.contains("not valid at the time of signing")), "{:?}", s.details);
-    assert!(!s.details.iter().any(|d| d.contains("trusted time")), "{:?}", s.details);
-    assert!(s.details.iter().any(|d| d.contains("unverified timestamp")), "{:?}", s.details);
+    assert!(s.details.iter().any(|d| d.message.contains("not valid at the time of signing")), "{:?}", s.details);
+    assert!(!s.details.iter().any(|d| d.message.contains("trusted time")), "{:?}", s.details);
+    assert!(s.details.iter().any(|d| d.message.contains("unverified timestamp")), "{:?}", s.details);
     // Trusting the TSA makes its time authoritative: the certificate was valid then.
     let trust = TrustStore { certs: vec![anchor, tsa.id.certificate.clone()] };
     let s = signatures(&open(&signed), &signed, &trust).into_iter().find(|s| s.signed).unwrap();
@@ -1291,14 +1495,14 @@ fn a_document_timestamp_held_by_a_signature_field_is_checked_as_a_timestamp() {
     // Without trusting the TSA the stamp is intact but unknown, never "altered".
     let s = signatures(&open(&stamped), &stamped, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
     assert_eq!(s.status, Status::Unknown, "{:?}", s.details);
-    assert!(!s.details.iter().any(|d| d.contains("altered or corrupted")), "{:?}", s.details);
+    assert!(!s.details.iter().any(|d| d.message.contains("altered or corrupted")), "{:?}", s.details);
     // A changed byte in what it covers is still caught, and reported as the timestamp's.
     let mut tampered = stamped.clone();
     let i = tampered.windows(13).position(|w| w == b"Contract text").unwrap();
     tampered[i] = b'K';
     let s = signatures(&open(&tampered), &tampered, &trust).into_iter().find(|s| s.signed).unwrap();
     assert_eq!(s.status, Status::Invalid);
-    assert!(s.details.iter().any(|d| d.contains("since the timestamp was applied")), "{:?}", s.details);
+    assert!(s.details.iter().any(|d| d.message.contains("since the timestamp was applied")), "{:?}", s.details);
 }
 
 /// A trusted timestamp authority whose certificate was not yet valid when it stamped proves
@@ -1315,8 +1519,8 @@ fn a_field_timestamp_from_a_trusted_tsa_outside_its_validity_is_not_valid() {
     let s = signatures(&open(&stamped), &stamped, &trust).into_iter().find(|s| s.signed).unwrap();
     assert!(s.doc_timestamp);
     assert_eq!(s.status, Status::Unknown, "{:?}", s.details);
-    assert!(s.details.iter().any(|d| d.contains("was not valid at the time of timestamping")), "{:?}", s.details);
-    assert!(!s.details.iter().any(|d| d.contains("its authority is trusted")), "{:?}", s.details);
+    assert!(s.details.iter().any(|d| d.message.contains("was not valid at the time of timestamping")), "{:?}", s.details);
+    assert!(!s.details.iter().any(|d| d.message.contains("its authority is trusted")), "{:?}", s.details);
 }
 
 #[test]
@@ -1348,7 +1552,7 @@ fn a_legacy_x509_signature_with_a_malformed_rsa_key_is_invalid() {
     let s = signatures(&open(&bad), &bad, &TrustStore::default()).into_iter().find(|s| s.signed).unwrap();
     assert_eq!(s.sub_filter.as_deref(), Some("adbe.x509.rsa_sha1"));
     assert_eq!(s.status, Status::Invalid, "{:?}", s.details);
-    assert!(!s.details.iter().any(|d| d.contains("can't check this signature yet")), "{:?}", s.details);
+    assert!(!s.details.iter().any(|d| d.message.contains("can't check this signature yet")), "{:?}", s.details);
 }
 
 #[test]
@@ -1364,8 +1568,8 @@ fn validates_the_legacy_adbe_x509_rsa_sha1_format() {
     assert_eq!(s.modification, Modification::None);
     // SHA-1 still validates, but the panel says it is weak.
     let weak = "This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.";
-    assert_eq!(s.details.iter().filter(|d| *d == weak).count(), 1, "{:?}", s.details);
-    assert!(s.details.iter().any(|d| d.contains("legacy adbe.x509.rsa_sha1 format")), "{:?}", s.details);
+    assert_eq!(s.details.iter().filter(|d| d.message == weak).count(), 1, "{:?}", s.details);
+    assert!(s.details.iter().any(|d| d.message.contains("legacy adbe.x509.rsa_sha1 format")), "{:?}", s.details);
     let trusted = TrustStore { certs: vec![id.certificate.clone()] };
     let s = signatures(&open(&pdf), &pdf, &trusted).into_iter().find(|s| s.signed).unwrap();
     assert_eq!(s.status, Status::Valid, "{:?}", s.details);
@@ -1439,7 +1643,7 @@ fn encrypted_documents_are_signed_with_an_unencrypted_contents() {
         let sigs = signatures(&open_pw(&both, None), &both, &trust);
         let first = sigs.iter().find(|s| s.field == "Signature1").unwrap();
         assert_eq!(first.status, Status::Valid, "{alg:?}: {:?}", first.details);
-        assert_eq!(first.modification, Modification::Allowed(vec!["signature".into()]), "{alg:?}: {:?}", first.details);
+        assert_eq!(first.modification, Modification::Allowed(vec![kind::SIGNATURE]), "{alg:?}: {:?}", first.details);
         let second = sigs.iter().find(|s| s.field == "Approval").unwrap();
         assert_eq!((second.status, second.revision), (Status::Valid, 3), "{alg:?}: {:?}", second.details);
         // The page text is still encrypted, and tampering with its ciphertext breaks both.
@@ -1452,6 +1656,28 @@ fn encrypted_documents_are_signed_with_an_unencrypted_contents() {
     }
 }
 
+#[test]
+fn an_encrypted_documents_signature_graphic_is_encrypted_with_it() {
+    let id = pkcs12::open(&data("ec-p256.p12"), "test").unwrap();
+    let trust = TrustStore { certs: vec![id.certificate.clone()] };
+    for alg in ALL_ALGORITHMS {
+        let base = protected(alg, -1);
+        let signed = pdfcraft_sign::sign(&open_pw(&base, None), &id, &SignOptions { graphic: Some(picture(true)), ..opts() }).unwrap();
+        let doc = open_pw(&signed, None);
+        let s = signatures(&doc, &signed, &trust).into_iter().find(|s| s.signed).unwrap();
+        assert_eq!((s.status, s.modification), (Status::Valid, Modification::None), "{alg:?}");
+        // Read back through the security handler, the pixels and their mask are exact; a stream
+        // written in the clear would be "decrypted" into noise and fail to inflate.
+        let (content, res) = appearance_in(&doc, "Signature1");
+        assert!(content.contains("/Im1 Do"), "{alg:?}: {content}");
+        let xobjects = doc.resolve(res.get(b"XObject").unwrap()).as_dict().cloned().unwrap();
+        let Object::Stream(im) = &*doc.resolve(xobjects.get(b"Im1").unwrap()) else { panic!() };
+        assert_eq!(im.decoded().unwrap()[..3], [10, 20, 30], "{alg:?}");
+        let Object::Stream(mask) = &*doc.resolve(im.dict.get(b"SMask").unwrap()) else { panic!() };
+        assert_eq!(mask.decoded().unwrap()[..2], [128, 255], "{alg:?}");
+    }
+}
+
 #[test]
 fn encrypted_documents_are_signed_only_as_their_permissions_allow() {
     let id = pkcs12::open(&data("ec-p256.p12"), "test").unwrap();
@@ -1511,3 +1737,89 @@ fn encrypted_documents_take_a_document_timestamp() {
     let print_only = open_pw(&protected(pdfcraft_cos::Algorithm::Aes128, -3900), None);
     assert!(matches!(pdfcraft_sign::timestamp_document(&print_only, &tsa, "D:20261006120000Z"), Err(SignError::Pdf(_))));
 }
+
+/// Every sentence this crate says about a signature is listed in `WORDINGS`, and every sentence on
+/// that list is one it still says: the details are written as `Detail::plain`/`Detail::of`, the
+/// sentences the modules that read a signature word for themselves are pushed as notes and quirks,
+/// and the summaries are the only words `summary` chooses between, so all of them can be read off
+/// the files. An interface then has these to translate and only these.
+#[test]
+fn wordings_are_complete() {
+    let source = include_str!("../src/pdf.rs");
+    // The modules below `pdf` word whole sentences too: how a signature value had to be read, and
+    // what a certificate does not allow.
+    let elsewhere =
+        [include_str!("../src/x509.rs"), include_str!("../src/cms.rs"), include_str!("../src/keys.rs"), include_str!("../src/rsa_pad.rs")];
+    /// A sentence said to the user, as opposed to an OID, a name or a tag: it reads as English.
+    fn is_sentence(s: &str) -> bool {
+        s.len() > 24 && s.ends_with('.') && s.contains(' ') && s.starts_with(|c: char| c.is_ascii_uppercase())
+    }
+    // The literals of a stretch of the file, each as it is written there.
+    fn literals(text: &str) -> Vec<&str> {
+        let (mut out, mut rest) = (Vec::new(), text);
+        while let Some(at) = rest.find('"') {
+            rest = &rest[at + 1..];
+            let Some(end) = rest.find('"') else { break };
+            out.push(&rest[..end]);
+            rest = &rest[end + 1..];
+        }
+        out
+    }
+    /// The literals written right after each of `shapes`, wherever they appear in `text`.
+    fn after<'a>(text: &'a str, shapes: &[&str]) -> Vec<&'a str> {
+        let mut out = Vec::new();
+        for shape in shapes {
+            let mut rest = text;
+            while let Some(at) = rest.find(shape) {
+                rest = &rest[at + shape.len()..];
+                // A long sentence is written on the line below, and `plain` passes its own on.
+                let Some(text) = rest.trim_start().strip_prefix('"') else { continue };
+                let Some(end) = text.find('"') else { break };
+                out.push(&text[..end]);
+                rest = text;
+            }
+        }
+        out
+    }
+    let mut said = after(source, &["Detail::plain(", "Detail::of("]);
+    let at_hand = ["Detail::plain(", "Detail::of(", ".push(", "Some("];
+    said.extend(elsewhere.iter().flat_map(|s| after(s, &at_hand)).filter(|s| is_sentence(s)));
+    let summary = source.split("pub fn summary").nth(1).and_then(|s| s.split("\n    }").next()).unwrap_or_default();
+    said.extend(literals(summary));
+    assert!(said.len() >= 40, "the sentences are not being read off the files: {said:#?}");
+    let missing: Vec<&&str> = said.iter().filter(|s| !WORDINGS.contains(s)).collect();
+    assert!(missing.is_empty(), "add these to WORDINGS, and a translation of each to every interface: {missing:#?}");
+    let unsaid: Vec<&&str> = WORDINGS.iter().filter(|s| !said.contains(s)).collect();
+    assert!(unsaid.is_empty(), "WORDINGS lists sentences this crate no longer says: {unsaid:#?}");
+    // And every word it calls a change by is in `kind::ALL`, which is what an interface translates.
+    let vocabulary = source.split("pub mod kind {").nth(1).and_then(|s| s.split("\n}").next()).unwrap_or_default();
+    let words = literals(vocabulary);
+    assert!(words.len() >= 11, "the vocabulary is not being read off the file: {words:#?}");
+    let missing: Vec<&&str> = words.iter().filter(|w| !kind::ALL.contains(w)).collect();
+    assert!(missing.is_empty(), "add these to kind::ALL, and a translation of each to every interface: {missing:#?}");
+    let gone: Vec<&&str> = kind::ALL.iter().filter(|w| !words.contains(w)).collect();
+    assert!(gone.is_empty(), "kind::ALL lists words that are no longer there: {gone:#?}");
+}
+
+/// Each detail says itself: in English it comes to the sentence it carries, and its wording is one an
+/// interface can look up. This is what the Signatures panel relies on to read in another language.
+#[test]
+fn details_say_themselves() {
+    let id = pkcs12::open(&data("rsa-aes.p12"), "test").unwrap();
+    let signed = pdfcraft_sign::sign(&open(&fixture()), &id, &opts()).unwrap();
+    let sigs = signatures(&open(&signed), &signed, &TrustStore::default());
+    let details: Vec<&Detail> = sigs.iter().flat_map(|s| s.details.iter()).collect();
+    assert!(!details.is_empty());
+    for d in details {
+        assert_eq!(d.said(&in_english), d.message);
+        assert!(WORDINGS.contains(&d.pattern), "{:?} is not in WORDINGS", d.pattern);
+        // A wording has exactly as many holes as its fill has things to put in them.
+        let holes = d.pattern.matches("{}").count();
+        let wanted = match &d.fill {
+            pdfcraft_sign::Fill::Nothing => 0,
+            pdfcraft_sign::Fill::Names(..) => 2,
+            _ => 1,
+        };
+        assert_eq!(holes, wanted, "{:?} has {holes} holes", d.pattern);
+    }
+}
diff --git a/crates/ui-egui/src/a11y_ui.rs b/crates/ui-egui/src/a11y_ui.rs
index ef372a93..da88e8e7 100644
--- a/crates/ui-egui/src/a11y_ui.rs
+++ b/crates/ui-egui/src/a11y_ui.rs
@@ -287,7 +287,10 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, state: &mut A11yState, doc: D
                 egui::Frame::NONE.inner_margin(egui::Margin { left: 46, right: 4, top: 0, bottom: 6 }).show(ui, |ui| {
                     ui.spacing_mut().item_spacing.y = 2.0;
                     for f in &r.findings {
-                        let l = ui.add(egui::Label::new(egui::RichText::new(&f.message).small().color(t.text_muted)).sense(egui::Sense::click()));
+                        // The checker hands over the sentence and the document's own words apart, so
+                        // the sentence is said in the panel's language with those words still in it.
+                        let said = f.said(&crate::i18n::words);
+                        let l = ui.add(egui::Label::new(egui::RichText::new(said).small().color(t.text_muted)).sense(egui::Sense::click()));
                         if let Some(p) = f.page
                             && l.on_hover_text(tl!("Go to the page")).clicked()
                         {
@@ -356,7 +359,9 @@ impl PdfCraftApp {
         let Some((_, report)) = self.a11y.report.as_ref().filter(|(d, _)| *d == id) else { return };
         let Some(doc) = self.session.get(id) else { return };
         let (y, m, d) = self.session.today();
-        let html = pdfcraft_engine::a11y::report_html(report, &doc.name, &format!("{y}-{m:02}-{d:02}"));
+        // The saved report reads the way the interface reads, down to its `lang` attribute.
+        let lang = crate::i18n::current();
+        let html = pdfcraft_engine::a11y::report_html(report, &doc.name, &format!("{y}-{m:02}-{d:02}"), lang.code(), &crate::i18n::words);
         let stem = doc.name.trim_end_matches(".pdf").trim_end_matches(".PDF").to_string();
         let title = tl!("Save the accessibility report").to_string();
         self.write_files(&[(format!("{stem} Accessibility Report.html"), std::sync::Arc::new(html.into_bytes()))], &title);
@@ -493,8 +498,7 @@ pub(crate) fn alt_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) ->
     ui.add_space(8.0);
     ui.add_enabled_ui(!d.decorative[i], |ui| {
         let l = ui.label(tl!("Alternate text"));
-        ui.add(egui::TextEdit::multiline(&mut d.texts[i]).desired_rows(3).desired_width(380.0).hint_text(tl!("Describe the figure")))
-            .labelled_by(l.id);
+        ui.add(crate::widgets::block(&mut d.texts[i]).desired_rows(3).desired_width(380.0).hint_text(tl!("Describe the figure"))).labelled_by(l.id);
     });
     ui.checkbox(&mut d.decorative[i], tl!("Decorative figure"));
     ui.add_space(10.0);
diff --git a/crates/ui-egui/src/actions_ui.rs b/crates/ui-egui/src/actions_ui.rs
index b3142637..89cf2569 100644
--- a/crates/ui-egui/src/actions_ui.rs
+++ b/crates/ui-egui/src/actions_ui.rs
@@ -307,10 +307,10 @@ fn edit_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
     ui.add_space(8.0);
     egui::Grid::new("action-edit").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
         ui.label(tl!("Action name:"));
-        ui.add(egui::TextEdit::singleline(&mut a.name).desired_width(320.0).id_salt("action-name"));
+        ui.add(crate::widgets::line(&mut a.name).desired_width(320.0).id_salt("action-name"));
         ui.end_row();
         ui.label(tl!("Description:"));
-        ui.add(egui::TextEdit::singleline(&mut a.description).desired_width(320.0).id_salt("action-description"));
+        ui.add(crate::widgets::line(&mut a.description).desired_width(320.0).id_salt("action-description"));
         ui.end_row();
     });
     ui.add_space(6.0);
@@ -326,7 +326,7 @@ fn edit_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
                 ui.horizontal(|ui| {
                     ui.label(format!("{}. {}", i + 1, tl!(s.label())));
                     if let Some(arg) = s.arg_mut() {
-                        ui.add(egui::TextEdit::singleline(arg).desired_width(220.0));
+                        ui.add(crate::widgets::line(arg).desired_width(220.0));
                     }
                     ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                         if ui.button(tl!("Remove")).clicked() {
diff --git a/crates/ui-egui/src/appearance.rs b/crates/ui-egui/src/appearance.rs
new file mode 100644
index 00000000..bb804314
--- /dev/null
+++ b/crates/ui-egui/src/appearance.rs
@@ -0,0 +1,181 @@
+//! Preferences › Appearance: the appearance mode (follow the system, light or dark) above a light
+//! and a dark theme card, each with a small picture of PdfCraft in that theme.
+
+use egui::{Rect, RichText, pos2, vec2};
+
+use crate::PdfCraftApp;
+use crate::theme::{self, ThemeKind, ThemePreference, Tokens};
+
+/// The themes each card offers. One of each today; a new theme is one more row here.
+pub const LIGHT_THEMES: &[(ThemeKind, &str)] = &[(ThemeKind::Light, "Light gray")];
+pub const DARK_THEMES: &[(ThemeKind, &str)] = &[(ThemeKind::Dark, "Dark gray")];
+
+fn mode_label(preference: ThemePreference) -> &'static str {
+    match preference {
+        ThemePreference::System => "Use system setting",
+        ThemePreference::Light => "Light",
+        ThemePreference::Dark => "Dark",
+    }
+}
+
+fn mode_command(preference: ThemePreference) -> &'static str {
+    match preference {
+        ThemePreference::System => "view.theme.system",
+        ThemePreference::Light => "view.theme.light",
+        ThemePreference::Dark => "view.theme.dark",
+    }
+}
+
+/// A miniature PdfCraft window in `kind`'s colours: title bar and tabs, the tool bar, the page
+/// thumbnails, a page on the pasteboard and the right-hand panel.
+fn preview(ui: &mut egui::Ui, kind: ThemeKind, width: f32) {
+    let p = Tokens::for_kind(kind);
+    let (rect, _) = ui.allocate_exact_size(vec2(width, 118.0), egui::Sense::hover());
+    let painter = ui.painter_at(rect);
+    painter.rect_filled(rect, 3.0, p.chrome);
+    let title = Rect::from_min_size(rect.min, vec2(rect.width(), 12.0));
+    painter.rect_filled(title, 0.0, p.titlebar);
+    // The active tab and the theme button.
+    painter.rect_filled(Rect::from_min_size(title.min + vec2(6.0, 3.0), vec2(36.0, 9.0)), 2.0, p.panel);
+    painter.rect_filled(Rect::from_min_size(title.min + vec2(9.0, 6.0), vec2(20.0, 2.0)), 1.0, p.text);
+    painter.circle_filled(pos2(title.right() - 7.0, title.center().y), 2.5, p.icon);
+    // The tool bar, with its first tool active.
+    let tools = Rect::from_min_size(pos2(rect.left(), title.bottom()), vec2(rect.width(), 12.0));
+    painter.rect_filled(tools, 0.0, p.panel);
+    for i in 0..8 {
+        let c = if i == 0 { p.accent } else { p.icon };
+        painter.rect_filled(Rect::from_min_size(tools.min + vec2(8.0 + i as f32 * 9.0, 3.5), vec2(5.0, 5.0)), 1.0, c);
+    }
+    let body = Rect::from_min_max(pos2(rect.left(), tools.bottom() + 1.0), rect.max);
+    // Page thumbnails on the left, the second one selected.
+    let rail = Rect::from_min_size(body.min, vec2((body.width() * 0.16).round(), body.height()));
+    painter.rect_filled(rail, 0.0, p.panel);
+    for i in 0..3 {
+        let thumb = Rect::from_min_size(rail.min + vec2(rail.width() * 0.25, 6.0 + i as f32 * 26.0), vec2(rail.width() * 0.5, 20.0));
+        if i == 1 {
+            painter.rect_filled(thumb.expand(2.0), 2.0, p.accent_soft);
+        }
+        painter.rect_filled(thumb, 1.0, egui::Color32::WHITE);
+        painter.rect_stroke(thumb, 1.0, egui::Stroke::new(0.5, p.border), egui::StrokeKind::Outside);
+    }
+    // The right-hand panel: a heading and a few rows.
+    let side = Rect::from_min_max(pos2(body.right() - (body.width() * 0.22).round(), body.top()), body.max);
+    painter.rect_filled(side, 0.0, p.panel);
+    painter.rect_filled(Rect::from_min_size(side.min + vec2(5.0, 5.0), vec2(side.width() * 0.5, 2.5)), 1.0, p.text);
+    for i in 0..4 {
+        let y = side.top() + 14.0 + i as f32 * 8.0;
+        painter.rect_filled(Rect::from_min_size(pos2(side.left() + 5.0, y), vec2(side.width() * 0.7, 2.0)), 1.0, p.text_muted);
+    }
+    // The page, white in both themes, with a heading and lines of text.
+    let paste = Rect::from_min_max(pos2(rail.right(), body.top()), pos2(side.left(), body.bottom()));
+    painter.rect_filled(paste, 0.0, p.pasteboard);
+    let page_h = paste.height() - 10.0;
+    let page = Rect::from_center_size(paste.center(), vec2(page_h * 0.77, page_h));
+    painter.rect_filled(page.translate(vec2(1.0, 1.0)), 1.0, p.page_shadow);
+    painter.rect_filled(page, 1.0, egui::Color32::WHITE);
+    let ink = egui::Color32::from_gray(0x60);
+    painter.rect_filled(Rect::from_min_size(page.min + vec2(6.0, 7.0), vec2(page.width() * 0.5, 3.0)), 1.0, egui::Color32::from_gray(0x30));
+    for i in 0..8 {
+        let w = if i % 4 == 3 { 0.45 } else { 0.8 };
+        painter.rect_filled(Rect::from_min_size(page.min + vec2(6.0, 15.0 + i as f32 * 6.0), vec2(page.width() * w - 6.0, 1.5)), 0.5, ink);
+    }
+}
+
+/// One theme card: its title, Active when it is what shows now, a preview of the chosen theme
+/// and a radio row per theme.
+fn card(ui: &mut egui::Ui, t: &Tokens, title: &str, active: bool, themes: &[(ThemeKind, &str)]) {
+    egui::Frame::new()
+        .fill(t.card)
+        .stroke(egui::Stroke::new(1.0, if active { t.accent } else { t.border }))
+        .corner_radius(6.0)
+        .inner_margin(egui::Margin::same(8))
+        .show(ui, |ui| {
+            ui.set_width(ui.available_width());
+            ui.horizontal(|ui| {
+                ui.label(RichText::new(title).font(theme::semibold(12.5)).color(t.text));
+                if active {
+                    ui.label(RichText::new(tl!("Active")).color(t.accent_text).small());
+                }
+            });
+            ui.add_space(4.0);
+            let shown = themes.first().map_or(ThemeKind::Light, |(kind, _)| *kind);
+            preview(ui, shown, ui.available_width());
+            ui.add_space(4.0);
+            for (kind, label) in themes {
+                // One theme per card today, so it is always the chosen one.
+                let _ = ui.radio(*kind == shown, tl!(label));
+            }
+        });
+}
+
+/// The Appearance section of Preferences.
+pub fn preferences_section(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) {
+    ui.label(RichText::new(tl!("Appearance")).font(theme::semibold(13.0)));
+    ui.horizontal(|ui| {
+        ui.label(tl!("Appearance mode"));
+        egui::ComboBox::from_id_salt("appearance-mode").selected_text(tl!(mode_label(app.theme_preference))).show_ui(ui, |ui| {
+            for preference in [ThemePreference::System, ThemePreference::Light, ThemePreference::Dark] {
+                if ui.selectable_label(app.theme_preference == preference, tl!(mode_label(preference))).clicked() {
+                    app.execute(mode_command(preference));
+                    ui.close();
+                }
+            }
+        });
+    });
+    ui.add_space(4.0);
+    let light_active = app.theme == ThemeKind::Light;
+    ui.columns(2, |cols| {
+        let [light, dark] = cols else { return };
+        card(light, t, tl!("Light theme"), light_active, LIGHT_THEMES);
+        card(dark, t, tl!("Dark theme"), !light_active, DARK_THEMES);
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use egui_kittest::Harness;
+    use egui_kittest::kittest::Queryable;
+
+    use super::*;
+
+    /// The mode is chosen in Preferences and both theme cards show, the one on screen marked
+    /// Active.
+    #[test]
+    fn preferences_choose_the_appearance_mode_and_show_both_themes() {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        let mut fonts = false;
+        let mut h = Harness::builder().with_size(egui::vec2(640.0, 400.0)).build_ui_state(
+            move |ui, app: &mut PdfCraftApp| {
+                // The app's fonts (the semibold headings) take effect from the next frame.
+                if !fonts {
+                    ui.ctx().set_fonts(theme::font_definitions());
+                    fonts = true;
+                    return;
+                }
+                let t = Tokens::get(ui.ctx());
+                preferences_section(ui, app, &t);
+            },
+            app,
+        );
+        h.run();
+        assert!(h.query_by_label("Light theme").is_some() && h.query_by_label("Dark theme").is_some());
+        assert!(h.query_by_label("Light gray").is_some() && h.query_by_label("Dark gray").is_some());
+        assert_eq!(h.query_all_by_label("Active").count(), 1);
+        if let Ok(path) = std::env::var("PDFCRAFT_APPEARANCE_SHOT") {
+            h.render().unwrap().save(path).unwrap();
+        }
+
+        let combo = egui::accesskit::Role::ComboBox;
+        h.get_by_role(combo).click();
+        h.run();
+        h.get_by_label("Dark").click();
+        h.run();
+        assert_eq!(h.state().theme_preference, ThemePreference::Dark);
+        h.get_by_role(combo).click();
+        h.run();
+        h.get_by_label("Use system setting").click();
+        h.run();
+        assert_eq!(h.state().theme_preference, ThemePreference::System);
+    }
+}
diff --git a/crates/ui-egui/src/camera_ui.rs b/crates/ui-egui/src/camera_ui.rs
new file mode 100644
index 00000000..720ac7c6
--- /dev/null
+++ b/crates/ui-egui/src/camera_ui.rs
@@ -0,0 +1,216 @@
+//! Scan & OCR ▸ Enhance ▸ Camera image: four corner handles on a page, dragged onto the edges of
+//! a photographed document; Enhance page straightens what they enclose
+//! (`Session::enhance_camera_page`, one undoable step).
+
+use egui::{Align2, Color32, CornerRadius, Pos2, Rect, Shape, Stroke, vec2};
+
+use crate::canvas::{DocView, PageXform, ViewAction};
+use crate::theme::Tokens;
+pub use pdfcraft_engine::camera_clean::Look;
+
+/// How far in from the page's edges the corners start, as a share of its size.
+const INSET: f32 = 0.05;
+/// How close (screen points) the pointer must be to pick up a corner.
+const GRAB: f32 = 12.0;
+/// The slider's top.
+pub const MAX_LEVEL: u8 = pdfcraft_engine::camera_clean::MAX_LEVEL;
+const BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
+
+/// The quadrilateral being placed: its page, its corners in view space (points, y down) and the
+/// corner being dragged.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct CameraQuad {
+    pub page: usize,
+    pub corners: [[f32; 2]; 4],
+    pub grab: Option<usize>,
+}
+
+impl CameraQuad {
+    /// The page `page` (view size `w` × `h` points) inset by [`INSET`] on every side.
+    pub fn inset(page: usize, w: f32, h: f32) -> Self {
+        let (dx, dy) = (w * INSET, h * INSET);
+        Self { page, corners: [[dx, dy], [w - dx, dy], [w - dx, h - dy], [dx, h - dy]], grab: None }
+    }
+}
+
+/// The clean-up level a page is enhanced at before the slider is touched.
+pub const DEFAULT_LEVEL: u8 = 50;
+
+/// A page just enhanced: what the bar's slider needs to enhance it again at another level
+/// (from the straightened photo, keeping the turns made since).
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct CameraDone {
+    pub page: usize,
+    /// The corners it was straightened from, in PDF user space.
+    pub corners: [[f64; 2]; 4],
+    /// The look and slider level chosen, and the ones the page shows.
+    pub look: Look,
+    pub level: u8,
+    pub applied: (Look, u8),
+    /// Quarter turns made since, in degrees (clockwise positive).
+    pub turns: i64,
+    /// The undo steps the enhancement and the turns took.
+    pub steps: usize,
+}
+
+fn screen(xf: &PageXform, c: [f32; 2]) -> Pos2 {
+    xf.norm_to_screen(c[0] / xf.pw.max(1e-3), c[1] / xf.ph.max(1e-3))
+}
+
+/// Corner dragging on one page. A press on a page without the quadrilateral moves it there.
+pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, xf: &PageXform, page: usize, view: &mut DocView, allowed: bool) {
+    let pointer = ui.input(|i| i.pointer.hover_pos());
+    let origin = ui.input(|i| i.pointer.press_origin());
+    if !allowed {
+        if pointer.is_some_and(|p| xf.rect.contains(p)) {
+            ui.ctx().set_cursor_icon(egui::CursorIcon::NotAllowed);
+        }
+        return;
+    }
+    // Once the page is enhanced, the bar's buttons take over.
+    if view.camera_done.is_some() {
+        return;
+    }
+    // The tool starts with the corners on the current page.
+    if view.camera.is_none() && page == view.current {
+        view.camera = Some(CameraQuad::inset(page, xf.pw, xf.ph));
+    }
+    if resp.drag_started() || resp.clicked() {
+        let pressed = origin.filter(|o| xf.rect.contains(*o));
+        if pressed.is_some() && view.camera.is_none_or(|q| q.page != page) {
+            view.camera = Some(CameraQuad::inset(page, xf.pw, xf.ph));
+        }
+        if resp.drag_started()
+            && let (Some(o), Some(q)) = (pressed, view.camera.as_mut())
+        {
+            q.grab = (0..4)
+                .map(|i| (i, screen(xf, q.corners[i]).distance(o)))
+                .filter(|(_, d)| *d <= GRAB)
+                .min_by(|a, b| a.1.total_cmp(&b.1))
+                .map(|(i, _)| i);
+        }
+    }
+    let Some(q) = view.camera.as_mut().filter(|q| q.page == page) else { return };
+    let near = pointer.is_some_and(|p| q.corners.iter().any(|&c| screen(xf, c).distance(p) <= GRAB));
+    if let Some(i) = q.grab {
+        ui.ctx().set_cursor_icon(egui::CursorIcon::Grabbing);
+        if let Some(p) = pointer {
+            let (x, y) = xf.screen_to_view(p);
+            if let Some(c) = q.corners.get_mut(i) {
+                *c = [x.clamp(0.0, xf.pw), y.clamp(0.0, xf.ph)];
+            }
+        }
+        if resp.drag_stopped() {
+            q.grab = None;
+        }
+    } else if near {
+        ui.ctx().set_cursor_icon(egui::CursorIcon::Grab);
+    }
+}
+
+/// The quadrilateral and its handles, with what will be cut away dimmed.
+pub(crate) fn paint(painter: &egui::Painter, xf: &PageXform, page: usize, view: &DocView) {
+    let Some(q) = view.camera.filter(|q| q.page == page) else { return };
+    let pts: Vec<Pos2> = q.corners.iter().map(|&c| screen(xf, c)).collect();
+    // Dim the page outside the quadrilateral: a band from each edge out to the page's border.
+    let r = xf.rect;
+    let mut mesh = egui::Mesh::default();
+    let dim = Color32::from_black_alpha(70);
+    let outer = [r.left_top(), r.right_top(), r.right_bottom(), r.left_bottom()];
+    // Pair each quad corner with the page corner nearest to it, in order around the page.
+    let start = (0..4).min_by(|&a, &b| pts[0].distance_sq(outer[a]).total_cmp(&pts[0].distance_sq(outer[b]))).unwrap_or(0);
+    for i in 0..4 {
+        let (a, b) = (pts[i], pts[(i + 1) % 4]);
+        let (oa, ob) = (outer[(start + i) % 4], outer[(start + i + 1) % 4]);
+        let base = mesh.vertices.len() as u32;
+        for p in [a, b, ob, oa] {
+            mesh.colored_vertex(p, dim);
+        }
+        mesh.add_triangle(base, base + 1, base + 2);
+        mesh.add_triangle(base, base + 2, base + 3);
+    }
+    painter.add(Shape::mesh(mesh));
+    painter.add(Shape::closed_line(pts.clone(), Stroke::new(1.5, BLUE)));
+    for p in pts {
+        painter.circle(p, 6.0, Color32::WHITE, Stroke::new(2.0, BLUE));
+    }
+}
+
+/// The floating bar at the top right of the document area (where the find bar goes, clear of a
+/// centred page's corners): Enhance page and Cancel; once the page is enhanced, rotate it either
+/// way, choose its look (original, colour, greyscale, black and white) and clean-up level,
+/// Crop pages, Organize pages, or Done. The instructions are a notice (`ocr.enhance_camera`).
+pub(crate) fn bar(ctx: &egui::Context, view: &mut DocView, area: Rect, t: &Tokens, allowed: bool) {
+    egui::Area::new(egui::Id::new("camera-bar"))
+        .order(egui::Order::Middle)
+        .pivot(Align2::RIGHT_TOP)
+        .fixed_pos(area.right_top() + vec2(-18.0, 12.0))
+        .show(ctx, |ui| {
+            egui::Frame::NONE
+                .fill(t.card)
+                .stroke(Stroke::new(1.0, t.border))
+                .corner_radius(CornerRadius::same(10))
+                .shadow(egui::Shadow { offset: [0, 4], blur: 16, spread: 0, color: Color32::from_black_alpha(if t.dark() { 90 } else { 30 }) })
+                .inner_margin(egui::Margin::symmetric(12, 8))
+                .show(ui, |ui| {
+                    ui.horizontal(|ui| {
+                        // After Enhance page: put the page the right way up, trim it, or move on.
+                        if let Some(done) = view.camera_done.as_mut() {
+                            let mut again = false;
+                            for (look, label) in [
+                                (Look::Original, tl!("Original")),
+                                (Look::Colour, tl!("Colour")),
+                                (Look::Greyscale, tl!("Greyscale")),
+                                (Look::BlackWhite, tl!("Black and white")),
+                            ] {
+                                if ui.add_enabled(allowed, egui::Button::selectable(done.look == look, label)).clicked() && done.look != look {
+                                    done.look = look;
+                                    again = true;
+                                }
+                            }
+                            ui.separator();
+                            ui.label(tl!("Clean-up"));
+                            let slider = ui.add_enabled(
+                                allowed && done.look != Look::Original,
+                                egui::Slider::new(&mut done.level, 0..=crate::camera_ui::MAX_LEVEL).show_value(false),
+                            );
+                            // Enhance again once the slider is let go (or moved with the keys).
+                            again |= slider.drag_stopped() || (slider.changed() && !slider.dragged());
+                            if again && (done.look, done.level) != done.applied {
+                                view.pending_action = Some(ViewAction::CameraLevel);
+                            }
+                            ui.separator();
+                            let icon = |ui: &mut egui::Ui, name: &str, tip: &str| {
+                                let r = ui.add_enabled(allowed, egui::Button::image(crate::icons::image(name, 18.0, t.text)).frame(false));
+                                // Named for screen readers (and tests), not only on hover.
+                                r.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, allowed, tip));
+                                r.on_hover_text(tip).clicked()
+                            };
+                            if icon(ui, "rotate-ccw", tl!("Rotate counterclockwise")) {
+                                view.pending_action = Some(ViewAction::CameraRotate { clockwise: false });
+                            }
+                            if icon(ui, "rotate-cw", tl!("Rotate clockwise")) {
+                                view.pending_action = Some(ViewAction::CameraRotate { clockwise: true });
+                            }
+                            if crate::widgets::pill_button(ui, tl!("Crop pages"), false).clicked() {
+                                view.pending_action = Some(ViewAction::CameraNext("page.crop"));
+                            }
+                            if crate::widgets::pill_button(ui, tl!("Organize pages"), false).clicked() {
+                                view.pending_action = Some(ViewAction::CameraNext("page.organize"));
+                            }
+                            if crate::widgets::pill_button(ui, tl!("Done"), true).clicked() {
+                                view.pending_action = Some(ViewAction::CancelCamera);
+                            }
+                            return;
+                        }
+                        let ready = allowed && view.camera.is_some();
+                        if ui.add_enabled_ui(ready, |ui| crate::widgets::pill_button(ui, tl!("Enhance page"), true)).inner.clicked() {
+                            view.pending_action = Some(ViewAction::EnhanceCamera);
+                        }
+                        if crate::widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                            view.pending_action = Some(ViewAction::CancelCamera);
+                        }
+                    });
+                });
+        });
+}
diff --git a/crates/ui-egui/src/canvas.rs b/crates/ui-egui/src/canvas.rs
index bf66f873..eeb8e7b0 100644
--- a/crates/ui-egui/src/canvas.rs
+++ b/crates/ui-egui/src/canvas.rs
@@ -48,6 +48,10 @@ const RESULTS_PER_FRAME: usize = 8;
 const MAX_THUMB_DEMAND: usize = 256;
 /// At most this many whole-page rasters are cached beyond the ones on screen.
 const MAX_CACHED_PAGES: usize = 24;
+/// At most this many text layers are cached beyond visible, selected and matched pages.
+/// Text layers are glyph structs, far smaller than rasters; deliberately independent of
+/// `MAX_CACHED_PAGES` so raster tuning never silently retunes text memory.
+const MAX_CACHED_TEXT_PAGES: usize = 24;
 
 fn rgba_bytes(width: usize, height: usize) -> usize {
     width.saturating_mul(height).saturating_mul(4)
@@ -74,28 +78,28 @@ pub enum Fit {
     None,
 }
 
+/// The base page display: one page across, or a two-page spread. Whether it scrolls continuously
+/// is a separate flag (`continuous`), as in Acrobat, so every combination is reachable (#752).
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum PageLayout {
-    Continuous,
-    TwoUp,
     Single,
+    TwoUp,
 }
 
 impl PageLayout {
-    /// Every page display, in the order the View menu, the rail's Page display button and
+    /// The base page displays, in the order the View menu, the rail's Page display button and
     /// Preferences list them.
-    pub const ORDER: [Self; 3] = [Self::Continuous, Self::Single, Self::TwoUp];
+    pub const ORDER: [Self; 2] = [Self::Single, Self::TwoUp];
 
-    /// The name settings and view options use: `continuous`, `single` or `two-up`.
+    /// The name settings and view options use for the base layout: `single` or `two-up`.
     pub fn as_str(self) -> &'static str {
         match self {
-            Self::Continuous => "continuous",
             Self::Single => "single",
             Self::TwoUp => "two-up",
         }
     }
 
-    /// The layout an [`as_str`](Self::as_str) name stands for, in any case. `None` for
+    /// The base layout an [`as_str`](Self::as_str) name stands for, in any case. `None` for
     /// anything else, so callers can reject a typo rather than switch layouts silently.
     pub fn try_parse(value: &str) -> Option<Self> {
         Self::ORDER.into_iter().find(|l| l.as_str().eq_ignore_ascii_case(value.trim()))
@@ -104,22 +108,20 @@ impl PageLayout {
     /// Rail icon for this layout.
     pub fn icon(self) -> &'static str {
         match self {
-            Self::Continuous => "arrow-up-down",
             Self::Single => "file-text",
             Self::TwoUp => "columns-2",
         }
     }
 
-    /// Registry command that switches to this layout (`PdfCraftApp::execute`).
+    /// Registry command that switches to this base layout (`PdfCraftApp::execute`).
     pub fn command(self) -> &'static str {
         match self {
-            Self::Continuous => "view.layout.continuous",
             Self::Single => "view.layout.single",
             Self::TwoUp => "view.layout.two_up",
         }
     }
 
-    /// The layout a [`command`](Self::command) id switches to.
+    /// The base layout a [`command`](Self::command) id switches to.
     pub fn from_command(id: &str) -> Option<Self> {
         Self::ORDER.into_iter().find(|l| l.command() == id)
     }
@@ -127,18 +129,43 @@ impl PageLayout {
     /// Menu label: the label of [`command`](Self::command), which the catalogs translate.
     pub fn label(self) -> &'static str {
         match self {
-            Self::Continuous => "Continuous scrolling",
             Self::Single => "Single page",
             Self::TwoUp => "Two-page view",
         }
     }
 }
 
+/// The single page-display token settings and the control channel use, combining the base layout
+/// with continuous scrolling. `single` and `two-page` show one page or one spread at a time;
+/// `continuous` (Single, scrolling) and `two-up` (Two-page, scrolling) keep their earlier names
+/// for back-compat.
+pub fn display_token(layout: PageLayout, continuous: bool) -> &'static str {
+    match (layout, continuous) {
+        (PageLayout::Single, false) => "single",
+        (PageLayout::Single, true) => "continuous",
+        (PageLayout::TwoUp, true) => "two-up",
+        (PageLayout::TwoUp, false) => "two-page",
+    }
+}
+
+/// The base layout and continuous flag a [`display_token`] names, in any case. `None` for a typo.
+pub fn parse_display_token(value: &str) -> Option<(PageLayout, bool)> {
+    match value.trim().to_ascii_lowercase().as_str() {
+        "single" => Some((PageLayout::Single, false)),
+        "continuous" => Some((PageLayout::Single, true)),
+        "two-up" => Some((PageLayout::TwoUp, true)),
+        "two-page" | "two-up-single" => Some((PageLayout::TwoUp, false)),
+        _ => None,
+    }
+}
+
 /// How a newly opened document is shown (Preferences ▸ Documents and view). A PDF that asks
 /// for its own layout or zoom gets that instead.
 #[derive(Clone, Copy, Debug, PartialEq)]
 pub struct ViewDefaults {
     pub layout: PageLayout,
+    /// Whether the base layout scrolls continuously.
+    pub continuous: bool,
     /// [`Fit::Width`] or [`Fit::Page`], or [`Fit::None`] for a fixed `zoom`.
     pub fit: Fit,
     /// The zoom with [`Fit::None`] (1.0 = 100%).
@@ -150,7 +177,8 @@ pub struct ViewDefaults {
 
 impl Default for ViewDefaults {
     fn default() -> Self {
-        Self { layout: PageLayout::Continuous, fit: Fit::Width, zoom: 1.0, highlight_fields: false }
+        // Single page, scrolling continuously at fit width: the earlier "continuous" default.
+        Self { layout: PageLayout::Single, continuous: true, fit: Fit::Width, zoom: 1.0, highlight_fields: false }
     }
 }
 
@@ -263,6 +291,8 @@ pub struct DocView {
     pub zoom: f32,
     pub fit: Fit,
     pub layout: PageLayout,
+    /// Whether the base layout scrolls continuously (independent of `layout`, as in Acrobat).
+    pub continuous: bool,
     /// View rotation in degrees clockwise (0, 90, 180, 270); display only, never saved.
     pub rotation: u16,
     pub current: usize,
@@ -270,6 +300,9 @@ pub struct DocView {
     pub highlight_fields: bool,
     pub page_input: String,
     pub notice_dismissed: bool,
+    /// The file changed on disk while this document had unsaved changes: the notice bar asks
+    /// before replacing it (#431).
+    pub disk_changed: bool,
     /// Two-page view: show the first page alone, as a cover (View ▸ Page display).
     pub cover: bool,
     /// Previous view / Next view: pages visited before (and after, once going back).
@@ -305,6 +338,10 @@ pub struct DocView {
     frame_visible: HashSet<usize>,
     /// Thumbnails that are out of date (still shown until their replacement arrives).
     stale_thumbs: HashSet<usize>,
+    /// Tiles that are out of date (still shown until their replacement arrives).
+    stale_tiles: HashSet<(usize, u64, u32, u32)>,
+    /// Scale tag of the current zoom level, as last drawn.
+    current_scale_tag: u64,
     /// Print dialog: the current sheet's pages at the preview pane's device resolution.
     print_pages: HashMap<usize, (u64, TextureHandle)>,
     /// Sharp tiles of large pages: (page, scale tag, tile x, tile y) → texture. Tiles of an
@@ -317,6 +354,8 @@ pub struct DocView {
     selection: Option<Selection>,
     /// Clicks in the current run on the text layer: two select a word, three the line, four the page.
     clicks: u32,
+    last_press_time: f64,
+    last_press_pos: Option<Pos2>,
     last_queue: Vec<RenderRequest>,
     viewport_w: f32,
     viewport_h: f32,
@@ -328,7 +367,7 @@ pub struct DocView {
     screen_xforms: Vec<(usize, PageXform)>,
     /// The scroll viewport on screen last frame.
     viewport_screen: Rect,
-    /// Pending zoom anchor: page, position within it (0..1), and offset from the viewport corner.
+    /// Pending zoom anchor: page, fractional position (also in gutters), and viewport offset.
     zoom_anchor: Option<(usize, f32, f32, Vec2)>,
     /// The page view has been shown, so its scroll offset in egui's memory is this document's.
     shown: bool,
@@ -373,6 +412,11 @@ pub struct DocView {
     pub pending_redaction: Option<(usize, Vec<[f64; 8]>)>,
     /// A crop rectangle being dragged (Crop tool).
     pub crop_drag: crate::crop::CropDrag,
+    /// Enhance ▸ Camera image: the quadrilateral being placed.
+    pub camera: Option<crate::camera_ui::CameraQuad>,
+    /// Enhance ▸ Camera image: the page just enhanced, while the bar offers rotate, crop and
+    /// organize.
+    pub camera_done: Option<crate::camera_ui::CameraDone>,
     /// Use a certificate: a signature rectangle being drawn, or an empty signature field clicked.
     pub sign: crate::sign_ui::SignView,
     /// Organize: the pages being dragged to a new place.
@@ -446,6 +490,18 @@ pub enum ViewAction {
     },
     /// Paste copied pages after the selection.
     PastePages,
+    /// Enhance ▸ Camera image: straighten what the corners enclose.
+    EnhanceCamera,
+    /// Leave Enhance ▸ Camera image (Cancel before Enhance page, Done after it).
+    CancelCamera,
+    /// After Enhance page: turn the enhanced page a quarter.
+    CameraRotate {
+        clockwise: bool,
+    },
+    /// After Enhance page: enhance again at the slider's clean-up level.
+    CameraLevel,
+    /// After Enhance page: leave the tool for this command (Crop pages, Organize pages).
+    CameraNext(&'static str),
 }
 
 impl DocView {
@@ -497,12 +553,14 @@ impl DocView {
             zoom: defaults.zoom,
             fit: defaults.fit,
             layout: defaults.layout,
+            continuous: defaults.continuous,
             rotation: 0,
             current: 0,
             organize: false,
             highlight_fields: defaults.highlight_fields,
             page_input: "1".into(),
             notice_dismissed: false,
+            disk_changed: false,
             cover: false,
             back: Vec::new(),
             forward: Vec::new(),
@@ -520,6 +578,8 @@ impl DocView {
             frame_queue: Vec::new(),
             frame_visible: HashSet::new(),
             stale_thumbs: HashSet::new(),
+            stale_tiles: HashSet::new(),
+            current_scale_tag: 0,
             print_pages: HashMap::new(),
             tiles: HashMap::new(),
             texts: HashMap::new(),
@@ -527,6 +587,8 @@ impl DocView {
             find: None,
             selection: None,
             clicks: 0,
+            last_press_time: 0.0,
+            last_press_pos: None,
             last_queue: Vec::new(),
             viewport_w: 800.0,
             viewport_h: 600.0,
@@ -565,6 +627,8 @@ impl DocView {
             redact_drag: None,
             pending_redaction: None,
             crop_drag: None,
+            camera: None,
+            camera_done: None,
             sign: Default::default(),
             org_drag: None,
             panel_drag: None,
@@ -601,6 +665,38 @@ impl DocView {
         self.panel_drag = None;
     }
 
+    /// The document was replaced by a newer version of its file (#431). The reader's place
+    /// stays: zoom, layout, rotation, page, scroll, view history and the find bar, and the page
+    /// images on screen until their replacements are drawn, so nothing flashes. Everything that
+    /// pointed into the old version (a selected comment, a field being typed in, text being
+    /// edited, a drag, page selection) starts afresh, so no stale index reaches the new one.
+    pub fn document_replaced(&mut self, info: &DocInfo) {
+        let mut fresh = Self::new(self.id, info, ViewDefaults::default());
+        fresh.zoom = self.zoom;
+        fresh.fit = self.fit;
+        fresh.layout = self.layout;
+        fresh.rotation = self.rotation;
+        fresh.current = self.current;
+        fresh.organize = self.organize;
+        fresh.grid_zoom = self.grid_zoom;
+        // Same document id, so the scroll offset egui keeps for it is still this document's.
+        fresh.shown = self.shown;
+        fresh.highlight_fields = self.highlight_fields;
+        fresh.notice_dismissed = self.notice_dismissed;
+        fresh.cover = self.cover;
+        fresh.back = std::mem::take(&mut self.back);
+        fresh.forward = std::mem::take(&mut self.forward);
+        fresh.find = self.find.take();
+        fresh.pages = std::mem::take(&mut self.pages);
+        fresh.thumbs = std::mem::take(&mut self.thumbs);
+        fresh.viewport_w = self.viewport_w;
+        fresh.viewport_h = self.viewport_h;
+        fresh.viewport_screen = self.viewport_screen;
+        *self = fresh;
+        // Marks the kept images out of date and clamps the page to the new page count.
+        self.document_changed(info);
+    }
+
     /// Pages an organize command acts on: the selection, or the current page.
     pub fn target_pages(&self) -> Vec<usize> {
         if self.selected.is_empty() { vec![self.current] } else { self.selected.iter().copied().collect() }
@@ -663,6 +759,8 @@ impl DocView {
         // Pages may have moved: a sharp render of another page would be worse than a soft one.
         self.grid_pages.clear();
         self.tiles.clear();
+        self.stale_tiles.clear();
+        self.forms.unbaked.clear();
         self.texts.clear();
         self.text_failed.clear();
         self.errors.clear();
@@ -676,7 +774,7 @@ impl DocView {
     }
 
     /// Only `page` changed (a comment was added, edited or removed): re-render that page and
-    /// re-read its text, keep everything else.
+    /// re-read its text, keep everything else. Out-of-date tiles stay on screen until replacements arrive.
     pub fn page_changed(&mut self, page: usize) {
         if let Some(p) = self.pages.get_mut(&page) {
             p.tag = STALE_TAG;
@@ -687,7 +785,18 @@ impl DocView {
         if let Some(slot) = self.print_pages.get_mut(&page) {
             slot.0 = STALE_TAG;
         }
-        self.tiles.retain(|(p, _, _, _), _| *p != page);
+        let current_tag = if self.current_scale_tag != 0 {
+            self.current_scale_tag
+        } else {
+            self.tiles.keys().filter(|k| k.0 == page).map(|k| k.1).max().unwrap_or(0)
+        };
+        self.tiles.retain(|key, _| key.0 != page || key.1 == current_tag);
+        self.stale_tiles.retain(|key| key.0 != page || key.1 == current_tag);
+        for &key in self.tiles.keys() {
+            if key.0 == page && key.1 == current_tag {
+                self.stale_tiles.insert(key);
+            }
+        }
         self.texts.remove(&page);
         self.text_failed.remove(&page);
         self.errors.remove(&page);
@@ -934,8 +1043,8 @@ impl DocView {
                     (false, _) => first.saturating_sub(2),
                 }
             }
-            PageLayout::Continuous | PageLayout::Single if forward => c + 1,
-            PageLayout::Continuous | PageLayout::Single => c.saturating_sub(1),
+            PageLayout::Single if forward => c + 1,
+            PageLayout::Single => c.saturating_sub(1),
         };
         self.go_to_page(target);
     }
@@ -998,8 +1107,9 @@ impl DocView {
         self.goto = Some((self.current, 0.0));
     }
 
-    /// Switch the page display. A no-op when the layout is already current, so re-selecting
-    /// it never yanks a scrolled view back to the top.
+    /// Switch the base page display (Single or Two-page), leaving continuous scrolling as it is.
+    /// A no-op when the layout is already current, so re-selecting it never yanks a scrolled view
+    /// back to the top.
     pub fn set_layout(&mut self, layout: PageLayout) {
         if self.layout == layout {
             return;
@@ -1008,6 +1118,27 @@ impl DocView {
         self.goto = Some((self.current, 0.0));
     }
 
+    /// Whether the view scrolls continuously (as opposed to one page or spread at a time).
+    pub fn continuous(&self) -> bool {
+        self.continuous
+    }
+
+    /// Turn continuous scrolling on or off, keeping the current page in view. A no-op when it is
+    /// already in that state.
+    pub fn set_continuous(&mut self, continuous: bool) {
+        if self.continuous != continuous {
+            self.continuous = continuous;
+            self.goto = Some((self.current, 0.0));
+        }
+    }
+
+    /// Set the whole page display at once (the base layout and continuous scrolling together),
+    /// as the control channel and settings do through a single [`display_token`].
+    pub fn set_display(&mut self, layout: PageLayout, continuous: bool) {
+        self.set_layout(layout);
+        self.set_continuous(continuous);
+    }
+
     /// Set the cover page in two-page view. A no-op unless something changed.
     pub fn set_cover(&mut self, cover: bool) {
         if self.cover != cover {
@@ -1021,11 +1152,12 @@ impl DocView {
         self.layout == PageLayout::TwoUp
     }
 
-    /// One wheel event in single-page view (the rules are in `wheel_pager`): `dy` is its
-    /// vertical delta (negative scrolls down) and `now` is egui time. With `can_turn` false
-    /// the gesture is followed but the page stays. Returns whether the page turned.
+    /// One wheel event in a non-continuous view, where the wheel turns pages or spreads (the
+    /// rules are in `wheel_pager`): `dy` is its vertical delta (negative scrolls down) and `now`
+    /// is egui time. With `can_turn` false the gesture is followed but the page stays. Returns
+    /// whether the page turned.
     pub fn single_page_wheel(&mut self, unit: egui::MouseWheelUnit, dy: f32, phase: egui::TouchPhase, now: f64, can_turn: bool) -> bool {
-        if self.layout != PageLayout::Single {
+        if self.continuous {
             return false;
         }
         let Some(forward) = self.wheel.feed(unit, dy, phase, now, can_turn) else { return false };
@@ -1082,17 +1214,31 @@ impl DocView {
 
     /// Zoom keeping the centre of the view still.
     pub fn set_zoom(&mut self, zoom: f32) {
-        let centre = self.viewport_screen.center();
+        // CLI/view options can set zoom before the first layout. Rect::NOTHING has no
+        // finite centre yet, but an initial zoom still needs to leave the default fit mode.
+        let centre = if self.viewport_screen.is_positive() { self.viewport_screen.center() } else { Pos2::ZERO };
         self.zoom_at(zoom, centre);
     }
 
     /// Zoom keeping the document point under `screen_pos` still (pinch, ⌘-scroll).
     pub fn zoom_at(&mut self, zoom: f32, screen_pos: Pos2) {
-        let anchor = self.screen_rects.iter().find(|(_, r)| r.expand(GAP).contains(screen_pos)).map(|(p, r)| {
-            let f = (screen_pos - r.min) / r.size();
-            (*p, f.x.clamp(0.0, 1.0), f.y.clamp(0.0, 1.0), screen_pos - self.viewport_screen.min)
-        });
-        self.zoom = zoom.clamp(0.08, 64.0);
+        if !zoom.is_finite() || !screen_pos.is_finite() {
+            return;
+        }
+        let zoom = zoom.clamp(0.08, 64.0);
+        if zoom == self.zoom && self.fit == Fit::None {
+            return;
+        }
+        // In gutters/gaps, anchor relative to the nearest page rather than jumping to its top.
+        // Fractions outside 0..1 preserve the pointer's position outside the page as well.
+        let anchor =
+            self.screen_rects.iter().min_by(|(_, a), (_, b)| a.distance_sq_to_pos(screen_pos).total_cmp(&b.distance_sq_to_pos(screen_pos))).map(
+                |(p, r)| {
+                    let f = (screen_pos - r.min) / r.size();
+                    (*p, f.x, f.y, screen_pos - self.viewport_screen.min)
+                },
+            );
+        self.zoom = zoom;
         self.fit = Fit::None;
         match anchor {
             Some(a) => self.zoom_anchor = Some(a),
@@ -1142,6 +1288,7 @@ impl DocView {
         self.grid_pages.clear();
         self.print_pages.clear();
         self.stale_thumbs.clear();
+        self.stale_tiles.clear();
         self.waiting_since.clear();
         // Signature previews own a separate renderer and image/background textures.
         self.signature_drag = Default::default();
@@ -1209,7 +1356,7 @@ impl DocView {
                 }
                 tile_bytes = tile_bytes.saturating_add(bytes);
                 tile_tags.insert(req.tag);
-                if !self.tiles.contains_key(&key) {
+                if !self.tiles.contains_key(&key) || self.stale_tiles.contains(&key) {
                     queue.push(*req);
                 }
             } else {
@@ -1240,7 +1387,23 @@ impl DocView {
         // Tiles of an earlier zoom (not a demanded scale) stay while the canvas keeps them, a
         // bounded few under a page whose current tiles are still missing (OLD_TILES).
         self.tiles.retain(|key, _| tiles.contains(key) || !tile_tags.contains(&key.1));
+        self.stale_tiles.retain(|key| self.tiles.contains_key(key));
         queue.extend(grid);
+        // Opening (or turning to) a page queues its pixels alongside thumbnails and
+        // text extraction. The workers would otherwise spend the first seconds on
+        // thumbnails and search text while the visible page stays blank: hold those
+        // until no visible main-page raster is still missing. Errored pages never
+        // block: they are never re-requested.
+        let visible_mains_pending = queue.iter().any(|r| {
+            r.kind == RequestKind::Pixels
+                && r.tag & (GRID_TAG | PRINT_TAG | THUMB_TAG | TEXT_TAG) == 0
+                && self.frame_visible.contains(&r.page)
+                && !self.errors.contains_key(&r.page)
+        });
+        if visible_mains_pending {
+            // Caches are kept; demand is re-evaluated next frame once pixels arrive.
+            return queue;
+        }
         let thumbs = self.thumbnail_requests(info, ppp);
         let mut thumb_bytes = 0usize;
         let mut admitted = HashSet::new();
@@ -1258,11 +1421,39 @@ impl DocView {
         }
         self.thumbs.retain(|p, _| admitted.contains(p));
         self.stale_thumbs.retain(|p| admitted.contains(p));
+        self.retain_text_layers();
         // Visible main pages and thumbnails take precedence over background search work.
         queue.extend(requests.into_iter().filter(|r| r.kind == RequestKind::Text));
         queue
     }
 
+    /// Drop text layers nothing can still need. Every visited page's text used to stay
+    /// cached for the session. Keep visible, selected and matched pages plus the nearest
+    /// prefetch window; evicted pages re-extract on revisit. (Count window only: unlike
+    /// rasters there is no byte budget here.) While a search is active keep everything:
+    /// demand still wants every page, so evicting would re-request evicted pages each
+    /// frame and churn the workers. Failures are never evicted either: they cost nothing
+    /// to remember, and evicting one would re-request and re-fail it every frame.
+    fn retain_text_layers(&mut self) {
+        if self.texts.len() <= MAX_CACHED_TEXT_PAGES {
+            return;
+        }
+        if self.find.as_ref().is_some_and(|f| !f.case_query.trim().is_empty()) {
+            return;
+        }
+        let mut keep: HashSet<usize> = self.frame_visible.clone();
+        if let Some(s) = self.selection {
+            keep.insert(s.page);
+        }
+        if let Some(f) = self.find.as_ref() {
+            keep.extend(f.matches.iter().map(|(p, _)| *p));
+        }
+        let mut rest: Vec<usize> = self.texts.keys().filter(|p| !keep.contains(*p)).copied().collect();
+        rest.sort_by_key(|p| p.abs_diff(self.current));
+        keep.extend(rest.into_iter().take(MAX_CACHED_TEXT_PAGES));
+        self.texts.retain(|p, _| keep.contains(p));
+    }
+
     pub(crate) fn finish_render_frame(&mut self, ctx: &egui::Context, info: &DocInfo, pool: &RenderPool) {
         let queue = self.prepare_render_queue(info, ctx.pixels_per_point());
         if queue != self.last_queue {
@@ -1327,8 +1518,13 @@ impl DocView {
         // The length was checked above, so the renderer's buffer becomes the texture data as is.
         let img = texture_image([r.width as usize, r.height as usize], r.rgba);
         if let Some(t) = r.request.tile {
+            let key = (page, r.request.tag, t.x / TILE, t.y / TILE);
             let tex = ctx.load_texture(format!("tile-{:?}-{page}-{}-{}", self.id, t.x, t.y), img, TextureOptions::LINEAR);
-            self.tiles.insert((page, r.request.tag, t.x / TILE, t.y / TILE), tex);
+            self.tiles.insert(key, tex);
+            self.stale_tiles.remove(&key);
+            if !self.stale_tiles.iter().any(|k| k.0 == page) {
+                self.forms.unbaked.retain(|(_, p)| *p != page);
+            }
         } else if r.request.tag & PRINT_TAG != 0 {
             let tex = ctx.load_texture(format!("print-{:?}-{page}", self.id), img, TextureOptions::LINEAR);
             self.print_pages.insert(page, (r.request.tag, tex));
@@ -1344,6 +1540,9 @@ impl DocView {
             self.pages.insert(page, PageTex { tag: r.request.tag, tex });
             self.signature_drag.page_received(page);
             self.waiting_since.remove(&page);
+            if !self.stale_tiles.iter().any(|k| k.0 == page) {
+                self.forms.unbaked.retain(|(_, p)| *p != page);
+            }
         }
         bytes
     }
@@ -1385,11 +1584,13 @@ impl DocView {
     fn fit_zoom(&mut self, info: &DocInfo) {
         let largest = |side: fn((f32, f32)) -> f32| info.pages.iter().map(|p| side(self.display_size(p))).fold(1.0, f32::max);
         let max_w = largest(|s| s.0);
-        // Single-page view fits the page it shows. The scrolling views fit their largest page,
-        // so the zoom holds still while pages of other sizes scroll past.
-        let (w, h) = match self.layout {
-            PageLayout::Single => info.pages.get(self.current).map_or_else(|| (max_w, largest(|s| s.1)), |p| self.display_size(p)),
-            PageLayout::Continuous | PageLayout::TwoUp => (max_w, largest(|s| s.1)),
+        // A single page shown on its own fits that page. Every other display (scrolling, or a
+        // two-page spread) fits its largest page, so the zoom holds still while pages of other
+        // sizes scroll or page past.
+        let (w, h) = if self.layout == PageLayout::Single && !self.continuous {
+            info.pages.get(self.current).map_or_else(|| (max_w, largest(|s| s.1)), |p| self.display_size(p))
+        } else {
+            (max_w, largest(|s| s.1))
         };
         let avail_w = (self.viewport_w - 2.0 * SIDE).max(100.0);
         let per_row = if self.layout == PageLayout::TwoUp { 2.0 } else { 1.0 };
@@ -1409,7 +1610,7 @@ impl DocView {
     /// Width of the scroll content. Single-page view sizes it to the page it shows, so a
     /// wider page elsewhere in the document can't push the shown one off-centre.
     fn content_width(&self, info: &DocInfo, avail_w: f32) -> f32 {
-        let single = (self.layout == PageLayout::Single).then(|| self.current.min(info.pages.len().saturating_sub(1)));
+        let single = (self.layout == PageLayout::Single && !self.continuous).then(|| self.current.min(info.pages.len().saturating_sub(1)));
         let shown = info.pages.iter().enumerate().filter(|&(i, _)| single.is_none_or(|c| c == i));
         let max_w = shown.map(|(_, p)| self.display_size(p).0).fold(0.0, f32::max);
         let per_row = if self.layout == PageLayout::TwoUp { 2.0 } else { 1.0 };
@@ -1422,7 +1623,7 @@ impl DocView {
         let mut rects = Vec::with_capacity(info.pages.len());
         let mut y = MARGIN;
         match self.layout {
-            PageLayout::Continuous | PageLayout::Single => {
+            PageLayout::Single => {
                 for p in &info.pages {
                     let (w, h) = self.display_size(p);
                     let size = vec2(w * s, h * s);
@@ -1670,14 +1871,11 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context) {
     if pressed(cmd(Key::CloseBracket)) {
         view.view_history(true);
     }
-    // ⌘C arrives as a Copy event on most platforms.
-    let copy = ctx.input(|i| i.events.iter().any(|e| matches!(e, egui::Event::Copy)));
-    if copy && let Some(text) = view.selected_text() {
-        ctx.copy_text(text);
-    }
     let key = |k| ctx.input(|i| i.key_pressed(k));
     if key(Key::Escape) {
-        if view.selection.is_some() {
+        if view.camera.is_some() || view.camera_done.is_some() {
+            view.pending_action = Some(ViewAction::CancelCamera);
+        } else if view.selection.is_some() {
             view.selection = None;
         } else {
             view.find = None;
@@ -1692,7 +1890,7 @@ pub fn shortcuts(view: &mut DocView, ctx: &egui::Context) {
     // As in Acrobat: → / ← go to the next / previous page in every layout (#185), and so do
     // ⌘Page Down / ⌘Page Up, or plain Page Down / Page Up in single-page view.
     let command = ctx.input(|i| i.modifiers.command);
-    let scrolls = view.layout != PageLayout::Single;
+    let scrolls = view.continuous;
     if key(Key::ArrowRight) || (key(Key::PageDown) && (command || !scrolls)) {
         view.step_page(true);
     }
@@ -1767,8 +1965,13 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let secured = doc.security_summary().is_some_and(|s| !(s.owner || (s.permissions.modify() && s.permissions.assemble())));
     let repaired = !doc.repair_log().is_empty();
     match notices(view, doc, secured, repaired, crate::sign_ui::banner(&doc.signatures), ui, &t) {
+        #[cfg(not(target_arch = "wasm32"))]
+        Some(Notice::Reload) => app.watch.reload_request = Some(view.id),
+        #[cfg(target_arch = "wasm32")]
+        Some(Notice::Reload) => {}
         Some(Notice::Repairs) => app.dialog = Some(crate::Dialog::Properties(crate::PropsTab::Advanced)),
         Some(Notice::Security) => app.dialog = Some(crate::Dialog::Properties(crate::PropsTab::Security)),
+        Some(Notice::Unlock) => app.unlock_prompt = Some(crate::UnlockPrompt::new(doc, None)),
         Some(Notice::Signatures) => app.right = Some(RightPanel::Signatures),
         Some(Notice::FieldHighlights(on)) => app.view_defaults.highlight_fields = on,
         None => {}
@@ -1784,11 +1987,34 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let avail = ui.available_rect_before_wrap();
     view.viewport_w = avail.width();
     view.viewport_h = avail.height();
+    let old_zoom = view.zoom;
     view.fit_zoom(info);
+    if view.shown && view.zoom_anchor.is_none() && view.goto.is_none() && view.goto_point.is_none() && (view.zoom - old_zoom).abs() > 1e-4 {
+        let prev_viewport = view.viewport_screen;
+        let top_y = prev_viewport.min.y;
+        let anchor = view
+            .screen_rects
+            .iter()
+            .find(|(_, r)| r.min.y <= top_y && r.max.y > top_y)
+            .map(|(p, r)| {
+                let fy = if r.height() > 0.0 { ((top_y - r.min.y) / r.height()).clamp(0.0, 1.0) } else { 0.0 };
+                (*p, fy, 0.0f32)
+            })
+            .or_else(|| view.screen_rects.iter().find(|(_, r)| r.min.y >= top_y).map(|(p, r)| (*p, 0.0f32, (r.min.y - top_y).max(0.0))))
+            .or_else(|| view.screen_rects.last().map(|(p, r)| (*p, 1.0f32, (r.max.y - top_y).max(0.0))));
+        if let Some((page, fy, rel_y)) = anchor {
+            view.zoom_anchor = Some((page, 0.5, fy, vec2(avail.width() / 2.0, rel_y)));
+        } else {
+            view.zoom_anchor = Some((view.current, 0.5, 0.0, vec2(avail.width() / 2.0, MARGIN)));
+        }
+    }
 
     // Pinch / ctrl+scroll zoom, anchored on the current page.
     let zoom_delta = ui.input(|i| i.zoom_delta());
-    if (zoom_delta - 1.0).abs() > 0.001 && ui.rect_contains_pointer(avail) {
+    // Exclude the previous frame's scrollbar tracks from gesture activation.
+    let navigation_rect = if view.viewport_screen.is_positive() { avail.intersect(view.viewport_screen) } else { avail };
+    let navigation_enabled = app.dialog.is_none() && app.close_request.is_none() && !app.palette_open && ui.is_enabled() && ui.input(|i| i.focused);
+    if zoom_delta.is_finite() && zoom_delta > 0.0 && zoom_delta != 1.0 && navigation_enabled && ui.rect_contains_pointer(navigation_rect) {
         let z = view.zoom * zoom_delta;
         match ui.input(|i| i.pointer.hover_pos()) {
             Some(p) => view.zoom_at(z, p),
@@ -1805,15 +2031,34 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
 
     let content_w = view.content_width(info, avail.width());
     let rects = view.layout(info, content_w);
+    // When not scrolling continuously, only one row is shown at a time: the current page, or the
+    // current two-page spread (with the cover rule). These indices drive paging, which pages are
+    // drawn, and the content height (#752). Empty for a document with no pages.
+    let row: Vec<usize> = if rects.is_empty() {
+        Vec::new()
+    } else {
+        let last = rects.len() - 1;
+        let cur = view.current.min(last);
+        match view.layout {
+            PageLayout::Single => vec![cur],
+            PageLayout::TwoUp if view.cover && cur == 0 => vec![0],
+            PageLayout::TwoUp => {
+                let first = if view.cover { cur - (cur + 1) % 2 } else { cur - cur % 2 };
+                if first < last { vec![first, first + 1] } else { vec![first] }
+            }
+        }
+    };
     let middle_gesture = view.auto_scroll.blocks_input();
-    // Single page: when the whole page fits, the wheel would do nothing, so it turns pages
-    // instead; zoomed in far enough to pan, it pans. Touch drags are untouched: with nothing
-    // to pan, touch users turn pages with the rail buttons, the page box and the arrow keys.
-    // Runs before `visible_pages` so the frame that turns the page draws it.
+    // Not scrolling: when the whole page or spread fits, the wheel would do nothing, so it turns
+    // pages instead; zoomed in far enough to pan, it pans. Touch drags are untouched: with
+    // nothing to pan, touch users turn pages with the rail buttons, the page box and the arrow
+    // keys. Runs before `visible_pages` so the frame that turns the page draws it.
     let mut single_paging = false;
-    if view.layout == PageLayout::Single {
+    if !view.continuous {
+        // The row's bounding box on screen (one page, or a two-page spread).
+        let row_rect = row.iter().filter_map(|&i| rects.get(i)).copied().reduce(Rect::union);
         // Within a point, so layout rounding can't stop a fitting page from turning.
-        let fits = rects.get(view.current.min(rects.len().saturating_sub(1))).is_some_and(|r| r.height() + 2.0 * MARGIN <= avail.height() + 1.0);
+        let fits = row_rect.is_some_and(|r| r.height() + 2.0 * MARGIN <= avail.height() + 1.0);
         let can_turn = fits && !middle_gesture && unobstructed && ui.rect_contains_pointer(avail);
         single_paging = can_turn;
         // Every wheel event goes to the pager, so it follows each trackpad touch to its end
@@ -1873,16 +2118,15 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     } else {
         precise_scroll = Vec2::ZERO;
     }
-    let visible_pages: Vec<usize> = match view.layout {
-        PageLayout::Single => vec![view.current.min(rects.len() - 1)],
-        _ => (0..rects.len()).collect(),
-    };
-    let (y_shift, content_h) = match view.layout {
-        PageLayout::Single => {
-            let r = rects[visible_pages[0]];
-            (r.top() - MARGIN, r.height() + 2.0 * MARGIN)
+    let visible_pages: Vec<usize> = if view.continuous { (0..rects.len()).collect() } else { row.clone() };
+    let (y_shift, content_h) = if view.continuous {
+        (0.0, rects.last().map(|r| r.bottom() + MARGIN).unwrap_or(0.0))
+    } else {
+        // Only the current row scrolls into view; the content is its bounding box plus margins.
+        match row.iter().filter_map(|&i| rects.get(i)).copied().reduce(Rect::union) {
+            Some(r) => (r.top() - MARGIN, r.height() + 2.0 * MARGIN),
+            None => (0.0, 0.0),
         }
-        _ => (0.0, rects.last().map(|r| r.bottom() + MARGIN).unwrap_or(0.0)),
     };
 
     let mut scroll = egui::ScrollArea::both().auto_shrink([false, false]).scroll_source(egui::scroll_area::ScrollSource {
@@ -1915,6 +2159,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     let ppp = ui.ctx().pixels_per_point();
     let scale = view.render_scale(ppp);
     let tag = scale_tag(scale);
+    view.current_scale_tag = tag;
     let hand = app.quick_tool == QuickTool::Hand;
     let tool = app.quick_tool;
     // Text selection runs for the Select tool and for the markup tools (highlight…).
@@ -1925,6 +2170,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         QuickTool::Hand
         | QuickTool::Measure(_)
         | QuickTool::Crop
+        | QuickTool::EnhanceCamera
         | QuickTool::Fill(_)
         | QuickTool::Field(_)
         | QuickTool::AddText
@@ -1937,6 +2183,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         | QuickTool::Snapshot => false,
     };
     let prefs = &app.comment_prefs;
+    let units = app.units;
     let allowed = doc.allows_annotation();
     let comments_hidden = doc.comments_hidden();
     let form = doc.form.clone();
@@ -1960,6 +2207,14 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
     };
     let mut open_signature = false;
     let mut hover_text: Option<(Pos2, String)> = None;
+    // A dialog, save prompt or palette covers the page. Hover tips are drawn above those
+    // windows, so a comment under the pointer would otherwise float over the dialog.
+    let page_covered = app.dialog.is_some()
+        || app.close_request.is_some()
+        || app.palette_open
+        || app.password_prompt.is_some()
+        || app.pending_link.is_some()
+        || app.updates.open;
     let mut clicked_link: Option<LinkTarget> = None;
     let mut canvas_action: Option<comments::CanvasAction> = None;
     let mut field_menu: Option<FieldMenu> = None;
@@ -2105,7 +2360,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                         let now = ui.input(|inp| inp.time);
                         let since = *view.waiting_since.entry(i).or_insert(now);
                         let msg = if now - since > 6.0 { "Still rendering — this page is unusually complex…" } else { "Rendering…" };
-                        painter.text(r.center(), Align2::CENTER_CENTER, msg, theme::regular(12.0), t.text_faint);
+                        painter.text(r.center(), Align2::CENTER_CENTER, tl!(msg), theme::regular(12.0), t.text_faint);
                     }
                 }
                 if tiled && r.intersects(visible) {
@@ -2162,7 +2417,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             // Comments: tools, selection, moving and resizing come before text selection.
             let pcx = comments::PageCx { page: i, xf: &xf, info, tool, prefs, allowed, hidden: comments_hidden };
             if let QuickTool::Measure(measure_tool) = tool {
-                crate::measure_ui::page_input(ui, &resp, doc, view, &pcx, measure_tool);
+                crate::measure_ui::page_input(ui, &resp, doc, view, &pcx, measure_tool, units);
             }
 
             // Form fields take clicks first with the Select tool (as Acrobat fills fields in
@@ -2247,6 +2502,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             if matches!(tool, QuickTool::MarqueeZoom | QuickTool::Snapshot) {
                 crate::zoom_snap::page_input(ui, &resp, &xf, i, view);
             }
+            if tool == QuickTool::EnhanceCamera {
+                crate::camera_ui::page_input(ui, &resp, &xf, i, view, can_modify);
+            }
             if tool == QuickTool::Crop && crate::crop::page_input(ui, &resp, &xf, i, info, view, can_crop) {
                 view.current = i;
                 open_boxes = true;
@@ -2357,14 +2615,40 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                         ui.ctx().set_cursor_icon(egui::CursorIcon::Text);
                     }
                     let press_here = ui.input(|inp| inp.pointer.press_origin()).is_some_and(|o| r.contains(o));
+                    let pressed = ui.input(|inp| inp.pointer.primary_pressed());
+                    if pressed && press_here && !over_link {
+                        let now = ui.input(|inp| inp.time);
+                        // The same limits egui uses to count clicks on release.
+                        let (max_delay, max_dist) = ui.ctx().options(|o| (o.input_options.max_double_click_delay, o.input_options.max_click_dist));
+                        let is_consecutive =
+                            now - view.last_press_time <= max_delay && view.last_press_pos.is_some_and(|pos| pos.distance(p) <= max_dist);
+                        view.clicks = if is_consecutive { view.clicks.saturating_add(1) } else { 1 };
+                        view.last_press_time = now;
+                        view.last_press_pos = Some(p);
+
+                        // Multi-click highlights immediately on pointer press instead of release (#1024).
+                        let clicks = if view.clicks > 2 && tool != QuickTool::Select { 1 } else { view.clicks };
+                        if clicks >= 2 && over_text {
+                            let span = text.nearest(vx, vy).and_then(|a| match clicks {
+                                2 => text.word_at(a),
+                                3 => text.line_at(a),
+                                _ => text.glyphs.len().checked_sub(1).map(|last| (0, last)),
+                            });
+                            if let Some((first, last)) = span {
+                                view.selection = Some(Selection::run(i, first, last));
+                            }
+                        }
+                    }
                     if resp.drag_started() && press_here && !over_link {
                         let origin = ui.input(|inp| inp.pointer.press_origin()).unwrap_or(p);
                         let (ox, oy) = xf.screen_to_view(origin);
-                        view.selection = if column {
-                            Some(Selection { page: i, span: Span::Column { rect: [ox, oy, vx, vy] } })
-                        } else {
-                            text.nearest(ox, oy).map(|a| Selection::run(i, a, a))
-                        };
+                        if view.clicks < 2 {
+                            view.selection = if column {
+                                Some(Selection { page: i, span: Span::Column { rect: [ox, oy, vx, vy] } })
+                            } else {
+                                text.nearest(ox, oy).map(|a| Selection::run(i, a, a))
+                            };
+                        }
                     }
                     if resp.dragged()
                         && let Some(sel) = view.selection.as_mut().filter(|s| s.page == i)
@@ -2388,29 +2672,30 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                         view.selection = None;
                     }
                     // Quick clicks widen the selection: two a word, three the line, four the page.
-                    // egui counts up to three, so four come from the run kept here. The markup and
-                    // Redact tools mark a double-clicked word at once, so they stop at the word.
-                    let clicks = if resp.triple_clicked() {
+                    // Release-based fallback for platforms or synthetic events that report double_clicked.
+                    let release_clicks = if resp.triple_clicked() {
                         view.clicks.max(2).saturating_add(1)
                     } else if resp.double_clicked() {
-                        2
+                        view.clicks.max(2)
                     } else {
-                        u32::from(resp.clicked())
+                        0
                     };
-                    if clicks > 0 {
-                        view.clicks = clicks;
+                    if release_clicks > 0 {
+                        view.clicks = release_clicks;
                     }
-                    let clicks = if clicks > 2 && tool != QuickTool::Select { 1 } else { clicks };
-                    if clicks >= 2 && over_text {
-                        let span = text.nearest(vx, vy).and_then(|a| match clicks {
-                            2 => text.word_at(a),
-                            3 => text.line_at(a),
-                            _ => text.glyphs.len().checked_sub(1).map(|last| (0, last)),
-                        });
-                        if let Some((first, last)) = span {
-                            view.selection = Some(Selection::run(i, first, last));
+                    let clicks = if view.clicks > 2 && tool != QuickTool::Select { 1 } else { view.clicks };
+                    if release_clicks > 0 && clicks >= 2 && over_text {
+                        if view.selection.is_none() {
+                            let span = text.nearest(vx, vy).and_then(|a| match clicks {
+                                2 => text.word_at(a),
+                                3 => text.line_at(a),
+                                _ => text.glyphs.len().checked_sub(1).map(|last| (0, last)),
+                            });
+                            if let Some((first, last)) = span {
+                                view.selection = Some(Selection::run(i, first, last));
+                            }
                         }
-                    } else if resp.clicked() && !over_link {
+                    } else if resp.clicked() && view.clicks < 2 && !over_link {
                         // ⇧-click extends a selection on this page to the click, keeping its
                         // anchor (#527). Otherwise (no shift, no selection on this page, or a
                         // column selection, which has no anchor glyph; a selection cannot yet
@@ -2438,6 +2723,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
             if tool == QuickTool::EditText {
                 crate::object_ui::paint(painter, &xf, i, info, &view.objects);
             }
+            if tool == QuickTool::EnhanceCamera {
+                crate::camera_ui::paint(painter, &xf, i, view);
+            }
             if tool == QuickTool::Link {
                 crate::link_ui::paint(ui, painter, &xf, i, info, &doc_links, view);
             }
@@ -2471,7 +2759,8 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
                 }
             }
             // Fill & Sign keeps its placement cursor clear of link/comment hover feedback.
-            if !matches!(tool, QuickTool::Fill(_))
+            if !page_covered
+                && !matches!(tool, QuickTool::Fill(_))
                 && let Some(p) = pointer
             {
                 for l in info.links.iter().filter(|l| l.page == i) {
@@ -2541,7 +2830,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         if current_overlap >= best_overlap - TIE || current_overlap >= current_height - TIE {
             current = view.current;
         }
-        if view.layout != PageLayout::Single {
+        if view.continuous {
             view.current = current;
             if !ui.memory(|m| m.has_focus(egui::Id::new("page-input"))) {
                 view.page_input = (current + 1).to_string();
@@ -2600,7 +2889,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         });
         (wanted, visible_now)
     });
-    view.single_edges = visible_pages.first().copied().filter(|_| view.layout == PageLayout::Single).map(|page| {
+    view.single_edges = visible_pages.first().copied().filter(|_| !view.continuous).map(|page| {
         // At the top once the page's top edge shows where going to a page puts it (a gap
         // below the window's top). Within a point, as for wheel paging, so layout rounding
         // can't hide an edge.
@@ -2608,6 +2897,7 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         (page, out.state.offset.y <= MARGIN - GAP + 1.0, out.state.offset.y >= max_y - 1.0)
     });
 
+    view.viewport_screen = out.inner_rect;
     view.auto_scroll.paint(ui, avail);
 
     // Collect all main-page demand, including cached surfaces, for byte admission later.
@@ -2649,6 +2939,9 @@ pub fn document_area(app: &mut PdfCraftApp, index: usize, ui: &mut egui::Ui) {
         });
     }
     find_bar(view, info.pages.len(), avail, ui, &t);
+    if tool == QuickTool::EnhanceCamera {
+        crate::camera_ui::bar(ui.ctx(), view, avail, &t, can_modify);
+    }
     if let Some(e) = comments::composer(ui.ctx(), view, info, prefs) {
         view.pending_edit = Some(e);
     }
@@ -3004,11 +3297,15 @@ enum FieldMenu {
 
 /// What the notice bar's buttons ask for.
 enum Notice {
+    /// Reload the file that changed on disk, dropping unsaved changes.
+    Reload,
     Security,
     Signatures,
     Repairs,
     /// Highlight fields was turned on or off.
     FieldHighlights(bool),
+    /// Unlock… (enter the permissions password).
+    Unlock,
 }
 
 /// The notice bar above the pages: the signature status first (Acrobat's signature bar), then
@@ -3024,6 +3321,27 @@ fn notices(
 ) -> Option<Notice> {
     let info = &doc.info;
     let xfa = doc.xfa.as_ref();
+    // The file changed on disk while this document has unsaved changes (#431): ask before
+    // replacing it, ahead of every other notice.
+    if view.disk_changed {
+        let mut reload = false;
+        egui::Frame::NONE.fill(t.accent_soft).inner_margin(egui::Margin::symmetric(14, 7)).show(ui, |ui| {
+            ui.horizontal(|ui| {
+                ui.add(icons::image("rotate-cw", 16.0, t.accent_text));
+                ui.label(
+                    egui::RichText::new(tl!("This file changed on disk. Reload it to see the new version; your unsaved changes will be lost."))
+                        .color(t.text),
+                );
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if icons::button(ui, "x", 22.0, false, tl!("Dismiss")).clicked() {
+                        view.disk_changed = false;
+                    }
+                    reload = crate::widgets::pill_button(ui, tl!("Reload"), false).clicked();
+                });
+            });
+        });
+        return reload.then_some(Notice::Reload);
+    }
     if let Some((icon, color, template, arg)) = signed {
         let mut open = false;
         notice_bar(ui, t, icon, color, crate::i18n::fmt(tl!(template), &[("by", &arg)]), |ui| {
@@ -3037,6 +3355,7 @@ fn notices(
         return None;
     }
     let mut open_security = false;
+    let mut unlock = false;
     let mut open_repairs = false;
     let mut toggled = None;
     let msg = if secured {
@@ -3094,6 +3413,9 @@ fn notices(
         if secured && crate::widgets::pill_button(ui, tl!("Security settings"), false).clicked() {
             open_security = true;
         }
+        if secured && doc.can_unlock() && crate::widgets::pill_button(ui, tl!("Unlock…"), true).clicked() {
+            unlock = true;
+        }
         if repaired && !secured && info.fields.is_empty() && crate::widgets::pill_button(ui, tl!("Details"), false).clicked() {
             open_repairs = true;
         }
@@ -3101,6 +3423,9 @@ fn notices(
     if open_repairs {
         return Some(Notice::Repairs);
     }
+    if unlock {
+        return Some(Notice::Unlock);
+    }
     open_security.then_some(Notice::Security).or(toggled)
 }
 
@@ -3181,12 +3506,14 @@ fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
                                         ui.painter().rect_filled(row, CornerRadius::same(4), t.hover);
                                     }
                                     icons::paint(ui, Rect::from_min_size(row.min + vec2(8.0, 6.0), vec2(16.0, 16.0)), tool.icon(), 16.0, t.text);
-                                    ui.painter().text(
+                                    let reserve = if on { 28.0 } else { 8.0 };
+                                    crate::widgets::paint_left(
+                                        ui,
                                         row.left_center() + vec2(34.0, 0.0),
-                                        Align2::LEFT_CENTER,
                                         tl!(tool.label()),
                                         theme::regular(13.0),
                                         t.text,
+                                        (row.width() - 34.0 - reserve).max(0.0),
                                     );
                                     if on {
                                         icons::paint(
@@ -3246,12 +3573,14 @@ fn quick_bar(app: &mut PdfCraftApp, area: Rect, ui: &mut egui::Ui) {
                                     ui.painter().rect_filled(row, CornerRadius::same(4), t.hover);
                                 }
                                 icons::paint(ui, Rect::from_min_size(row.min + vec2(8.0, 6.0), vec2(16.0, 16.0)), tool.icon(), 16.0, t.text);
-                                ui.painter().text(
+                                let reserve = if on { 28.0 } else { 8.0 };
+                                crate::widgets::paint_left(
+                                    ui,
                                     row.left_center() + vec2(34.0, 0.0),
-                                    Align2::LEFT_CENTER,
                                     tl!(tool.label()),
                                     theme::regular(13.0),
                                     t.text,
+                                    (row.width() - 34.0 - reserve).max(0.0),
                                 );
                                 if on {
                                     icons::paint(
@@ -3301,10 +3630,10 @@ fn organize_toolbar(view: &mut DocView, info: &DocInfo, editable: bool, dirty: b
             // Fixed width so the buttons never shift as the selection text changes.
             ui.add_sized([150.0, 30.0], egui::Label::new(egui::RichText::new(label).font(theme::medium(13.0)).color(t.text_muted)).truncate());
             ui.add_enabled_ui(editable, |ui| {
-                if icons::button(ui, "rotate-ccw", 30.0, false, "Rotate counterclockwise").clicked() {
+                if icons::button(ui, "rotate-ccw", 30.0, false, tl!("Rotate counterclockwise")).clicked() {
                     view.pending_edit = Some(Edit::RotatePages { pages: targets.clone(), degrees: -90 });
                 }
-                if icons::button(ui, "rotate-cw", 30.0, false, "Rotate clockwise").clicked() {
+                if icons::button(ui, "rotate-cw", 30.0, false, tl!("Rotate clockwise")).clicked() {
                     view.pending_edit = Some(Edit::RotatePages { pages: targets.clone(), degrees: 90 });
                 }
                 let can_delete = targets.len() < n;
@@ -3448,7 +3777,7 @@ fn gap_button(ui: &mut egui::Ui, gap: usize, at: Pos2, height: f32, label: Strin
 fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool, unobstructed: bool, ui: &mut egui::Ui, t: &Tokens) {
     let ppp = ui.ctx().pixels_per_point();
     // The page image scales with the zoom; the padding and the page number don't.
-    let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 56.0);
+    let cell = vec2(146.0 * view.grid_zoom + 44.0, 194.0 * view.grid_zoom + 88.0);
     let anchor = view.grid_anchor.take();
     let mut open_page = None;
     organize_toolbar(view, info, editable, dirty, unobstructed, ui, t);
@@ -3506,10 +3835,10 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
                 if resp.drag_stopped() {
                     drop = true;
                 }
-                let info = crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.label)]);
-                resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, view.selected.contains(&i), info.clone()));
-                let s = (cell.x - 44.0) / p.width.max(1.0);
-                let size = vec2(p.width * s, p.height * s).min(vec2(cell.x - 44.0, cell.y - 56.0));
+                let page_label = crate::i18n::fmt(tl!("Page {label}"), &[("label", &p.label)]);
+                resp.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, view.selected.contains(&i), page_label.clone()));
+                let s = ((cell.x - 60.0) / p.width.max(1.0)).min((cell.y - 88.0) / p.height.max(1.0));
+                let size = vec2(p.width * s, p.height * s);
                 let pr = Rect::from_center_size(pos2(c.center().x, c.top() + 16.0 + size.y / 2.0), size);
                 let selected = view.selected.contains(&i) || (view.selected.is_empty() && i == view.current);
                 if selected || resp.hovered() {
@@ -3536,7 +3865,53 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
                     ui.painter().image(tex.id(), pr, Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)), Color32::WHITE);
                 }
                 ui.painter().rect_stroke(pr, CornerRadius::ZERO, Stroke::new(1.0, t.border), egui::StrokeKind::Outside);
-                ui.painter().text(pos2(c.center().x, pr.bottom() + 16.0), Align2::CENTER_CENTER, &p.label, theme::medium(12.0), t.text_muted);
+                let label_font = theme::medium(12.0);
+                let label_w = (c.width() - 12.0).max(0.0);
+                let page_label = crate::widgets::fit_line(&p.label, label_w, |s| crate::widgets::text_width(ui, s, &label_font));
+                let label_pos = pos2(c.center().x, c.bottom() - 48.0);
+                ui.painter().with_clip_rect(Rect::from_center_size(label_pos, vec2(label_w, 18.0))).text(
+                    label_pos,
+                    Align2::CENTER_CENTER,
+                    page_label,
+                    label_font,
+                    t.text_muted,
+                );
+                // The checkbox toggles just this page without requiring a modifier. Keep it
+                // outside the page image, including on very tall or wide pages.
+                let mut checked = view.selected.contains(&i);
+                let check_rect = Rect::from_min_size(c.min + vec2(8.0, 8.0), Vec2::splat(20.0));
+                let check = ui.push_id(("org-check", i), |ui| ui.put(check_rect, egui::Checkbox::without_text(&mut checked))).inner;
+                let label = crate::i18n::fmt(tl!("Select page {label}"), &[("label", &p.label)]);
+                check.widget_info(|| egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, checked, label.clone()));
+                if check.on_hover_text(label).changed() {
+                    view.click_page(i, egui::Modifiers::COMMAND, false);
+                    view.current = i;
+                }
+                // Local actions always target the labelled page. The toolbar above the grid
+                // remains the place for actions on the whole selection.
+                if selected || resp.contains_pointer() || resp.has_focus() {
+                    let actions = Rect::from_center_size(pos2(c.center().x, c.bottom() - 24.0), vec2(84.0, 26.0));
+                    ui.scope_builder(
+                        egui::UiBuilder::new().id_salt(("org-actions", i)).max_rect(actions).layout(egui::Layout::left_to_right(egui::Align::Center)),
+                        |ui| {
+                            ui.spacing_mut().item_spacing.x = 3.0;
+                            ui.add_enabled_ui(editable, |ui| {
+                                for (icon, degrees, key) in
+                                    [("rotate-ccw", -90, "Rotate page {label} counterclockwise"), ("rotate-cw", 90, "Rotate page {label} clockwise")]
+                                {
+                                    let label = crate::i18n::fmt(tl!(key), &[("label", &p.label)]);
+                                    if icons::button(ui, icon, 26.0, false, &label).clicked() {
+                                        view.pending_edit = Some(Edit::RotatePages { pages: vec![i], degrees });
+                                    }
+                                }
+                                let label = crate::i18n::fmt(tl!("Delete page {label}"), &[("label", &p.label)]);
+                                if ui.add_enabled_ui(info.pages.len() > 1, |ui| icons::button(ui, "trash-2", 26.0, false, &label)).inner.clicked() {
+                                    view.pending_edit = Some(Edit::DeletePages { pages: vec![i] });
+                                }
+                            });
+                        },
+                    );
+                }
                 if resp.clicked() {
                     let m = ui.input(|i| i.modifiers);
                     view.click_page(i, m, false);
@@ -3568,20 +3943,20 @@ fn organize_grid(view: &mut DocView, info: &DocInfo, editable: bool, dirty: bool
         }
         // Between pages (and at both ends): insert files right there.
         if editable && !middle_gesture && view.org_drag.is_none() {
-            let mid = |r: &Rect| r.top() + 16.0 + (cell.y - 56.0) / 2.0;
+            let mid = |r: &Rect| r.top() + 16.0 + (cell.y - 88.0) / 2.0;
             for (i, c) in &cells {
                 let label = info
                     .pages
                     .get(*i)
                     .map(|p| crate::i18n::fmt(tl!("Insert a file before page {label}"), &[("label", &p.label)]))
                     .unwrap_or_default();
-                if gap_button(ui, *i, pos2(c.left(), mid(c)), cell.y - 56.0, label, t) {
+                if gap_button(ui, *i, pos2(c.left(), mid(c)), cell.y - 88.0, label, t) {
                     view.pending_action = Some(ViewAction::InsertFromFileAt(*i));
                 }
             }
             if let Some((i, c)) = cells.last()
                 && i + 1 == info.pages.len()
-                && gap_button(ui, i + 1, pos2(c.right(), mid(c)), cell.y - 56.0, tl!("Insert a file at the end").to_string(), t)
+                && gap_button(ui, i + 1, pos2(c.right(), mid(c)), cell.y - 88.0, tl!("Insert a file at the end").to_string(), t)
             {
                 view.pending_action = Some(ViewAction::InsertFromFileAt(i + 1));
             }
@@ -3716,7 +4091,7 @@ trailer << /Root 1 0 R >>
         assert!(!sharp_enough(264, 876.0), "a thumbnail stretched over a zoomed page");
         assert!(!sharp_enough(876, 200.0), "far larger than drawn: wasteful");
         assert!(!sharp_enough(100, 0.0) && !sharp_enough(100, f32::NAN));
-        let mut v = view(3, PageLayout::Continuous);
+        let mut v = view(3, PageLayout::Single, true);
         for odd in [f32::NAN, f32::INFINITY] {
             v.set_grid_zoom(odd);
             assert_eq!(v.grid_zoom(), 1.0);
@@ -3727,14 +4102,68 @@ trailer << /Root 1 0 R >>
         assert_eq!(v.grid_zoom(), 0.5);
     }
 
-    fn view(pages: usize, layout: PageLayout) -> DocView {
+    fn view(pages: usize, layout: PageLayout, continuous: bool) -> DocView {
         let info = pdfcraft_render::DocInfo {
             pages: (0..pages)
                 .map(|_| pdfcraft_render::PageInfo { width: 300.0, height: 400.0, label: String::new(), crop: [0.0, 0.0, 300.0, 400.0], rotation: 0 })
                 .collect(),
             ..Default::default()
         };
-        DocView::new(DocId(1), &info, ViewDefaults { layout, ..Default::default() })
+        DocView::new(DocId(1), &info, ViewDefaults { layout, continuous, ..Default::default() })
+    }
+
+    #[test]
+    fn text_layers_evict_far_pages_but_keep_visible_and_matches() {
+        let info = thumbnail_info(100);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        v.current = 50;
+        v.frame_visible = HashSet::from([50, 51]);
+        for p in 0..100 {
+            v.texts.insert(p, Arc::new(PageText::default()));
+        }
+        v.text_failed.insert(0);
+        v.text_failed.insert(99);
+        v.find = Some(Find { matches: vec![(0, 0..1)], ..Default::default() });
+        let _ = v.prepare_render_queue(&info, 1.0);
+        assert!(v.texts.contains_key(&50) && v.texts.contains_key(&51), "visible pages stay");
+        assert!(v.texts.contains_key(&0), "matched pages stay");
+        assert!(v.texts.contains_key(&49), "nearest prefetch window stays");
+        assert!(!v.texts.contains_key(&99), "far pages go");
+        assert_eq!(v.texts.len(), 2 + 1 + MAX_CACHED_TEXT_PAGES, "visible + matched + prefetch window");
+        assert!(v.text_failed.contains(&0) && v.text_failed.contains(&99), "failures are bytes-free: never evict");
+    }
+
+    #[test]
+    fn text_layers_keep_the_selection_page() {
+        let info = thumbnail_info(100);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        let text = PageText {
+            glyphs: vec![pdfcraft_render::TextGlyph { text: "x".into(), rect: [0.0, 0.0, 10.0, 10.0], quad: [[0.0, 0.0]; 4], direction: [1.0, 0.0] }],
+            line_of: vec![0],
+            space_before: vec![false],
+        };
+        for p in 0..100 {
+            v.texts.insert(p, Arc::new(text.clone()));
+        }
+        v.select_text(0, 0, 0);
+        v.current = 90;
+        v.frame_visible = HashSet::from([90, 91]);
+        let _ = v.prepare_render_queue(&info, 1.0);
+        assert_eq!(v.selected_text().as_deref(), Some("x"), "stale selections still copy");
+    }
+
+    #[test]
+    fn text_layers_stay_while_a_search_is_active() {
+        let info = thumbnail_info(100);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        v.current = 50;
+        v.frame_visible = HashSet::from([50]);
+        for p in 0..100 {
+            v.texts.insert(p, Arc::new(PageText::default()));
+        }
+        v.find = Some(Find { query: "dup".into(), case_query: "dup".into(), matches: vec![(0, 0..1)], ..Default::default() });
+        let _ = v.prepare_render_queue(&info, 1.0);
+        assert_eq!(v.texts.len(), 100, "evicting mid-search would churn the workers");
     }
 
     fn thumbnail_info(count: usize) -> DocInfo {
@@ -3948,6 +4377,48 @@ trailer << /Root 1 0 R >>
         assert!(v.prepare_render_queue(&info, 1.0).is_empty());
     }
 
+    #[test]
+    fn visible_pages_render_before_thumbnails_and_text() {
+        let ctx = egui::Context::default();
+        let info = thumbnail_info(4);
+        let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
+        let main = RenderRequest { page: 0, scale: 1.0, tag: 1000, ..Default::default() };
+        let text = RenderRequest { page: 0, kind: RequestKind::Text, scale: 1.0, tag: TEXT_TAG, ..Default::default() };
+        // Opening page 0 queues its pixels and text alongside Pages-panel thumbnails.
+        v.begin_render_frame();
+        v.frame_visible = [0].into();
+        v.frame_queue = vec![main, text];
+        for p in 1..4 {
+            v.need_thumbnail(p, true);
+        }
+        let queue = v.prepare_render_queue(&info, 1.0);
+        assert_eq!(queue, vec![main], "visible pixels first: no thumbnails or text yet");
+        // Once the visible raster arrives, background work is admitted.
+        v.last_queue = queue;
+        assert!(v.receive_result(&ctx, solid_result(main, 100, 130)) > 0);
+        v.begin_render_frame();
+        v.frame_visible = [0].into();
+        v.frame_queue = vec![text];
+        for p in 1..4 {
+            v.need_thumbnail(p, true);
+        }
+        let queue = v.prepare_render_queue(&info, 1.0);
+        assert!(queue.iter().any(|r| r.kind == RequestKind::Text), "text admitted after pixels");
+        assert!(queue.iter().any(|r| r.tag & THUMB_TAG != 0), "thumbnails admitted after pixels");
+        assert!(!queue.iter().any(|r| r.kind == RequestKind::Pixels && r.tag & THUMB_TAG == 0), "no main pixels re-requested");
+        // An errored visible page never holds background work back.
+        v.errors.insert(0, "gone".to_string());
+        v.begin_render_frame();
+        v.frame_visible = [0].into();
+        v.frame_queue = vec![main, text];
+        for p in 1..4 {
+            v.need_thumbnail(p, true);
+        }
+        let queue = v.prepare_render_queue(&info, 1.0);
+        assert!(queue.iter().any(|r| r.kind == RequestKind::Text), "text admitted despite the error");
+        assert!(queue.iter().any(|r| r.tag & THUMB_TAG != 0), "thumbnails still admitted");
+    }
+
     #[test]
     fn thumbnail_tags_do_not_change_as_a_row_scrolls_in_or_out() {
         let info = thumbnail_info(10_000);
@@ -4058,7 +4529,7 @@ trailer << /Root 1 0 R >>
     #[test]
     fn suspending_a_view_releases_owned_raster_textures_and_queue_state() {
         let ctx = egui::Context::default();
-        let mut view = view(2, PageLayout::Continuous);
+        let mut view = view(2, PageLayout::Single, true);
         let texture = |name| ctx.load_texture(name, egui::ColorImage::filled([1, 1], Color32::WHITE), TextureOptions::LINEAR);
         let request = RenderRequest { page: 0, scale: 1.0, tag: 1, ..Default::default() };
         view.pages.insert(0, PageTex { tag: request.tag, tex: texture("suspended-page") });
@@ -4168,7 +4639,7 @@ trailer << /Root 1 0 R >>
 
     #[test]
     fn notches_turn_pages_and_stop_at_the_ends() {
-        let mut v = view(3, PageLayout::Single);
+        let mut v = view(3, PageLayout::Single, false);
         assert!(notch(&mut v, -1.0, 1.0) && notch(&mut v, -1.0, 1.05));
         assert_eq!(v.current, 2);
         assert!(!notch(&mut v, -1.0, 1.1), "nothing turns past the last page");
@@ -4177,10 +4648,22 @@ trailer << /Root 1 0 R >>
     }
 
     #[test]
-    fn wheel_is_single_page_only() {
-        for layout in [PageLayout::Continuous, PageLayout::TwoUp] {
-            let mut v = view(3, layout);
-            assert!(!notch(&mut v, -1.0, 1.0), "{layout:?} ignores the wheel");
+    fn notches_turn_two_page_spreads() {
+        // Two-page view, shown one spread at a time (not continuous): a notch turns a whole
+        // spread at once, not a single page (#752).
+        let mut v = view(4, PageLayout::TwoUp, false);
+        assert!(notch(&mut v, -1.0, 1.0));
+        assert_eq!(v.current, 2, "a notch turns from the first spread to the second");
+        assert!(notch(&mut v, 1.0, 1.1));
+        assert_eq!(v.current, 0, "a notch back turns to the previous spread");
+    }
+
+    #[test]
+    fn continuous_views_ignore_the_wheel_for_paging() {
+        // Scrolling views let the ScrollArea handle the wheel; it never turns pages.
+        for layout in [PageLayout::Single, PageLayout::TwoUp] {
+            let mut v = view(3, layout, true);
+            assert!(!notch(&mut v, -1.0, 1.0), "{layout:?} continuous ignores the wheel");
             assert_eq!(v.current, 0);
         }
     }
@@ -4188,7 +4671,7 @@ trailer << /Root 1 0 R >>
     #[test]
     fn navigation_drops_partial_wheel_motion() {
         use egui::{MouseWheelUnit::Point, TouchPhase::Move, TouchPhase::Start};
-        let mut v = view(3, PageLayout::Single);
+        let mut v = view(3, PageLayout::Single, false);
         assert!(!v.single_page_wheel(Point, 0.0, Start, 1.0, true));
         assert!(!v.single_page_wheel(Point, -30.0, Move, 1.02, true));
         v.go_to_page(1);
@@ -4200,12 +4683,17 @@ trailer << /Root 1 0 R >>
 
     #[test]
     fn reselecting_the_layout_does_not_scroll_to_top() {
-        let mut v = view(3, PageLayout::Continuous);
+        let mut v = view(3, PageLayout::Single, true);
         v.goto = None;
-        v.set_layout(PageLayout::Continuous);
-        assert!(v.goto.is_none(), "re-selecting the current layout is a no-op");
         v.set_layout(PageLayout::Single);
-        assert_eq!(v.goto, Some((0, 0.0)));
+        assert!(v.goto.is_none(), "re-selecting the current layout is a no-op");
+        v.set_continuous(true);
+        assert!(v.goto.is_none(), "re-selecting the current continuity is a no-op");
+        v.set_layout(PageLayout::TwoUp);
+        assert_eq!(v.goto, Some((0, 0.0)), "switching the base layout aligns the current page");
+        v.goto = None;
+        v.set_continuous(false);
+        assert_eq!(v.goto, Some((0, 0.0)), "toggling continuous scrolling aligns the current page");
     }
 
     #[test]
@@ -4221,8 +4709,8 @@ trailer << /Root 1 0 R >>
             v.current = 1;
             v.fit_zoom(&info);
             assert_eq!(v.zoom, zoom, "{fit:?}: scrolling onto a bigger page keeps the zoom");
-            // Single-page view shows one page at a time, so it fits each one.
-            v.layout = PageLayout::Single;
+            // A single page shown on its own (not scrolling) fits each one.
+            (v.layout, v.continuous) = (PageLayout::Single, false);
             v.fit_zoom(&info);
             let big = v.zoom;
             v.current = 0;
@@ -4239,6 +4727,7 @@ trailer << /Root 1 0 R >>
         let mut v = DocView::new(DocId(1), &info, ViewDefaults::default());
         (v.fit, v.viewport_w, v.viewport_h) = (Fit::Width, 1000.0, 800.0);
         v.layout = PageLayout::Single;
+        v.continuous = false;
         v.fit_zoom(&info);
         let narrow = v.zoom;
         // The shown page fills the width between the side gutters, not centred for the wide page.
@@ -4248,7 +4737,7 @@ trailer << /Root 1 0 R >>
         v.fit_zoom(&info);
         assert!((narrow / v.zoom - 2.0).abs() < 1e-3, "the narrow page gets twice the zoom of the wide one");
         // Scrolling views keep one zoom for the whole document.
-        v.layout = PageLayout::Continuous;
+        v.continuous = true;
         v.fit_zoom(&info);
         let wide = v.zoom;
         v.current = 0;
@@ -4276,7 +4765,7 @@ trailer << /Root 1 0 R >>
                 .collect(),
             ..Default::default()
         };
-        let mut v = view(3, PageLayout::Continuous);
+        let mut v = view(3, PageLayout::Single, true);
         v.fit = Fit::Width;
         // No position (or a malformed one): the top of the page, zoom as it was.
         v.go_to_dest(1, DestView::Top, &info);
diff --git a/crates/ui-egui/src/chrome.rs b/crates/ui-egui/src/chrome.rs
index 0591fe67..58cf8ccd 100644
--- a/crates/ui-egui/src/chrome.rs
+++ b/crates/ui-egui/src/chrome.rs
@@ -6,11 +6,35 @@ use crate::canvas::{DocView, Fit, PageLayout};
 use crate::theme::{self, ThemePreference, Tokens};
 use crate::{Dialog, Mode, PdfCraftApp, PropsTab, RightPanel, icons, widgets};
 
+/// Height of the tab strip when it doubles as the macOS title bar (#789). AppKit draws the traffic
+/// lights itself, centred in the standard 28 pt title-bar band at the top of the window, and moving
+/// them takes AppKit calls the workspace forbids (`unsafe`). So on macOS the strip is that band:
+/// the lights sit vertically centred in it, and the controls beside them shrink to fit, as in
+/// WordCraft (storytold/wordcraft#255).
+pub const MAC_TITLE_BAR: f32 = 28.0;
+/// The traffic lights as AppKit lays them out: button diameter, centre-to-centre pitch and the
+/// first button's left edge (8–10 pt depending on the macOS version; the larger value keeps the
+/// gap after them from shrinking).
+const MAC_LIGHT: f32 = 12.0;
+const MAC_LIGHT_PITCH: f32 = 20.0;
+const MAC_LIGHTS_LEFT: f32 = 10.0;
+/// Where the strip's content starts to the right of the traffic lights: the end of the three
+/// lights plus the same gap the lights keep from the top of the window.
+pub const MAC_CONTENT_LEFT: f32 = MAC_LIGHTS_LEFT + 2.0 * MAC_LIGHT_PITCH + MAC_LIGHT + (MAC_TITLE_BAR - MAC_LIGHT) / 2.0;
+/// The strip and its controls everywhere else.
+const TAB_STRIP: f32 = 38.0;
+const TAB_HEIGHT: f32 = 30.0;
+const STRIP_BUTTON: f32 = 28.0;
+
 pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     let t = Tokens::get(ui.ctx());
-    let left = if cfg!(target_os = "macos") && app.integrated_titlebar { 80 } else { 8 };
+    // macOS: the strip is the 28 pt title bar, so the traffic lights are centred in it; tabs and
+    // buttons shrink to keep a margin above and below.
+    let mac = cfg!(target_os = "macos") && app.integrated_titlebar;
+    let left = if mac { MAC_CONTENT_LEFT as i8 } else { 8 };
+    let (tab_h, button) = if mac { (MAC_TITLE_BAR - 2.0, 24.0) } else { (TAB_HEIGHT, STRIP_BUTTON) };
     egui::Panel::top("tab_strip")
-        .exact_size(38.0)
+        .exact_size(if mac { MAC_TITLE_BAR } else { TAB_STRIP })
         .frame(egui::Frame::NONE.fill(t.titlebar).inner_margin(egui::Margin { left, right: 10, top: 0, bottom: 0 }))
         .show(ui, |ui| {
             let full = ui.max_rect();
@@ -24,12 +48,12 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             }
             ui.horizontal_centered(|ui| {
                 ui.spacing_mut().item_spacing.x = 4.0;
-                if icons::button(ui, "house", 28.0, app.active.is_none() && !app.combine_showing(), tl!("Home")).clicked() {
+                if icons::button(ui, "house", button, app.active.is_none() && !app.combine_showing(), tl!("Home")).clicked() {
                     app.active = None;
                     app.combine_tab.focused = false;
                 }
-                // Keep the two 28-point buttons, Discord's text/padding and three gaps outside the scrolling tabs.
-                let controls_width = ui.fonts_mut(|f| f.layout_no_wrap("Discord".into(), theme::medium(13.0), t.text).size().x) + 106.0;
+                // Keep the two icon buttons, Discord's text/padding and three gaps outside the scrolling tabs.
+                let controls_width = ui.fonts_mut(|f| f.layout_no_wrap("Discord".into(), theme::medium(13.0), t.text).size().x) + 2.0 * button + 50.0;
                 // Open stays in sight after the tabs: its icon, text and padding, and the gaps around it.
                 let open_width = ui.fonts_mut(|f| f.layout_no_wrap(tl!("Open").into(), theme::medium(13.0), t.text).size().x) + 38.0 + 12.0;
                 let mut tabs_width = (ui.available_width() - controls_width - open_width).max(0.0);
@@ -90,6 +114,7 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                                     &mut close,
                                     i,
                                     cap,
+                                    tab_h,
                                 );
                                 if changed && app.active == Some(i) && !app.combine_showing() {
                                     response.scroll_to_me(Some(Align::Center));
@@ -116,6 +141,7 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                                     &mut close,
                                     usize::MAX,
                                     cap,
+                                    tab_h,
                                 );
                                 if changed && app.combine_showing() {
                                     response.scroll_to_me(Some(Align::Center));
@@ -141,23 +167,31 @@ pub fn tab_strip(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 }
                 ui.add_space(4.0);
                 let tip = crate::commands::command_tip(ui.ctx(), tl!("Open a PDF ({key})"), "file.open");
-                if widgets::ghost_button(ui, "plus", tl!("Open")).on_hover_text(tip).clicked() {
+                if widgets::ghost_button_sized(ui, "plus", tl!("Open"), tab_h).on_hover_text(tip).clicked() {
                     app.open_dialog();
                 }
                 ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
                     let (icon, label) = match app.theme_preference {
-                        ThemePreference::System => ("settings", tl!("Use system setting")),
+                        ThemePreference::System => ("monitor", tl!("Use system setting")),
                         ThemePreference::Light => ("sun", tl!("Light gray")),
                         ThemePreference::Dark => ("moon", tl!("Dark gray")),
                     };
                     let tip = format!("{}: {label}", tl!("Display theme"));
-                    let response = icons::button(ui, icon, 28.0, false, &tip);
-                    egui::Popup::menu(&response).show(|ui| theme_menu(app, ui));
-                    if icons::button(ui, "circle-help", 28.0, false, tl!("Keyboard shortcuts")).clicked() {
+                    let response = icons::button(ui, icon, button, false, &tip);
+                    // A click cycles System, Light, Dark; a right-click opens the menu.
+                    if response.clicked() {
+                        app.execute(match app.theme_preference {
+                            ThemePreference::System => "view.theme.light",
+                            ThemePreference::Light => "view.theme.dark",
+                            ThemePreference::Dark => "view.theme.system",
+                        });
+                    }
+                    egui::Popup::context_menu(&response).id(response.id.with("theme_menu")).show(|ui| appearance_menu(app, ui));
+                    if icons::button(ui, "circle-help", button, false, tl!("Keyboard shortcuts")).clicked() {
                         app.dialog = Some(Dialog::Shortcuts);
                     }
                     // One click to the community, from anywhere in the app.
-                    if widgets::ghost_button(ui, "messages-square", "Discord").on_hover_text(pdfcraft_engine::links::DISCORD).clicked() {
+                    if widgets::ghost_button_sized(ui, "messages-square", "Discord", tab_h).on_hover_text(pdfcraft_engine::links::DISCORD).clicked() {
                         app.execute("help.discord");
                     }
                 });
@@ -177,6 +211,19 @@ fn theme_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             ui.close();
         }
     }
+    ui.separator();
+    if ui.button(tl!("Appearance settings…")).clicked() {
+        app.dialog = Some(Dialog::Preferences);
+        ui.close();
+    }
+}
+
+/// The right-click menu on the title bar's theme button.
+fn appearance_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
+    if ui.button(tl!("Appearance settings…")).clicked() {
+        app.dialog = Some(Dialog::Preferences);
+        ui.close();
+    }
 }
 
 /// A tab's chrome around its name: the icon on the left, the close button on the right.
@@ -245,6 +292,7 @@ fn tab(
     close: &mut Option<usize>,
     index: usize,
     cap: Option<f32>,
+    height: f32,
 ) -> egui::Response {
     let font = theme::regular(13.0);
     let mut label = tab_name(name);
@@ -259,7 +307,7 @@ fn tab(
     let label = crate::bidi::visual(&label).into_owned();
     let text_w = ui.fonts_mut(|f| f.layout_no_wrap(label.clone(), font.clone(), t.text).size().x);
     let width = cap.map_or(text_w + TAB_CHROME, |cap| (text_w + TAB_CHROME).min(cap));
-    let (rect, _) = ui.allocate_exact_size(vec2(width, 30.0), Sense::hover());
+    let (rect, _) = ui.allocate_exact_size(vec2(width, height), Sense::hover());
     let a11y = if dirty { format!("{name} (edited)") } else { name.to_string() };
     let resp = craft_ui::tabs::Tab::new(id, &a11y, active).focus_stroke(Stroke::new(1.0, t.accent)).show_at(ui, rect, |ui, resp| {
         let bg = if active {
@@ -270,7 +318,13 @@ fn tab(
             Color32::TRANSPARENT
         };
         ui.painter().rect_filled(rect, CornerRadius { nw: 7, ne: 7, sw: 0, se: 0 }, bg);
-        icons::paint(ui, Rect::from_min_size(rect.min + vec2(6.0, 7.0), vec2(16.0, 16.0)), icon, 15.0, if active { t.accent } else { t.text_muted });
+        icons::paint(
+            ui,
+            Rect::from_min_size(rect.min + vec2(6.0, (height - 16.0) / 2.0), vec2(16.0, 16.0)),
+            icon,
+            15.0,
+            if active { t.accent } else { t.text_muted },
+        );
         ui.painter().text(rect.min + vec2(28.0, rect.height() / 2.0), Align2::LEFT_CENTER, label, font, if active { t.text } else { t.text_muted });
     });
     let x_rect = Rect::from_center_size(rect.right_center() - vec2(16.0, 0.0), vec2(20.0, 20.0));
@@ -310,7 +364,7 @@ pub fn mode_bar(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     [(Mode::AllTools, "All tools"), (Mode::Read, "Read"), (Mode::Edit, "Edit"), (Mode::Convert, "Convert"), (Mode::Sign, "E-Sign")]
                 {
                     if widgets::mode_tab(ui, tl!(label), app.mode == mode).clicked() {
-                        app.select_mode(mode);
+                        app.switch_mode(mode, true);
                     }
                 }
                 ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
@@ -321,7 +375,8 @@ pub fn mode_bar(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                         if icons::button(ui, "printer", 32.0, false, &tip).clicked() {
                             app.run_command("print.dialog");
                         }
-                        if icons::button(ui, "save", 32.0, false, tl!("Save (M4)")).clicked() {
+                        let tip = crate::commands::command_tip(ui.ctx(), tl!("Save ({key})"), "file.save");
+                        if icons::button(ui, "save", 32.0, false, &tip).clicked() {
                             app.run_command("file.save");
                         }
                         let tip = crate::commands::command_tip(ui.ctx(), tl!("Document properties ({key})"), "file.properties");
@@ -544,6 +599,12 @@ fn page_display_menu(ui: &mut egui::Ui, view: &DocView) -> Option<&'static str>
             picked = Some(l.command());
         }
     }
+    ui.separator();
+    // Continuous scrolling is an independent checkbox over the base layout, as in Acrobat (#752).
+    let mut continuous = view.continuous();
+    if ui.add(egui::Checkbox::new(&mut continuous, tl!("Continuous scrolling"))).changed() {
+        picked = Some("view.continuous");
+    }
     let mut cover = view.cover;
     if ui.add_enabled(view.cover_applies(), egui::Checkbox::new(&mut cover, tl!("Show cover page in two-page view"))).changed() {
         picked = Some("view.layout.cover");
@@ -591,7 +652,7 @@ fn rail_view_menu(ui: &mut egui::Ui, view: &mut DocView) -> Option<&'static str>
 
 #[cfg(test)]
 mod tab_widths {
-    use super::tab_cap;
+    use super::{MAC_CONTENT_LEFT, MAC_LIGHT, MAC_LIGHT_PITCH, MAC_LIGHTS_LEFT, MAC_TITLE_BAR, tab_cap};
 
     /// Tabs that fit keep their own widths.
     #[test]
@@ -627,4 +688,14 @@ mod tab_widths {
         assert_eq!(tab_cap(&[250.0; 12], 600.0, 4.0, 110.0), Some(110.0));
         assert_eq!(tab_cap(&[250.0; 3], 0.0, 4.0, 110.0), Some(110.0));
     }
+
+    #[test]
+    fn the_mac_title_bar_centres_and_clears_the_traffic_lights() {
+        // The lights are centred in the bar, and content keeps the same gap after them (#789).
+        let margin = (MAC_TITLE_BAR - MAC_LIGHT) / 2.0;
+        let lights_end = MAC_LIGHTS_LEFT + 2.0 * MAC_LIGHT_PITCH + MAC_LIGHT;
+        assert_eq!(MAC_CONTENT_LEFT - lights_end, margin);
+        // `egui::Margin` is in `i8`.
+        assert!(MAC_CONTENT_LEFT <= f32::from(i8::MAX));
+    }
 }
diff --git a/crates/ui-egui/src/combine_ui.rs b/crates/ui-egui/src/combine_ui.rs
index faefb68f..7e6d1cc0 100644
--- a/crates/ui-egui/src/combine_ui.rs
+++ b/crates/ui-egui/src/combine_ui.rs
@@ -213,6 +213,9 @@ pub struct CombineTab {
     pub(crate) selected_pages: BTreeSet<(u64, usize)>,
     /// The page a Shift-click selects from.
     pub(crate) page_anchor: Option<(u64, usize)>,
+    /// "Leave out files that can't be read?", asked when Combine is clicked with such files in the
+    /// list.
+    pub(crate) confirm_skip: bool,
 }
 
 /// The pages a range takes, and the range and page count they were worked out for.
@@ -395,6 +398,13 @@ impl CombineFile {
         self.checked = None;
     }
 
+    /// Whether the file can't be read at all (damaged, or a type that can't be made into a PDF):
+    /// it stays in the list, with why, and Combine leaves it out once the user agrees. A
+    /// password-protected file can be unlocked instead, so it isn't one.
+    pub(crate) fn unreadable(&self) -> bool {
+        self.problem.is_some() && self.lock.is_none()
+    }
+
     /// The password the file was unlocked with, if any.
     pub(crate) fn password(&self) -> Option<&str> {
         self.password.as_ref().map(|p| p.0.as_str())
@@ -583,7 +593,7 @@ pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
     // The keyboard is the list's unless a text field, the password box or the size slider has it.
     let slider_focused = grid && app.combine_tab.zoom_slider.is_some_and(|id| ui.memory(|m| m.has_focus(id)));
     // (Nor while a file is shown large: its window may only open or close this frame.)
-    let covered = app.combine_tab.unlock.is_some() || app.combine_tab.preview.is_some();
+    let covered = app.combine_tab.unlock.is_some() || app.combine_tab.preview.is_some() || app.combine_tab.confirm_skip;
     let focus = ui.memory(|m| m.focused());
     let space = focus.is_none() || focus == app.combine_tab.card_focus;
     let any_picked = count > 0 || !app.combine_tab.selected_pages.is_empty();
@@ -793,7 +803,67 @@ pub(crate) fn page(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
         app.combine_apply(action);
     }
     if combine && blocker.is_none() {
-        app.combine_staged();
+        if app.combine_draft.iter().any(CombineFile::unreadable) {
+            app.combine_tab.confirm_skip = true;
+        } else {
+            app.combine_staged();
+        }
+    }
+    skip_prompt(app, ui.ctx());
+}
+
+/// Most files the prompt names; the rest are counted.
+const SKIP_PROMPT_NAMES: usize = 8;
+
+/// "Leave out files that can't be read?": names them and why, then combines the others, or not.
+fn skip_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    if !app.combine_tab.confirm_skip {
+        return;
+    }
+    let t = Tokens::get(ctx);
+    let mut left_out: Vec<(&str, &str)> = Vec::new();
+    let mut seen = BTreeSet::new();
+    for f in app.combine_draft.iter().filter(|f| f.unreadable() && seen.insert(f.group)) {
+        left_out.push((f.name.as_str(), f.problem.as_deref().unwrap_or_default()));
+    }
+    let mut choice: Option<bool> = None;
+    let modal = egui::Modal::new(egui::Id::new("combine-skip")).show(ctx, |ui| {
+        ui.set_width(460.0);
+        ui.horizontal(|ui| {
+            ui.add(icons::image("triangle-alert", 22.0, ERROR));
+            ui.add(egui::Label::new(egui::RichText::new(tl!("Leave out files that can't be read?")).font(theme::semibold(16.0))).wrap());
+        });
+        ui.add_space(6.0);
+        ui.label(egui::RichText::new(tl!("These files can't be read, so they won't be in the combined PDF:")).color(t.text_muted));
+        ui.add_space(6.0);
+        for (name, why) in left_out.iter().take(SKIP_PROMPT_NAMES) {
+            ui.horizontal_wrapped(|ui| {
+                ui.label(egui::RichText::new(format!("• {}", crate::bidi::visual(name))).strong());
+                ui.label(egui::RichText::new(*why).color(t.text_muted));
+            });
+        }
+        if left_out.len() > SKIP_PROMPT_NAMES {
+            let more = (left_out.len() - SKIP_PROMPT_NAMES).to_string();
+            ui.label(egui::RichText::new(crate::i18n::fmt(tl!("and {n} more"), &[("n", &more)])).color(t.text_muted));
+        }
+        ui.add_space(14.0);
+        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
+            if widgets::pill_button(ui, tl!("Combine the rest"), true).clicked() {
+                choice = Some(true);
+            }
+            if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
+                choice = Some(false);
+            }
+        });
+    });
+    if choice.is_none() && modal.should_close() {
+        choice = Some(false);
+    }
+    if let Some(go) = choice {
+        app.combine_tab.confirm_skip = false;
+        if go {
+            app.combine_staged();
+        }
     }
 }
 
@@ -828,8 +898,8 @@ fn unlock_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
             }
             ui.add_space(8.0);
             ui.horizontal(|ui| {
-                let field =
-                    ui.add(egui::TextEdit::singleline(&mut prompt.input.0).password(!prompt.show).hint_text(tl!("Password")).desired_width(290.0));
+                crate::widgets::begin_dialog(ui);
+                let field = ui.add(crate::widgets::line(&mut prompt.input.0).password(!prompt.show).hint_text(tl!("Password")).desired_width(290.0));
                 if !prompt.focused {
                     field.request_focus();
                     prompt.focused = true;
@@ -907,11 +977,20 @@ fn expandable(f: &mut CombineFile) -> bool {
 
 /// Why Combine can't run yet, if so.
 fn blocker(files: &[CombineFile], checks: &[Result<usize, String>]) -> Option<String> {
-    // (A file split into parts is still one file.)
-    if files.iter().map(|f| f.group).collect::<BTreeSet<u64>>().len() < 2 {
-        return Some(tl!("Add at least two files").to_string());
+    // (A file split into parts is still one file.) Files that can't be read are left out, so
+    // they don't count.
+    if files.iter().filter(|f| !f.unreadable()).map(|f| f.group).collect::<BTreeSet<u64>>().len() < 2 {
+        return Some(match files.iter().find(|f| f.unreadable()) {
+            Some(f) => {
+                crate::i18n::fmt(tl!("{name} can't be combined: {why}"), &[("name", &f.name), ("why", f.problem.as_deref().unwrap_or_default())])
+            }
+            None => tl!("Add at least two files").to_string(),
+        });
     }
     for (f, check) in files.iter().zip(checks) {
+        if f.unreadable() {
+            continue;
+        }
         if let Some(p) = &f.problem {
             return Some(crate::i18n::fmt(tl!("{name} can't be combined: {why}"), &[("name", &f.name), ("why", p)]));
         }
@@ -1041,9 +1120,9 @@ fn empty_state(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, files_hover
         ui.add_space((ui.available_height() / 2.0 - 70.0).max(16.0));
         ui.add(icons::image("files", 40.0, if files_hovering { t.accent } else { t.text_faint }));
         ui.add_space(10.0);
-        ui.label(egui::RichText::new(tl!("Add the PDFs to combine")).font(theme::medium(15.0)));
+        ui.label(egui::RichText::new(tl!("Add the files to combine")).font(theme::medium(15.0)));
         ui.add_space(4.0);
-        ui.label(egui::RichText::new(tl!("Drop PDFs or folders here, or choose them.")).color(t.text_faint));
+        ui.label(egui::RichText::new(tl!("Drop PDFs, images, text files or folders here, or choose them.")).color(t.text_faint));
         ui.add_space(12.0);
         let folders = cfg!(not(target_arch = "wasm32"));
         // Centre the buttons: measure them first.
@@ -1084,12 +1163,12 @@ fn add_menu(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
             app.combine_dialog();
             ui.close();
         }
-        if item(ui, "folder", tl!("Add folder…")).on_hover_text(tl!("Every PDF in the folder")).clicked() {
+        if item(ui, "folder", tl!("Add folder…")).on_hover_text(tl!("Every PDF, image and text file in the folder")).clicked() {
             app.combine_add_folder(false);
             ui.close();
         }
         if item(ui, "folder-open", tl!("Add folder and subfolders…"))
-            .on_hover_text(tl!("Every PDF in the folder and the folders inside it"))
+            .on_hover_text(tl!("Every PDF, image and text file in the folder and the folders inside it"))
             .clicked()
         {
             app.combine_add_folder(true);
@@ -1295,9 +1374,10 @@ fn table_body(
                             }
                             // The range field and how many pages it takes.
                             SortKey::Pages => {
+                                crate::widgets::begin_dialog(ui);
                                 let edit = ui.add_enabled(
                                     f.problem.is_none(),
-                                    egui::TextEdit::singleline(&mut f.range).hint_text(tl!("All pages")).desired_width(88.0),
+                                    crate::widgets::line(&mut f.range).frame(egui::Frame::NONE).hint_text(tl!("All pages")).desired_width(88.0),
                                 );
                                 // A visible field on plain and striped rows alike; red when the range is wrong.
                                 let border = if check.is_err() { Stroke::new(1.5, ERROR) } else { Stroke::new(1.0, t.border) };
@@ -1406,10 +1486,10 @@ fn table_body(
         });
 }
 
-/// The PDFs in `dir` (and, if `recursive`, the folders inside it, not following links), in
-/// natural order, at most [`MAX_FOLDER_FILES`]; and whether there were more.
+/// The PDFs, images and text files in `dir` (and, if `recursive`, the folders inside it, not
+/// following links), in natural order, at most [`MAX_FOLDER_FILES`]; and whether there were more.
 #[cfg(not(target_arch = "wasm32"))]
-fn pdfs_in(dir: &std::path::Path, recursive: bool) -> (Vec<std::path::PathBuf>, bool) {
+fn combinable_in(dir: &std::path::Path, recursive: bool) -> (Vec<std::path::PathBuf>, bool) {
     let mut found = Vec::new();
     let mut more = false;
     let mut folders = vec![(dir.to_path_buf(), 0usize)];
@@ -1423,7 +1503,7 @@ fn pdfs_in(dir: &std::path::Path, recursive: bool) -> (Vec<std::path::PathBuf>,
                 if recursive && !hidden && depth < MAX_FOLDER_DEPTH {
                     folders.push((path, depth + 1));
                 }
-            } else if path.extension().is_some_and(|e| e.eq_ignore_ascii_case("pdf")) && path.is_file() {
+            } else if path.extension().is_some_and(|e| combinable(&e.to_string_lossy())) && path.is_file() {
                 if found.len() >= MAX_FOLDER_FILES {
                     more = true;
                     break 'walk;
@@ -1436,6 +1516,21 @@ fn pdfs_in(dir: &std::path::Path, recursive: bool) -> (Vec<std::path::PathBuf>,
     (found, more)
 }
 
+/// Whether a file with extension `ext` can join the list: a PDF, or an image or text file that
+/// becomes one.
+fn combinable(ext: &str) -> bool {
+    std::iter::once("pdf").chain(pdfcraft_engine::CONVERTIBLE).any(|c| ext.eq_ignore_ascii_case(c))
+}
+
+/// A file's bookmark in the combined PDF: its name without ".pdf", or without the extension of
+/// the image or text file it was made from.
+fn title_of(name: &str) -> &str {
+    match name.rsplit_once('.') {
+        Some((stem, ext)) if !stem.is_empty() && combinable(ext) => stem,
+        _ => name,
+    }
+}
+
 /// File names in the order people expect: case-insensitive, with numbers by value
 /// ("scan2" before "scan10").
 fn natural(a: &str, b: &str) -> Ordering {
@@ -2191,12 +2286,35 @@ impl PdfCraftApp {
     pub(crate) fn stage_combine_with(&mut self, files: Vec<Incoming>) {
         let mut added = Vec::new();
         for Incoming { name, bytes, modified, note } in files {
-            let assessed = match assess(&bytes, None) {
-                Ok(a) => a,
-                Err(AssessError::Unreadable(e)) => {
-                    self.notify_fmt("Couldn't add {name}: {e}", &[("name", &name), ("e", &e)]);
-                    continue;
+            // Images and text files become PDFs as they join the list (#569): from then on they
+            // are ordinary files, with pages, thumbnails and page ranges.
+            // A file that can't be read joins the list all the same, with why (the Warnings
+            // column, its card); Combine asks before leaving it out.
+            let unreadable = |e: &str| Assessed {
+                pages: 0,
+                sizes: Arc::from(Vec::new()),
+                problem: Some(crate::i18n::fmt(tl!("Can't be read: {e}"), &[("e", e)])),
+                lock: None,
+                notes: Vec::new(),
+            };
+            let (bytes, assessed) = match self.session.as_pdf(&name, &bytes) {
+                Ok(pdf) => {
+                    let assessed = assess(&pdf, None);
+                    (pdf, assessed)
                 }
+                Err(e) => {
+                    // (The engine's message names the file, which the row already shows.)
+                    let e = match e {
+                        pdfcraft_engine::EditError::Source(m) => m,
+                        other => other.to_string(),
+                    };
+                    let why = e.strip_prefix(&format!("{name}: ")).unwrap_or(&e).to_string();
+                    (bytes, Ok(unreadable(&why)))
+                }
+            };
+            let assessed = match assessed {
+                Ok(a) => a,
+                Err(AssessError::Unreadable(e)) => unreadable(&e),
                 Err(AssessError::WrongPassword) => {
                     self.notify_fmt("Couldn't add {name}: {e}", &[("name", &name), ("e", "the password is wrong")]);
                     continue;
@@ -2286,7 +2404,8 @@ impl PdfCraftApp {
         self.combine_unlock(&ids, password)
     }
 
-    /// Add every PDF in a folder the user picks (and its subfolders, if `recursive`).
+    /// Add every PDF, image and text file in a folder the user picks (and its subfolders, if
+    /// `recursive`).
     pub fn combine_add_folder(&mut self, recursive: bool) {
         #[cfg(not(target_arch = "wasm32"))]
         {
@@ -2298,19 +2417,19 @@ impl PdfCraftApp {
         let _ = recursive;
     }
 
-    /// Add the PDFs in `dir` to the Combine files list, as one undo step.
+    /// Add the PDFs, images and text files in `dir` to the Combine files list, as one undo step.
     #[cfg(not(target_arch = "wasm32"))]
     pub(crate) fn add_folder_to_combine(&mut self, dir: &std::path::Path, recursive: bool) {
-        let (paths, more) = pdfs_in(dir, recursive);
+        let (paths, more) = combinable_in(dir, recursive);
         let folder = dir.file_name().map_or_else(|| dir.to_string_lossy().into_owned(), |n| n.to_string_lossy().into_owned());
         if paths.is_empty() {
-            self.notify_fmt("No PDFs found in {folder}", &[("folder", &folder)]);
+            self.notify_fmt("No PDFs, images or text files found in {folder}", &[("folder", &folder)]);
             self.open_combine_tab();
             return;
         }
         self.use_paths(crate::files::FilePurpose::Combine, &paths);
         if more {
-            self.notify_fmt("Added the first {n} PDFs in {folder}", &[("n", &MAX_FOLDER_FILES.to_string()), ("folder", &folder)]);
+            self.notify_fmt("Added the first {n} files in {folder}", &[("n", &MAX_FOLDER_FILES.to_string()), ("folder", &folder)]);
         }
     }
 
@@ -2331,18 +2450,17 @@ impl PdfCraftApp {
     }
 
     /// Combine the listed files into a new, unsaved document; the tab makes way for it.
+    /// Files that can't be read are left out (the user was asked).
     pub fn combine_staged(&mut self) {
-        let files = &self.combine_draft;
+        let files: Vec<&CombineFile> = self.combine_draft.iter().filter(|f| !f.unreadable()).collect();
         if files.is_empty() {
             return;
         }
         // Each file once, however many parts it is in.
         let count = files.iter().map(|f| f.group).collect::<BTreeSet<u64>>().len();
         let groups: Vec<u64> = files.iter().map(|f| f.group).collect();
-        let sources: Vec<(String, Arc<Vec<u8>>, Option<String>)> = files
-            .iter()
-            .map(|f| (crate::files::strip_pdf(&f.name).to_string(), f.bytes.clone(), Some(f.range.clone()).filter(|r| !r.trim().is_empty())))
-            .collect();
+        let sources: Vec<(String, Arc<Vec<u8>>, Option<String>)> =
+            files.iter().map(|f| (title_of(&f.name).to_string(), f.bytes.clone(), Some(f.range.clone()).filter(|r| !r.trim().is_empty()))).collect();
         let passwords: Vec<Option<&str>> = files.iter().map(|f| f.password.as_ref().map(|p| p.0.as_str())).collect();
         match self.session.combine_grouped(&sources, &groups, &passwords) {
             Ok(bytes) => {
@@ -2423,6 +2541,16 @@ mod tests {
         }
     }
 
+    #[test]
+    fn bookmarks_are_named_without_the_extension_of_a_converted_file() {
+        assert_eq!(title_of("report.pdf"), "report");
+        assert_eq!(title_of("REPORT.PDF"), "REPORT");
+        assert_eq!(title_of("scan.2024.JPG"), "scan.2024");
+        assert_eq!(title_of("notes.txt"), "notes");
+        assert_eq!(title_of("v1.2"), "v1.2", "not a known extension");
+        assert_eq!(title_of(".png"), ".png", "nothing would be left");
+    }
+
     #[test]
     fn page_lists_become_the_shortest_range() {
         assert_eq!(range_of(&[0, 1, 2], 3), "", "every page in order: no range");
diff --git a/crates/ui-egui/src/commands.rs b/crates/ui-egui/src/commands.rs
index 8ccf1456..4ccca99e 100644
--- a/crates/ui-egui/src/commands.rs
+++ b/crates/ui-egui/src/commands.rs
@@ -123,16 +123,19 @@ impl PdfCraftApp {
                     };
                     crate::i18n::fmt(tl!("This document has no {kind} to change"), &[("kind", kind)])
                 }
+                // Restricted documents ask for their permissions password instead, so only an
+                // unprotected or a read-only document gets here.
                 commands::Needs::Security | commands::Needs::ProtectedSecurity if self.active.is_some() => {
-                    if self.active_ids().and_then(|(_, id)| self.session.get(id)).is_some_and(|d| d.allows_security_change()) {
-                        tl!("This document isn't password-protected").to_string()
-                    } else {
-                        tl!("Only the document's owner can change its security (open it with the permissions password)").to_string()
+                    match self.active_ids().and_then(|(_, id)| self.session.get(id)) {
+                        Some(d) if !d.allows_security_change() => crate::i18n::fmt(tl!("{name} is read-only"), &[("name", &d.name)]),
+                        _ => tl!("This document isn't password-protected").to_string(),
                     }
                 }
+                commands::Needs::Unlock if self.active.is_some() => tl!("This document has no restrictions to lift").to_string(),
                 commands::Needs::Assembly | commands::Needs::Modification | commands::Needs::Annotate if self.active.is_some() => {
                     tl!("The document's security settings don't allow this change").to_string()
                 }
+                commands::Needs::Copying if self.active.is_some() => crate::copy_refused().to_string(),
                 commands::Needs::TwoPageView if self.active.is_some() => tl!("Switch to two-page view first to show the cover page").to_string(),
                 _ => tl!("Open a document first").to_string(),
             };
@@ -172,6 +175,12 @@ impl PdfCraftApp {
             "file.revert" => self.dialog = Some(Dialog::Revert),
             "file.properties" => self.dialog = Some(Dialog::Properties(PropsTab::Description)),
             "protect.properties" => self.dialog = Some(Dialog::Properties(PropsTab::Security)),
+            // A restricted document's security changes once its permissions password is entered.
+            "protect.password" | "protect.remove" if self.active_ids().and_then(|(_, id)| self.session.get(id)).is_some_and(|d| d.can_unlock()) => {
+                let then = if id == "protect.password" { "protect.password" } else { "protect.remove" };
+                self.request_unlock(Some(then));
+            }
+            "protect.unlock" => self.request_unlock(None),
             "protect.password" => {
                 self.protect_draft = Default::default();
                 self.dialog = Some(Dialog::Protect);
@@ -221,6 +230,13 @@ impl PdfCraftApp {
                     self.views[i].set_layout(layout);
                 }
             }
+            // The Continuous scrolling checkbox (an independent toggle over the base layout).
+            "view.continuous" => {
+                if let Some(i) = active {
+                    let v = &mut self.views[i];
+                    v.set_continuous(!v.continuous());
+                }
+            }
             "view.layout.cover" => {
                 if let Some(i) = active {
                     let v = &mut self.views[i];
@@ -229,9 +245,10 @@ impl PdfCraftApp {
             }
             "view.fit_width_scrolling" | "view.fit_one_page" => {
                 use crate::canvas::{Fit, PageLayout};
-                let (layout, fit) = if id == "view.fit_one_page" { (PageLayout::Single, Fit::Page) } else { (PageLayout::Continuous, Fit::Width) };
+                // Fit one full page shows a single page on its own; fit width scrolls it.
+                let (continuous, fit) = if id == "view.fit_one_page" { (false, Fit::Page) } else { (true, Fit::Width) };
                 if let Some(i) = active {
-                    self.views[i].set_layout(layout);
+                    self.views[i].set_display(PageLayout::Single, continuous);
                     self.views[i].set_fit(fit);
                 }
             }
@@ -242,7 +259,7 @@ impl PdfCraftApp {
                     None => self.full_screen = on,
                 }
             }
-            "view.read_mode" => self.mode = if self.mode == Mode::Read { Mode::AllTools } else { Mode::Read },
+            "view.read_mode" => self.switch_mode(if self.mode == Mode::Read { Mode::AllTools } else { Mode::Read }, false),
             "view.theme" => {
                 let next = if self.theme == ThemeKind::Light { ThemePreference::Dark } else { ThemePreference::Light };
                 self.set_theme_preference(next);
@@ -570,6 +587,23 @@ impl PdfCraftApp {
             "page.duplicate" => {
                 self.apply_edit(Edit::DuplicatePages { pages: targets });
             }
+            "ocr.enhance_camera" => {
+                // The corners start on the document's edges when they can be found, else
+                // inset on the current page (camera_ui::page_input).
+                self.quick_tool = crate::QuickTool::EnhanceCamera;
+                if let Some(i) = self.active
+                    && let Some(view) = self.views.get_mut(i)
+                    && let Some(page) = self.session.get(view.id).and_then(|d| d.info.pages.get(view.current).cloned())
+                {
+                    view.camera_done = None;
+                    view.camera = self.session.detect_camera_corners(view.id, view.current).map(|found| crate::camera_ui::CameraQuad {
+                        page: view.current,
+                        corners: found.map(|[x, y]| page.user_to_view(x as f32, y as f32)),
+                        grab: None,
+                    });
+                }
+                self.notify_tr("Drag the corners onto the document's edges, then choose Enhance page.");
+            }
             "page.crop" => {
                 self.quick_tool = crate::QuickTool::Crop;
                 self.notify_tr("Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes");
@@ -632,6 +666,11 @@ impl PdfCraftApp {
                     // this document only.
                     self.deferred_commands.push((spec.id, active.map(|(_, id)| id)));
                     ctx.request_repaint();
+                } else if spec.id == "file.close" && active.is_none() && crate::commands::mac_shortcuts(ctx) && !cfg!(target_arch = "wasm32") {
+                    // macOS ⌘W closes the last window when no document tabs remain (#869).
+                    // Route through the normal viewport-close path (and its quit guard),
+                    // not the disabled document-only `file.close` command.
+                    ctx.send_viewport_cmd(egui::ViewportCommand::Close);
                 } else {
                     self.execute(spec.id);
                 }
diff --git a/crates/ui-egui/src/comment_props.rs b/crates/ui-egui/src/comment_props.rs
index 11776bca..a01bb94a 100644
--- a/crates/ui-egui/src/comment_props.rs
+++ b/crates/ui-egui/src/comment_props.rs
@@ -167,7 +167,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
     let kind = tl!(crate::comments_panel::subtype_label(&d.edited.subtype)).to_string();
     ui.label(egui::RichText::new(crate::i18n::fmt(tl!("{kind} Properties"), &[("kind", &kind)])).font(theme::semibold(18.0)));
     ui.add_space(6.0);
-    ui.horizontal(|ui| {
+    ui.horizontal_wrapped(|ui| {
         for (tab, label) in
             [(PropsTab::Appearance, tl!("Appearance")), (PropsTab::General, tl!("General")), (PropsTab::ReviewHistory, tl!("Review History"))]
         {
@@ -240,10 +240,10 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
         PropsTab::General => {
             egui::Grid::new("comment-general").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
                 let l = ui.label(tl!("Author"));
-                ui.add(egui::TextEdit::singleline(&mut e.author).desired_width(280.0)).labelled_by(l.id);
+                ui.add(crate::widgets::line(&mut e.author).desired_width(280.0)).labelled_by(l.id);
                 ui.end_row();
                 let l = ui.label(tl!("Subject"));
-                ui.add(egui::TextEdit::singleline(&mut e.subject).desired_width(280.0)).labelled_by(l.id);
+                ui.add(crate::widgets::line(&mut e.subject).desired_width(280.0)).labelled_by(l.id);
                 ui.end_row();
                 ui.label(tl!("Modified"));
                 ui.label(e.modified.as_deref().map(pdfcraft_render::pretty_date).unwrap_or_else(|| "—".into()));
diff --git a/crates/ui-egui/src/comments_panel.rs b/crates/ui-egui/src/comments_panel.rs
index d4958288..5182fadc 100644
--- a/crates/ui-egui/src/comments_panel.rs
+++ b/crates/ui-egui/src/comments_panel.rs
@@ -90,8 +90,13 @@ pub fn count(info: &DocInfo) -> usize {
 }
 
 fn matches(a: &Annotation, q: &str) -> bool {
-    let q = q.to_lowercase();
-    [a.author.as_deref(), a.contents.as_deref(), Some(kind_label(a))].into_iter().flatten().any(|s| s.to_lowercase().contains(&q))
+    any_contains([a.author.as_deref(), a.contents.as_deref(), Some(kind_label(a))].into_iter().flatten(), q)
+}
+
+/// Whether one of `fields` contains `q` in any case, Turkish dotted and dotless i included.
+fn any_contains<'a>(fields: impl IntoIterator<Item = &'a str>, q: &str) -> bool {
+    let q = pdfcraft_render::text::fold_case(q);
+    fields.into_iter().any(|s| pdfcraft_render::text::fold_case(s).contains(&q))
 }
 
 /// Draw the panel body. Returns an edit to apply (posting, replying, deleting…).
@@ -104,10 +109,11 @@ pub(crate) fn show(
     allowed: bool,
     nav: &mut Option<Nav>,
 ) -> Option<Edit> {
+    crate::widgets::begin_dialog(ui);
     let mut edit = None;
     // Search (the header's magnifier toggles it).
     if let Some(q) = view.comments.search.as_mut() {
-        let r = ui.add(egui::TextEdit::singleline(q).hint_text(tl!("Search comments")).desired_width(f32::INFINITY).id_salt("comment-search"));
+        let r = ui.add(crate::widgets::line(q).hint_text(tl!("Search comments")).desired_width(f32::INFINITY).id_salt("comment-search"));
         if view.comments.search_focus {
             r.request_focus();
             view.comments.search_focus = false;
@@ -117,11 +123,7 @@ pub(crate) fn show(
     // "Add a comment": a sticky note on the current page, near its top-right corner.
     if allowed {
         let r = ui.add(
-            egui::TextEdit::singleline(&mut view.comments.add_box)
-                .hint_text(tl!("Add a comment"))
-                .desired_width(f32::INFINITY)
-                .margin(egui::Margin::symmetric(8, 6))
-                .id_salt("comment-add-box"),
+            crate::widgets::line(&mut view.comments.add_box).hint_text(tl!("Add a comment")).desired_width(f32::INFINITY).id_salt("comment-add-box"),
         );
         if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) && !view.comments.add_box.trim().is_empty() {
             let page = view.current.min(info.pages.len().saturating_sub(1));
@@ -291,7 +293,7 @@ fn card(
             egui::Frame::NONE.inner_margin(egui::Margin { left: 34, right: 0, top: 4, bottom: 0 }).show(ui, |ui| {
                 ui.set_width(ui.available_width());
                 if editing && let Some((_, _, text)) = view.comments.editing.as_mut() {
-                    let r = ui.add(egui::TextEdit::multiline(text).desired_rows(2).desired_width(f32::INFINITY).id_salt(("comment-edit", key)));
+                    let r = ui.add(crate::widgets::block(text).desired_rows(2).desired_width(f32::INFINITY).id_salt(("comment-edit", key)));
                     if !r.has_focus() && !ui.memory(|m| m.focused().is_some()) {
                         r.request_focus();
                     }
@@ -357,7 +359,7 @@ fn card(
                     // around the button can't fit every language's "Post" exactly, and any overflow
                     // would widen the resizable panel again on every repaint.
                     let r = ui.add(
-                        egui::TextEdit::singleline(&mut view.comments.reply)
+                        crate::widgets::line(&mut view.comments.reply)
                             .hint_text(tl!("Add a reply"))
                             .desired_width(f32::INFINITY)
                             .id_salt(("comment-reply", key)),
@@ -588,3 +590,17 @@ pub(crate) fn header_controls(ui: &mut egui::Ui, info: &DocInfo, view: &mut DocV
     });
     command
 }
+
+#[cfg(test)]
+mod filter {
+    use super::any_contains;
+
+    #[test]
+    fn comments_match_in_any_case_with_turkish_i() {
+        assert!(any_contains(["Ayşe Yılmaz", "Lütfen İMZALAYIN"], "imzalayın"));
+        assert!(any_contains(["Ayşe Yılmaz"], "YILMAZ"));
+        assert!(any_contains(["IRMAK"], "ırmak"));
+        assert!(any_contains(["Note"], "NOTE"));
+        assert!(!any_contains(["Ayşe Yılmaz"], "mehmet"));
+    }
+}
diff --git a/crates/ui-egui/src/content_ui.rs b/crates/ui-egui/src/content_ui.rs
index 1dab43e3..fdabe8b3 100644
--- a/crates/ui-egui/src/content_ui.rs
+++ b/crates/ui-egui/src/content_ui.rs
@@ -337,6 +337,8 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
     let memo = &view.content.undrawable;
     egui::Area::new(egui::Id::new(("added-text", view.id.0))).order(egui::Order::Foreground).fixed_pos(r.min).show(ctx, |ui| {
         let Some(t) = view.content.draft.as_mut() else { return };
+        // The box is white in every theme, so the caret must not follow the theme (pale in dark mode) (#655).
+        ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(Color32::WHITE);
         let [cr, cg, cb] = t.style.color.map(|v| (v.clamp(0.0, 1.0) * 255.0) as u8);
         ui.horizontal_top(|ui| {
             ui.spacing_mut().item_spacing.x = 4.0;
@@ -362,8 +364,8 @@ pub(crate) fn editor(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, ad
                 .show(ui, |ui| {
                     ui.spacing_mut().item_spacing = egui::vec2(2.0, 2.0);
                     ui.horizontal(|ui| {
-                        done = crate::icons::button(ui, "check", 24.0, false, "Done adding text").clicked();
-                        cancel = crate::icons::button(ui, "x", 24.0, false, "Discard this text (Esc)").clicked();
+                        done = crate::icons::button(ui, "check", 24.0, false, tl!("Done adding text")).clicked();
+                        cancel = crate::icons::button(ui, "x", 24.0, false, tl!("Discard this text (Esc)")).clicked();
                     });
                 })
                 .response
@@ -521,6 +523,9 @@ impl crate::PdfCraftApp {
     /// Edit text & images ▸ Save Image As.
     pub(crate) fn save_page_image(&mut self, page: usize, index: usize) {
         let Some((_, id)) = self.active_ids() else { return };
+        if !self.may_copy(id) {
+            return;
+        }
         let file = self.session.get(id).map(|d| d.page_image_file(page, index));
         match file {
             Some(Ok((ext, bytes))) => {
diff --git a/crates/ui-egui/src/control.rs b/crates/ui-egui/src/control.rs
index 80bfec29..bba7108c 100644
--- a/crates/ui-egui/src/control.rs
+++ b/crates/ui-egui/src/control.rs
@@ -678,6 +678,7 @@ impl Host for crate::PdfCraftApp {
                 crate::QuickTool::Select => "select".to_string(),
                 crate::QuickTool::Hand => "hand".to_string(),
                 crate::QuickTool::Crop => "crop".to_string(),
+                crate::QuickTool::EnhanceCamera => "enhance-camera".to_string(),
                 crate::QuickTool::Redact => "redact".to_string(),
                 crate::QuickTool::AddText => "add-text".to_string(),
                 crate::QuickTool::EditText => "edit-text".to_string(),
diff --git a/crates/ui-egui/src/create_multiple_ui.rs b/crates/ui-egui/src/create_multiple_ui.rs
index f297306b..19b15c5e 100644
--- a/crates/ui-egui/src/create_multiple_ui.rs
+++ b/crates/ui-egui/src/create_multiple_ui.rs
@@ -4,38 +4,69 @@
 
 use std::sync::Arc;
 
+use pdfcraft_engine::EditError;
+
 use crate::PdfCraftApp;
 
 fn stem(name: &str) -> &str {
     name.rsplit_once('.').map_or(name, |(s, _)| s)
 }
 
+/// Why Create Multiple stopped early: a picked file couldn't be read, or the PDF couldn't be made.
+enum Stop {
+    Read { name: String, error: String },
+    Build(EditError),
+}
+
+impl From<EditError> for Stop {
+    fn from(e: EditError) -> Self {
+        Stop::Build(e)
+    }
+}
+
 impl PdfCraftApp {
     /// Convert the picked files, join them in the order picked, and open the result in the page
-    /// grid. A file that can't be converted is left out (and named in a notice).
-    pub(crate) fn stage_create_multiple(&mut self, files: Vec<(String, Vec<u8>)>) {
-        let max = pdfcraft_engine::MAX_CREATE_FILES;
-        let too_many = files.len() > max;
-        let (mut sources, mut refused) = (Vec::new(), Vec::new());
-        for (name, bytes) in files.into_iter().take(max) {
-            match self.session.convert_to_pdf(&name, &Arc::new(bytes)) {
-                Ok((_, pdf)) => sources.push((stem(&name).to_string(), pdf, None)),
-                Err(_) => refused.push(name),
+    /// grid. A file that can't be converted is left out (and named in a notice); a file that can't be
+    /// read stops the run. Files are read as their turn comes, so one file's bytes are held at a time.
+    pub(crate) fn stage_create_multiple<I>(&mut self, files: I)
+    where
+        I: IntoIterator<Item = Result<(String, Vec<u8>), (String, String)>>,
+    {
+        let (mut refused, mut converted) = (Vec::new(), 0usize);
+        let mut files = files.into_iter();
+        let session = &self.session;
+        let sources = std::iter::from_fn(|| {
+            loop {
+                match files.next()? {
+                    Ok((name, bytes)) => match session.convert_to_pdf(&name, &Arc::new(bytes)) {
+                        Ok((_, pdf)) => {
+                            converted += 1;
+                            return Some(Ok((stem(&name).to_string(), pdf, None)));
+                        }
+                        Err(_) => refused.push(name),
+                    },
+                    Err((name, error)) => return Some(Err(Stop::Read { name, error })),
+                }
+            }
+        });
+        let bytes = match session.combine_each(sources) {
+            Ok(Some(bytes)) => bytes,
+            Ok(None) => {
+                self.notify_tr("None of those files can be made into a PDF; use PDFs, images or .txt files");
+                return;
+            }
+            Err(Stop::Read { name, error }) => {
+                self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &error)]);
+                return;
+            }
+            Err(Stop::Build(e)) => {
+                self.notify_fmt("Couldn't create a PDF: {e}", &[("e", &e.to_string())]);
+                return;
             }
-        }
-        if sources.is_empty() {
-            self.notify_tr("None of those files can be made into a PDF; use PDFs, images or .txt files");
-            return;
-        }
-        let bytes = match self.session.combine_ranges(&sources) {
-            Ok(bytes) => bytes,
-            Err(e) => return self.notify_fmt("Couldn't create a PDF: {e}", &[("e", &e.to_string())]),
         };
-        let n = sources.len().to_string();
+        let n = converted.to_string();
         let message = if !refused.is_empty() {
             crate::i18n::fmt(tl!("Created a PDF from {n} files; left out: {names}"), &[("n", &n), ("names", &refused.join(", "))])
-        } else if too_many {
-            crate::i18n::fmt(tl!("Created a PDF from the first {n} files"), &[("n", &n)])
         } else {
             crate::i18n::fmt(tl!("Created a PDF from {n} files"), &[("n", &n)])
         };
diff --git a/crates/ui-egui/src/dialogs.rs b/crates/ui-egui/src/dialogs.rs
index 1da3a215..812b6c21 100644
--- a/crates/ui-egui/src/dialogs.rs
+++ b/crates/ui-egui/src/dialogs.rs
@@ -10,6 +10,12 @@ use crate::{CloseRequest, Dialog, PdfCraftApp, PropsTab, panels::human_size, wid
 const INFO_KEYS: [&str; 4] = ["Title", "Author", "Subject", "Keywords"];
 
 pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    dialogs(app, ctx);
+    // Last, so it sits above Document Properties when Security's Unlock… asked for it.
+    unlock(app, ctx);
+}
+
+fn dialogs(app: &mut PdfCraftApp, ctx: &egui::Context) {
     password(app, ctx);
     save_prompt(app, ctx);
     link_prompt(app, ctx);
@@ -62,7 +68,7 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
     let t = Tokens::get(ctx);
     let mut close = false;
     let mut next = dialog;
-    let modal = egui::Modal::new(egui::Id::new("dialog")).show(ctx, |ui| {
+    let modal = widgets::show_modal(ctx, "dialog", |ui| {
         ui.set_width(match dialog {
             Dialog::Properties(_) => 640.0,
             Dialog::Print => 820.0,
@@ -70,14 +76,6 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
             Dialog::About => 780.0,
             _ => 520.0,
         });
-        // Dialog controls are outlined (radio buttons, check boxes, combo boxes and number fields
-        // would otherwise blend into the dialog, whose fill matches the theme's field colour).
-        let w = &mut ui.visuals_mut().widgets;
-        w.inactive.bg_stroke = egui::Stroke::new(1.0, t.border);
-        w.inactive.weak_bg_fill = t.field;
-        // Slider rails and check-box interiors use the plain fill.
-        w.inactive.bg_fill = t.hover;
-        w.hovered.bg_stroke = egui::Stroke::new(1.0, t.text_muted);
         match dialog {
             Dialog::CreateImages => {
                 let (go, cancel) = crate::create_ui::image_import_body(ui, app);
@@ -88,7 +86,7 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
             Dialog::Properties(tab) => {
                 ui.label(egui::RichText::new(tl!("Document Properties")).font(theme::semibold(18.0)));
                 ui.add_space(8.0);
-                ui.horizontal(|ui| {
+                ui.horizontal_wrapped(|ui| {
                     for (tb, label) in [
                         (PropsTab::Description, tl!("Description")),
                         (PropsTab::InitialView, tl!("Initial View")),
@@ -102,6 +100,7 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                     }
                 });
                 ui.separator();
+                let units = app.units;
                 let Some((_, id)) = app.active_ids() else { return };
                 let Some(doc) = app.session.get(id) else { return };
                 let i = &doc.info;
@@ -119,14 +118,8 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                                 Some((_, draft)) if doc.allows_modification() => {
                                     for (k, v) in INFO_KEYS.iter().zip(draft.iter_mut()) {
                                         let l = ui.label(egui::RichText::new(tl!(k)).color(t.text_muted));
-                                        ui.add(
-                                            egui::TextEdit::singleline(v)
-                                                .desired_width(420.0)
-                                                .background_color(t.field)
-                                                .margin(egui::Margin::symmetric(6, 4))
-                                                .id_salt(("info", *k)),
-                                        )
-                                        .labelled_by(l.id);
+                                        ui.add(widgets::line(v).desired_width(420.0).background_color(t.field).id_salt(("info", *k)))
+                                            .labelled_by(l.id);
                                         ui.end_row();
                                     }
                                 }
@@ -271,8 +264,12 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                                         tl!("User password").to_string()
                                     },
                                 );
-                                if doc.allows_security_change() {
+                                // A restricted document asks for its permissions password first.
+                                if doc.allows_security_change() || doc.can_unlock() {
                                     ui.horizontal(|ui| {
+                                        if doc.can_unlock() && ui.button(tl!("Unlock…")).clicked() {
+                                            link_command = Some("protect.unlock");
+                                        }
                                         if ui.button(tl!("Change settings…")).clicked() {
                                             link_command = Some("protect.password");
                                         }
@@ -324,9 +321,9 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                         PropsTab::Advanced => {
                             row(ui, "PDF version", i.pdf_version.clone());
                             row(ui, "Location", crate::bidi::visual(doc.path.as_deref().unwrap_or_default()).into_owned());
-                            row(ui, "File size", format!("{} ({} bytes)", human_size(i.file_size), i.file_size));
+                            row(ui, "File size", format!("{} ({})", human_size(i.file_size), crate::panels::byte_count(i.file_size)));
                             let p = &i.pages[0];
-                            row(ui, "Page size", format!("{:.2} × {:.2} in", p.width / 72.0, p.height / 72.0));
+                            row(ui, "Page size", units.size(f64::from(p.width), f64::from(p.height)));
                             row(ui, "Number of pages", i.pages.len().to_string());
                             row(ui, "Tagged PDF", yes(i.tagged));
                             row(ui, "Form fields", i.fields.len().to_string());
@@ -366,7 +363,7 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                                 let l = ui.label(egui::RichText::new(tl!("Language")).color(t.text_muted));
                                 let mut lang = v.language.clone().unwrap_or_default();
                                 if ui
-                                    .add_enabled(editable, egui::TextEdit::singleline(&mut lang).hint_text(tl!("e.g. en-US")).desired_width(160.0))
+                                    .add_enabled(editable, widgets::line(&mut lang).hint_text(tl!("e.g. en-US")).desired_width(160.0))
                                     .labelled_by(l.id)
                                     .changed()
                                 {
@@ -949,15 +946,6 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 let d = &mut app.number_draft;
                 d.to = d.to.clamp(1, n);
                 d.from = d.from.clamp(1, d.to);
-                // Editable values get a visible border (the dialog and field fills are alike).
-                let boxed = |ui: &mut egui::Ui, add: &mut dyn FnMut(&mut egui::Ui) -> egui::Response| {
-                    egui::Frame::new()
-                        .stroke(egui::Stroke::new(1.0, t.border))
-                        .corner_radius(egui::CornerRadius::same(5))
-                        .inner_margin(egui::Margin::symmetric(4, 1))
-                        .show(ui, |ui| add(ui))
-                        .inner
-                };
                 egui::Grid::new("number_pages").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
                     ui.label(tl!("Pages"));
                     ui.horizontal(|ui| {
@@ -984,8 +972,7 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                     });
                     ui.end_row();
                     let l = ui.label(tl!("Prefix"));
-                    boxed(ui, &mut |ui| ui.add(egui::TextEdit::singleline(&mut d.prefix).desired_width(160.0).frame(egui::Frame::NONE)))
-                        .labelled_by(l.id);
+                    ui.add(widgets::line(&mut d.prefix).desired_width(160.0)).labelled_by(l.id);
                     ui.end_row();
                     ui.label(tl!("Start"));
                     ui.add(egui::DragValue::new(&mut d.start).range(1..=99_999));
@@ -1085,7 +1072,7 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 // Tabs About · Contributors · Models (craftrules standards/contributors.md).
                 let tab_id = egui::Id::new("about_tab");
                 let mut tab = ui.data_mut(|d| d.get_temp::<u8>(tab_id)).unwrap_or(0);
-                ui.horizontal(|ui| {
+                ui.horizontal_wrapped(|ui| {
                     for (i, label) in ["About", "Contributors", "Models"].into_iter().enumerate() {
                         let i = i as u8;
                         if widgets::mode_tab(ui, tl!(label), tab == i).clicked() {
@@ -1128,7 +1115,7 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                 }
             }
         }
-        ui.add_space(12.0);
+        ui.add_space(16.0);
         let changed = draft_changes(app).is_some_and(|c| !c.is_empty());
         ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
             if dialog == Dialog::Recovery {
@@ -1397,7 +1384,7 @@ fn save_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
     // the prompt taller than the window (#236); 80 characters wrap to a few lines.
     let shown = shorten_middle(&name, 80);
     let mut choice: Option<Option<bool>> = None;
-    let modal = egui::Modal::new(egui::Id::new("save_prompt")).show(ctx, |ui| {
+    let modal = widgets::show_modal(ctx, "save_prompt", |ui| {
         ui.set_width(420.0);
         ui.horizontal(|ui| {
             ui.add(crate::icons::image("save", 22.0, t.accent));
@@ -1458,7 +1445,7 @@ fn link_prompt(app: &mut PdfCraftApp, ctx: &egui::Context) {
     let email = pending.url.get(..7).is_some_and(|s| s.eq_ignore_ascii_case("mailto:"));
     let (title, open) = if email { (tl!("Write this email?"), tl!("Open email app")) } else { (tl!("Open this web page?"), tl!("Open link")) };
     let mut choice: Option<bool> = None;
-    let modal = egui::Modal::new(egui::Id::new("link_prompt")).show(ctx, |ui| {
+    let modal = widgets::show_modal(ctx, "link_prompt", |ui| {
         ui.set_width(460.0);
         ui.horizontal(|ui| {
             ui.add(crate::icons::image("external-link", 22.0, t.accent));
@@ -1518,47 +1505,83 @@ fn yes(b: bool) -> String {
     tl!(if b { "Yes" } else { "No" }).to_string()
 }
 
-/// Password prompt for encrypted documents (Acrobat: "Password" dialog on open).
-fn password(app: &mut PdfCraftApp, ctx: &egui::Context) {
-    let Some(prompt) = app.password_prompt.as_mut() else { return };
+/// What a password box was answered with.
+enum PasswordAnswer {
+    Submit,
+    Cancel,
+}
+
+/// A password box: a lock, a title, a message, the masked field, an error and two buttons.
+fn password_modal(
+    ctx: &egui::Context,
+    id: &str,
+    title: &str,
+    message: String,
+    input: &mut String,
+    error: Option<&str>,
+    ok: &str,
+) -> Option<PasswordAnswer> {
     let t = Tokens::get(ctx);
-    let mut submit = false;
-    let mut cancel = false;
-    let modal = egui::Modal::new(egui::Id::new("password")).show(ctx, |ui| {
+    let mut answer = None;
+    let modal = widgets::show_modal(ctx, id, |ui| {
         ui.set_width(400.0);
         ui.horizontal(|ui| {
             ui.add(crate::icons::image("lock", 22.0, t.accent));
-            ui.label(egui::RichText::new(tl!("Password required")).font(theme::semibold(17.0)));
+            ui.label(egui::RichText::new(title).font(theme::semibold(17.0)));
         });
         ui.add_space(6.0);
-        ui.add(egui::Label::new(crate::i18n::fmt(tl!("“{name}” is protected. Enter a password to open it."), &[("name", &prompt.name)])).wrap());
+        ui.add(egui::Label::new(message).wrap());
         ui.add_space(8.0);
-        let r = ui.add(egui::TextEdit::singleline(&mut prompt.input).password(true).hint_text(tl!("Password")).desired_width(f32::INFINITY));
+        let r = ui.add(widgets::line(input).password(true).hint_text(tl!("Password")).desired_width(f32::INFINITY));
         // Enter submits. The field keeps focus (we request it every frame), so check the key
         // while it is focused as well as on the frame focus is lost.
         if (r.has_focus() || r.lost_focus()) && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
-            submit = true;
+            answer = Some(PasswordAnswer::Submit);
         }
         r.request_focus();
-        if let Some(e) = &prompt.error {
+        if let Some(e) = error {
             ui.add_space(4.0);
             // Known error text is translated; anything else passes through.
             ui.label(egui::RichText::new(tl!(e)).color(egui::Color32::from_rgb(0xD1, 0x3B, 0x3B)));
         }
         ui.add_space(12.0);
         ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if widgets::pill_button(ui, tl!("Open"), true).clicked() {
-                submit = true;
+            if widgets::pill_button(ui, ok, true).clicked() {
+                answer = Some(PasswordAnswer::Submit);
             }
             if widgets::pill_button(ui, tl!("Cancel"), false).clicked() {
-                cancel = true;
+                answer = Some(PasswordAnswer::Cancel);
             }
         });
     });
-    if submit {
-        let pw = prompt.input.clone();
-        app.submit_password(Some(pw));
-    } else if cancel || modal.should_close() {
-        app.submit_password(None);
+    answer.or(modal.should_close().then_some(PasswordAnswer::Cancel))
+}
+
+/// Password prompt for encrypted documents (Acrobat: "Password" dialog on open).
+fn password(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(prompt) = app.password_prompt.as_mut() else { return };
+    let message = crate::i18n::fmt(tl!("“{name}” is protected. Enter a password to open it."), &[("name", &prompt.name)]);
+    match password_modal(ctx, "password", tl!("Password required"), message, &mut prompt.input, prompt.error.as_deref(), tl!("Open")) {
+        Some(PasswordAnswer::Submit) => {
+            let pw = prompt.input.clone();
+            app.submit_password(Some(pw));
+        }
+        Some(PasswordAnswer::Cancel) => app.submit_password(None),
+        None => {}
+    }
+}
+
+/// Permissions password prompt: lifts the restrictions of an open document (#995).
+fn unlock(app: &mut PdfCraftApp, ctx: &egui::Context) {
+    let Some(prompt) = app.unlock_prompt.as_mut() else { return };
+    let message =
+        crate::i18n::fmt(tl!("“{name}” has security restrictions. Enter its permissions password to lift them."), &[("name", &prompt.name)]);
+    match password_modal(ctx, "unlock", tl!("Permissions password"), message, &mut prompt.input, prompt.error.as_deref(), tl!("Unlock")) {
+        Some(PasswordAnswer::Submit) => {
+            let pw = prompt.input.clone();
+            app.submit_unlock(Some(pw));
+        }
+        Some(PasswordAnswer::Cancel) => app.submit_unlock(None),
+        None => {}
     }
 }
diff --git a/crates/ui-egui/src/docking.rs b/crates/ui-egui/src/docking.rs
index 3d0b6fd3..9c90e456 100644
--- a/crates/ui-egui/src/docking.rs
+++ b/crates/ui-egui/src/docking.rs
@@ -348,7 +348,7 @@ pub fn show(app: &mut crate::PdfCraftApp, ui: &mut egui::Ui) {
     let t = crate::theme::Tokens::get(ui.ctx());
     let mut workspace = std::mem::take(&mut app.docking);
     if let Err(error) = workspace.validate().and_then(|()| sync(&mut workspace, app)) {
-        app.notify(format!("Panel layout could not be restored: {error}"));
+        app.notify_fmt("Panel layout could not be restored: {error}", &[("error", &error)]);
         workspace = Workspace::default();
         let _ = sync(&mut workspace, app);
     }
@@ -411,7 +411,7 @@ pub fn show(app: &mut crate::PdfCraftApp, ui: &mut egui::Ui) {
         if let Err(error) =
             serde_json::to_value(action).map_err(|error| error.to_string()).and_then(|action| command(app, false, &json!({"action": action})))
         {
-            app.notify(format!("Panel move was not applied: {error}"));
+            app.notify_fmt("Panel move was not applied: {error}", &[("error", &error)]);
         }
     }
 }
diff --git a/crates/ui-egui/src/edit_text_ui.rs b/crates/ui-egui/src/edit_text_ui.rs
index 556d0b38..9cf38e40 100644
--- a/crates/ui-egui/src/edit_text_ui.rs
+++ b/crates/ui-egui/src/edit_text_ui.rs
@@ -561,7 +561,7 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
             // banner, #913): then a dark box, with a caret that shows on it.
             let fill = editor_fill(text_color);
             egui::Frame::NONE.fill(fill).stroke(Stroke::new(1.5, ACCENT)).inner_margin(egui::Margin::symmetric(2, 0)).show(ui, |ui| {
-                ui.visuals_mut().text_cursor.stroke.color = if fill == Color32::WHITE { Color32::BLACK } else { Color32::WHITE };
+                ui.visuals_mut().text_cursor.stroke.color = caret_color_on(fill);
                 let rows = ed.text.lines().count().max(1);
                 let r = ui.add(
                     egui::TextEdit::multiline(&mut ed.text)
@@ -601,6 +601,12 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo) -
     }
 }
 
+/// Caret colour that stays visible on a field filled with `fill`: black on light fills, white on dark ones.
+pub(crate) fn caret_color_on(fill: Color32) -> Color32 {
+    let luma = 299 * u32::from(fill.r()) + 587 * u32::from(fill.g()) + 114 * u32::from(fill.b());
+    if luma > 127_500 { Color32::BLACK } else { Color32::WHITE }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -617,4 +623,12 @@ mod tests {
             assert_eq!(editor_fill(dark), Color32::WHITE, "{dark:?}");
         }
     }
+
+    #[test]
+    fn caret_contrasts_with_its_fill() {
+        assert_eq!(caret_color_on(Color32::WHITE), Color32::BLACK);
+        assert_eq!(caret_color_on(Color32::from_rgb(0xFF, 0xFF, 0xF4)), Color32::BLACK);
+        assert_eq!(caret_color_on(Color32::BLACK), Color32::WHITE);
+        assert_eq!(caret_color_on(DARK_EDITOR_FILL), Color32::WHITE);
+    }
 }
diff --git a/crates/ui-egui/src/editing.rs b/crates/ui-egui/src/editing.rs
index 2cf6041b..81fb1f2a 100644
--- a/crates/ui-egui/src/editing.rs
+++ b/crates/ui-egui/src/editing.rs
@@ -32,16 +32,74 @@ impl PdfCraftApp {
     pub fn apply_edit(&mut self, edit: Edit) -> bool {
         let Some((i, id)) = self.active_ids() else { return false };
         let label = edit.label();
+        let (form_before, page_count_before, had_xfa) = if let Some(d) = self.session.get(id) {
+            (Some(std::sync::Arc::clone(&d.form)), d.info.pages.len(), d.xfa.is_some())
+        } else {
+            (None, 0, false)
+        };
         match self.session.apply(id, edit.clone()) {
             Ok(()) => {
                 let Some(doc) = self.session.get(id) else { return true };
                 let info = &doc.info;
                 let view = &mut self.views[i];
                 view.signature_drag.committed(&edit, doc.edit_generation());
-                match comment_page(&edit) {
+                if let Some(page) = comment_page(&edit) {
                     // Comment edits change one page: keep every other raster.
-                    Some(page) => view.page_changed(page),
-                    None => view.document_changed(info),
+                    view.page_changed(page);
+                } else if let Some(form_before) = form_before
+                    && doc.info.pages.len() == page_count_before
+                    && doc.xfa.is_some() == had_xfa
+                    && !doc.xfa.is_some()
+                    && is_form_edit(&edit)
+                {
+                    let mut changed_pages = std::collections::BTreeSet::new();
+                    for f in doc.form.iter() {
+                        match form_before.iter().find(|old| old.name == f.name) {
+                            Some(old) => {
+                                if old != f {
+                                    for w in &f.widgets {
+                                        if let Some(p) = w.page {
+                                            changed_pages.insert(p);
+                                        }
+                                    }
+                                    for w in &old.widgets {
+                                        if let Some(p) = w.page {
+                                            changed_pages.insert(p);
+                                        }
+                                    }
+                                    if old.value != f.value {
+                                        for w in &f.widgets {
+                                            if let Some(p) = w.page {
+                                                view.forms.unbaked.insert((f.name.clone(), p));
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                            None => {
+                                for w in &f.widgets {
+                                    if let Some(p) = w.page {
+                                        changed_pages.insert(p);
+                                        view.forms.unbaked.insert((f.name.clone(), p));
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    for old in form_before.iter() {
+                        if !doc.form.iter().any(|f| f.name == old.name) {
+                            for w in &old.widgets {
+                                if let Some(p) = w.page {
+                                    changed_pages.insert(p);
+                                }
+                            }
+                        }
+                    }
+                    for page in changed_pages {
+                        view.page_changed(page);
+                    }
+                } else {
+                    view.document_changed(info);
                 }
                 // Keep the pages the user acted on selected, where they now are.
                 match edit {
@@ -86,7 +144,7 @@ impl PdfCraftApp {
             }
             Err(e) => {
                 let message = if matches!(edit, Edit::MoveObjects { .. }) { crate::object_ui::move_error(&e) } else { e.to_string() };
-                self.notify_fmt("{label} failed: {e}", &[("label", &crate::i18n::action_label(&label)), ("e", &message)]);
+                self.notify_fmt("{label} failed: {e}", &[("label", &crate::i18n::edit_label(&label)), ("e", &message)]);
                 false
             }
         }
@@ -118,7 +176,7 @@ impl PdfCraftApp {
                     self.views[i].document_changed(&doc.info);
                 }
                 self.views[i].comments.selected = None;
-                let label = crate::i18n::action_label(&label);
+                let label = crate::i18n::edit_label(&label);
                 if undo {
                     self.notify_fmt("Undid {label}", &[("label", &label)]);
                 } else {
@@ -148,11 +206,123 @@ impl PdfCraftApp {
             Some(crate::canvas::ViewAction::Split) => self.dialog = Some(crate::Dialog::Split),
             Some(crate::canvas::ViewAction::CopyPages { cut }) => self.copy_pages(cut),
             Some(crate::canvas::ViewAction::PastePages) => self.paste_pages(),
+            Some(crate::canvas::ViewAction::EnhanceCamera) => self.enhance_camera(i),
+            Some(crate::canvas::ViewAction::CancelCamera) => self.leave_camera(i),
+            Some(crate::canvas::ViewAction::CameraRotate { clockwise }) => {
+                if let Some(done) = self.views.get(i).and_then(|v| v.camera_done) {
+                    let degrees = if clockwise { 90 } else { -90 };
+                    if self.apply_edit(Edit::RotatePages { pages: vec![done.page], degrees })
+                        && let Some(d) = self.views.get_mut(i).and_then(|v| v.camera_done.as_mut())
+                    {
+                        d.turns += degrees;
+                        d.steps += 1;
+                    }
+                }
+            }
+            Some(crate::canvas::ViewAction::CameraLevel) => self.camera_level(i),
+            Some(crate::canvas::ViewAction::CameraNext(command)) => {
+                self.leave_camera(i);
+                self.execute(command);
+            }
             None => {}
         }
         applied
     }
 
+    /// Enhance ▸ Camera image ▸ clean-up slider: undo the enhancement (and the turns made since)
+    /// and enhance again from the photo at the new level, turning it as before. Only when the
+    /// top of the undo history is still those steps; otherwise the slider goes back.
+    fn camera_level(&mut self, i: usize) {
+        let Some(view) = self.views.get(i) else { return };
+        let (id, Some(done)) = (view.id, view.camera_done) else { return };
+        let ours = |s: &pdfcraft_engine::Session, k: usize| {
+            let label = s.get(id).and_then(|d| d.can_undo().map(str::to_owned));
+            let want = if k + 1 == done.steps { "Enhance camera image" } else { "Rotate page" };
+            label.as_deref() == Some(want)
+        };
+        // Undo the run this tool applied, checking each step's label first. If the run was
+        // broken (another edit came in between), redo what was undone and leave the page alone:
+        // enhancing a page that is still straightened would warp it a second time.
+        let restore = |app: &mut Self| {
+            if let Some(d) = app.views.get_mut(i).and_then(|v| v.camera_done.as_mut()) {
+                (d.look, d.level) = d.applied;
+            }
+        };
+        let mut undone = 0;
+        while undone < done.steps && ours(&self.session, undone) && self.session.undo(id).is_ok() {
+            undone += 1;
+        }
+        if undone < done.steps {
+            for _ in 0..undone {
+                if self.session.redo(id).is_err() {
+                    break;
+                }
+            }
+            restore(self);
+            return;
+        }
+        let result = self.session.enhance_camera_page_at(id, done.page, done.corners, done.look, done.level).and_then(|()| {
+            let turn = done.turns.rem_euclid(360);
+            if turn == 0 { Ok(1) } else { self.session.apply(id, Edit::RotatePages { pages: vec![done.page], degrees: turn }).map(|()| 2) }
+        });
+        if let (Some(doc), Some(view)) = (self.session.get(id), self.views.get_mut(i)) {
+            view.document_changed(&doc.info);
+            if let Some(d) = view.camera_done.as_mut() {
+                match result {
+                    Ok(steps) => {
+                        d.applied = (d.look, d.level);
+                        d.steps = steps;
+                    }
+                    Err(_) => (d.look, d.level) = d.applied,
+                }
+            }
+        }
+        if let Err(e) = result {
+            let label = crate::i18n::action_label("Enhance camera image");
+            self.notify_fmt("{label} failed: {e}", &[("label", &label), ("e", &e.to_string())]);
+        }
+    }
+
+    /// Leave Enhance ▸ Camera image on tab `i`.
+    fn leave_camera(&mut self, i: usize) {
+        if let Some(view) = self.views.get_mut(i) {
+            view.camera = None;
+            view.camera_done = None;
+        }
+        if self.quick_tool == crate::QuickTool::EnhanceCamera {
+            self.quick_tool = crate::QuickTool::Select;
+        }
+    }
+
+    /// Enhance ▸ Camera image: straighten what the corners on tab `i` enclose. On success the
+    /// bar offers rotate, crop and organize for the page; on failure the corners stay so they
+    /// can be adjusted.
+    fn enhance_camera(&mut self, i: usize) {
+        let Some(view) = self.views.get(i) else { return };
+        let (id, Some(q)) = (view.id, view.camera) else { return };
+        let Some(page) = self.session.get(id).and_then(|d| d.info.pages.get(q.page).cloned()) else { return };
+        let corners = q.corners.map(|[x, y]| {
+            let [u, v] = page.view_to_user(x, y);
+            [u as f64, v as f64]
+        });
+        let (look, level) = (crate::camera_ui::Look::Colour, crate::camera_ui::DEFAULT_LEVEL);
+        match self.session.enhance_camera_page_at(id, q.page, corners, look, level) {
+            Ok(()) => {
+                // The tool stays open with the clean-up slider, rotate, crop and organize.
+                if let (Some(doc), Some(view)) = (self.session.get(id), self.views.get_mut(i)) {
+                    view.document_changed(&doc.info);
+                    view.camera = None;
+                    view.camera_done =
+                        Some(crate::camera_ui::CameraDone { page: q.page, corners, look, level, applied: (look, level), turns: 0, steps: 1 });
+                }
+            }
+            Err(e) => {
+                let label = crate::i18n::action_label("Enhance camera image");
+                self.notify_fmt("{label} failed: {e}", &[("label", &label), ("e", &e.to_string())]);
+            }
+        }
+    }
+
     /// Organize ▸ Copy / Cut: remember the selected pages (the document as it is now); Cut also
     /// deletes them (one page always stays).
     pub fn copy_pages(&mut self, cut: bool) {
@@ -238,6 +408,19 @@ impl PdfCraftApp {
             _ => false,
         };
         if self.apply_edit(edit) {
+            // Tab can wrap to the same field (including another widget of that field).
+            // Its new editor was opened before this edit ran, so it still holds the old
+            // value. Refresh from the accepted form before Save can commit that stale draft.
+            if typed
+                && let Some(view) = self.views.get_mut(i)
+                && let Some(focus) = view.forms.focus.as_mut()
+                && focus.request_focus
+                && committed.as_ref().is_some_and(|draft| draft.name == focus.name)
+                && let Some(field) = self.session.get(view.id).and_then(|doc| doc.form.iter().find(|field| field.name == focus.name))
+            {
+                focus.text = field.value.first().cloned().unwrap_or_default();
+                focus.picked = field.value.clone();
+            }
             if let Some(page) = signature_page
                 && let Some(view) = self.views.get_mut(i)
             {
@@ -384,7 +567,9 @@ impl PdfCraftApp {
         {
             let destination = match (target, path, &self.save_override) {
                 (_, _, Some(p)) => p.clone(),
-                (SaveTarget::InPlace, Some(p), _) => p,
+                // An email attachment's temporary copy is no place to keep work: ask, as for a new
+                // document (`is_mail_temp_copy`).
+                (SaveTarget::InPlace, Some(p), _) if !is_mail_temp_copy(&p) => p,
                 _ => {
                     let name = if name.to_ascii_lowercase().ends_with(".pdf") { name } else { format!("{name}.pdf") };
                     let dialog = rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).set_file_name(name);
@@ -473,6 +658,8 @@ impl PdfCraftApp {
             self.notify_fmt("Couldn't save {name}: {e}", &[("name", dest), ("e", &e.to_string())]);
             return false;
         }
+        // Our own write is not a change on disk to reload (#431).
+        self.watch.known_now(id, dest);
         match self.session.mark_saved(id, bytes, Some(dest.to_string())) {
             Ok(()) => {
                 self.forget_recovery(id);
@@ -480,6 +667,8 @@ impl PdfCraftApp {
                     && let Some(view) = self.views.iter_mut().find(|v| v.id == id)
                 {
                     view.document_changed(&doc.info);
+                    // Saving over a version that changed on disk keeps this one: nothing to ask.
+                    view.disk_changed = false;
                 }
                 self.notify_fmt("Saved {name}", &[("name", &short_name(dest))]);
                 true
@@ -529,6 +718,7 @@ impl PdfCraftApp {
                     // Otherwise a later Save could write a rejected draft back into the file.
                     view.forms.focus = None;
                     view.forms.committed = None;
+                    view.forms.unbaked.clear();
                     view.pending_edit = None;
                 }
                 self.notify_tr("Reverted to the last saved version");
@@ -660,6 +850,38 @@ fn comment_page(edit: &Edit) -> Option<usize> {
     }
 }
 
+/// Whether `edit` is a form-related modification.
+fn is_form_edit(edit: &Edit) -> bool {
+    matches!(
+        edit,
+        Edit::SetFieldValue { .. }
+            | Edit::ResetForm { .. }
+            | Edit::AddField { .. }
+            | Edit::DeleteField { .. }
+            | Edit::DuplicateField { .. }
+            | Edit::SetFieldProps { .. }
+            | Edit::SetFieldImage { .. }
+            | Edit::SetFieldScript { .. }
+            | Edit::ApplyScriptChanges { .. }
+    )
+}
+
+/// Whether `path` is the temporary copy an email client opened an attachment from, so that Save
+/// asks where to keep the document instead of writing to it.
+///
+/// Outlook opens an attachment from its own cache: `INetCache\Content.Outlook\<random>\` for
+/// classic Outlook (`Temporary Internet Files\Content.Outlook\` on older Windows), and the
+/// `Microsoft.OutlookForWindows` package folder for the new Outlook. Saving there either fails,
+/// because Outlook can still hold the file, or appears to work while the edits stay out of the
+/// email and are deleted with the cache. Matched on either separator and in any case, so it can
+/// be tested on every platform.
+pub(crate) fn is_mail_temp_copy(path: &str) -> bool {
+    let p = path.replace('\\', "/").to_ascii_lowercase();
+    p.contains("/inetcache/content.outlook/")
+        || p.contains("/temporary internet files/content.outlook/")
+        || p.contains("/microsoft.outlookforwindows")
+}
+
 /// Write via a temporary file in the same directory and rename over the target, so a crash or
 /// full disk never leaves a half-written PDF where the original was.
 pub fn write_atomically(path: &str, bytes: &[u8]) -> std::io::Result<()> {
@@ -773,7 +995,7 @@ fn bookmark_at<'a>(items: &'a [pdfcraft_render::OutlineItem], path: &[usize]) ->
 
 #[cfg(test)]
 mod tests {
-    use super::{write_atomically, write_atomically_with};
+    use super::{SaveTarget, is_mail_temp_copy, write_atomically, write_atomically_with};
     use pdfcraft_platform::staging::{STAGING_ATTEMPTS, staging_suffixes};
     use std::path::{Path, PathBuf};
 
@@ -930,6 +1152,81 @@ mod tests {
         std::fs::set_permissions(&target, perms).unwrap();
         let _ = std::fs::remove_dir_all(&dir);
     }
+    #[test]
+    fn outlook_attachment_copies_are_recognised_on_either_separator_and_in_any_case() {
+        for p in [
+            r"C:\Users\me\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\AB12CD34\Quote.pdf",
+            r"c:\users\me\appdata\local\microsoft\windows\inetcache\content.outlook\ab12cd34\quote (2).pdf",
+            r"C:\Users\me\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\AB12CD34\Quote.pdf",
+            r"C:\Users\me\AppData\Local\Packages\Microsoft.OutlookForWindows_8wekyb3d8bbwe\LocalCache\Quote.pdf",
+            "C:/Users/me/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/AB12CD34/Quote.pdf",
+        ] {
+            assert!(is_mail_temp_copy(p), "{p}");
+        }
+    }
+
+    #[test]
+    fn ordinary_paths_are_not_mail_copies() {
+        for p in [
+            r"C:\Users\me\Documents\Quote.pdf",
+            r"C:\Users\me\OneDrive - Contoso\Content.Outlook notes\Quote.pdf",
+            r"C:\Users\me\AppData\Local\Microsoft\Windows\INetCache\IE\Quote.pdf",
+            "/home/me/Documents/Quote.pdf",
+            "Quote.pdf",
+        ] {
+            assert!(!is_mail_temp_copy(p), "{p}");
+        }
+    }
+
+    /// A one-page document with a proper xref table.
+    fn one_page_pdf() -> Vec<u8> {
+        let objs = [
+            "<< /Type /Catalog /Pages 2 0 R >>",
+            "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>",
+            "<< /Type /Page /Parent 2 0 R >>",
+        ];
+        let mut out = b"%PDF-1.7\n".to_vec();
+        let mut offsets = Vec::new();
+        for (i, o) in objs.iter().enumerate() {
+            offsets.push(out.len());
+            out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+        }
+        let xref = out.len();
+        out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+        for o in offsets {
+            out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+        }
+        out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+        out
+    }
+
+    #[test]
+    fn save_asks_where_to_keep_an_email_attachment_and_leaves_the_temporary_copy_alone() {
+        let dir = staging_dir("mail-temp");
+        let cache = dir.join("INetCache").join("Content.Outlook").join("AB12CD34");
+        std::fs::create_dir_all(&cache).unwrap();
+        let attachment = cache.join("Quote.pdf");
+        let original = one_page_pdf();
+        std::fs::write(&attachment, &original).unwrap();
+        let kept = dir.join("Quote.pdf");
+
+        let mut app = crate::PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("Quote.pdf", Some(attachment.to_string_lossy().into_owned()), original.clone()).unwrap();
+        assert!(app.apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 }));
+        app.pick_override = Some(vec![kept.to_string_lossy().into_owned()]);
+
+        assert!(!app.save_active(SaveTarget::InPlace), "Save asks instead of writing the temporary copy");
+        app.process_picked();
+        assert_eq!(std::fs::read(&attachment).unwrap(), original, "the attachment's copy is untouched");
+        assert!(std::fs::read(&kept).unwrap().starts_with(b"%PDF"), "the document went where the user chose");
+
+        // The chosen file is the document's file now: the next Save writes it without asking.
+        app.pick_override = None;
+        assert!(app.apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 }));
+        assert!(app.save_active(SaveTarget::InPlace));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/ui-egui/src/export_ui.rs b/crates/ui-egui/src/export_ui.rs
index f1d9b926..bc6f353a 100644
--- a/crates/ui-egui/src/export_ui.rs
+++ b/crates/ui-egui/src/export_ui.rs
@@ -90,7 +90,9 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: E
     } else if kind == ExportKind::AllImages {
         ui.horizontal(|ui| {
             ui.label(tl!("Exclude images smaller than"));
-            let label = move |n: u32| if n == 0 { tl!("No limit").to_string() } else { format!("{n} pixels") };
+            let label = move |n: u32| {
+                if n == 0 { tl!("No limit").to_string() } else { crate::i18n::trn(crate::i18n::current(), u64::from(n), "{n} pixel", "{n} pixels") }
+            };
             egui::ComboBox::from_id_salt("export-min").selected_text(label(d.min_side)).show_ui(ui, |ui| {
                 for n in [0, 16, 32, 64, 128, 256] {
                     ui.selectable_value(&mut d.min_side, n, label(n));
@@ -221,6 +223,9 @@ impl PdfCraftApp {
             return;
         }
         let Some((_, id)) = self.active_ids() else { return };
+        if !self.may_copy(id) {
+            return;
+        }
         let Some(doc) = self.session.get(id) else { return };
         let src = doc.export_source();
         let stem = doc.name.trim_end_matches(".pdf").trim_end_matches(".PDF").to_string();
diff --git a/crates/ui-egui/src/file_watch.rs b/crates/ui-egui/src/file_watch.rs
new file mode 100644
index 00000000..da8521c8
--- /dev/null
+++ b/crates/ui-egui/src/file_watch.rs
@@ -0,0 +1,377 @@
+//! Reload a document when its file changes on disk (#431): a LaTeX or Typst build rewriting the
+//! PDF that is open shows its new version without reopening it.
+//!
+//! Cheap by design. One worker thread looks at each open file's metadata (no reading) every
+//! [`IDLE`], and blocks without waking at all while no open document has a file. A changed file
+//! is read only once it has stopped changing ([`SETTLE`] apart) and ends like a whole PDF: its
+//! last KiB is read first, so a file still being written costs one small read. The new bytes go
+//! to the UI thread, which is woken for them: a clean document is reloaded in place, keeping its
+//! tab, page, zoom and scroll; one with unsaved changes gets a notice instead. PdfCraft's own
+//! saves are recognised by the file's stamp after writing, so they never reload.
+
+use std::collections::HashMap;
+use std::fs::{File, Metadata};
+use std::io::{Read, Seek, SeekFrom};
+use std::sync::mpsc::{self, RecvTimeoutError};
+use std::sync::{Arc, Mutex, PoisonError};
+use std::time::{Duration, SystemTime};
+
+use pdfcraft_engine::DocId;
+
+use crate::PdfCraftApp;
+
+/// How often an unchanged file is looked at.
+pub const IDLE: Duration = Duration::from_millis(250);
+/// How long a changed file must stay the same before it is read: writers pause between chunks.
+pub const SETTLE: Duration = Duration::from_millis(40);
+/// How much of the end of a changed file is read to see whether it is a whole PDF.
+const TAIL: usize = 1024;
+
+/// One version of a file, told apart without reading it: its length and modification time, and
+/// what the platform adds (Unix: device, inode and change time; Windows: creation and last-write
+/// times in 100 ns ticks). The modification time alone is coarse on FAT and some network
+/// drives, and a rebuild can keep the length.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct Stamp {
+    len: u64,
+    modified: Option<SystemTime>,
+    extra: [u64; 4],
+}
+
+impl Stamp {
+    fn of(meta: &Metadata) -> Self {
+        #[cfg(unix)]
+        let extra = {
+            use std::os::unix::fs::MetadataExt;
+            [meta.dev(), meta.ino(), meta.ctime().cast_unsigned(), meta.ctime_nsec().cast_unsigned()]
+        };
+        #[cfg(windows)]
+        let extra = {
+            use std::os::windows::fs::MetadataExt;
+            [meta.creation_time(), meta.last_write_time(), 0, 0]
+        };
+        #[cfg(not(any(unix, windows)))]
+        let extra = [0; 4];
+        Self { len: meta.len(), modified: meta.modified().ok(), extra }
+    }
+
+    /// The file at `path` now; `None` when it is missing, not a file or can't be read.
+    pub fn at(path: &str) -> Option<Self> {
+        std::fs::metadata(path).ok().filter(Metadata::is_file).map(|m| Self::of(&m))
+    }
+}
+
+/// A file to watch, as the UI thread sees it.
+#[derive(Clone, Debug, PartialEq)]
+pub struct Watched {
+    pub doc: DocId,
+    pub path: String,
+    /// The version PdfCraft last read or wrote (`None`: the first one the watcher sees).
+    pub known: Option<Stamp>,
+}
+
+/// A new version of a watched file, read and ready to open.
+pub struct Changed {
+    pub doc: DocId,
+    pub stamp: Stamp,
+    pub bytes: Arc<Vec<u8>>,
+}
+
+/// The watcher's record of one file.
+struct Entry {
+    doc: DocId,
+    path: String,
+    known: Option<Stamp>,
+    /// A changed version seen once, waiting to be seen unchanged again.
+    pending: Option<Stamp>,
+}
+
+/// Looks at the watched files: on the worker thread, or on the UI thread in tests.
+#[derive(Default)]
+pub struct Watcher {
+    files: Vec<Entry>,
+}
+
+impl Watcher {
+    /// Watch `list` from now on. A file watched already keeps its pending change; a version the
+    /// UI thread knows (it just read or saved the file) replaces the watcher's own.
+    fn set(&mut self, list: Vec<Watched>) {
+        let old = std::mem::take(&mut self.files);
+        self.files = list
+            .into_iter()
+            .map(|w| {
+                let prev = old.iter().find(|e| e.doc == w.doc && e.path == w.path);
+                Entry { known: w.known.or(prev.and_then(|e| e.known)), pending: prev.and_then(|e| e.pending), doc: w.doc, path: w.path }
+            })
+            .collect();
+    }
+
+    /// Look at every file once: the new versions found, and whether a file is still changing
+    /// (look again after [`SETTLE`] rather than [`IDLE`]).
+    fn tick(&mut self) -> (Vec<Changed>, bool) {
+        let mut found = Vec::new();
+        let mut settling = false;
+        for e in &mut self.files {
+            // Missing (deleted, or being replaced) or unreadable: the document stays as it is.
+            let Some(now) = Stamp::at(&e.path) else {
+                e.pending = None;
+                continue;
+            };
+            let known = *e.known.get_or_insert(now);
+            if now == known {
+                e.pending = None;
+                continue;
+            }
+            if e.pending != Some(now) {
+                // Changed since the last look: read it once it stops changing.
+                e.pending = Some(now);
+                settling = true;
+                continue;
+            }
+            e.pending = None;
+            match read_whole_pdf(&e.path, now) {
+                Version::Ready(bytes) => {
+                    e.known = Some(now);
+                    found.push(Changed { doc: e.doc, stamp: now, bytes });
+                }
+                // Not a whole PDF in this version (a build that failed or paused): wait for the
+                // next one.
+                Version::Incomplete => e.known = Some(now),
+                // Changed again while being read, or held by its writer: look again soon.
+                Version::Busy => settling = true,
+            }
+        }
+        (found, settling)
+    }
+}
+
+/// What a changed file turned out to be.
+enum Version {
+    /// A whole PDF, read.
+    Ready(Arc<Vec<u8>>),
+    /// Not a whole PDF: a build that failed or paused.
+    Incomplete,
+    /// Changing, replaced or held by its writer: look again.
+    Busy,
+}
+
+/// Read `path` if it is still the version `stamp` and ends like a whole PDF (`%%EOF` in its last
+/// KiB, read first). The whole file is then read into a buffer of exactly its size.
+fn read_whole_pdf(path: &str, stamp: Stamp) -> Version {
+    // Windows refuses to open a file its writer holds exclusively: not ready yet.
+    let Ok(mut file) = File::open(path) else { return Version::Busy };
+    let Ok(meta) = file.metadata() else { return Version::Busy };
+    if Stamp::of(&meta) != stamp {
+        return Version::Busy;
+    }
+    let len = meta.len();
+    let mut end = [0u8; TAIL];
+    let tail = usize::try_from(len).map_or(TAIL, |l| l.min(TAIL));
+    let (Some(end), Ok(back)) = (end.get_mut(..tail), i64::try_from(tail)) else { return Version::Incomplete };
+    if file.seek(SeekFrom::End(-back)).is_err() || file.read_exact(end).is_err() {
+        return Version::Busy;
+    }
+    if !end.windows(5).any(|w| w == b"%%EOF") {
+        return Version::Incomplete;
+    }
+    let mut bytes = Vec::new();
+    // Too big to hold: the open version stays.
+    let Ok(size) = usize::try_from(len) else { return Version::Incomplete };
+    if bytes.try_reserve_exact(size).is_err() {
+        return Version::Incomplete;
+    }
+    if file.seek(SeekFrom::Start(0)).is_err() || file.read_to_end(&mut bytes).is_err() {
+        return Version::Busy;
+    }
+    // Still that version, under that name: a writer may have replaced the file meanwhile.
+    if bytes.len() != size || Stamp::at(path) != Some(stamp) {
+        return Version::Busy;
+    }
+    Version::Ready(Arc::new(bytes))
+}
+
+/// The worker thread: watches the newest list the UI thread sent and hands back new versions,
+/// waking the UI for them. It ends when the app (its inbox's sender) is gone.
+fn run(inbox: mpsc::Receiver<Vec<Watched>>, out: Arc<Mutex<Vec<Changed>>>, ctx: egui::Context) {
+    let mut watcher = Watcher::default();
+    // `None`: nothing to watch, so block until there is.
+    let mut wait = None;
+    loop {
+        let message = match wait {
+            None => inbox.recv().map_err(|_| RecvTimeoutError::Disconnected),
+            Some(wait) => inbox.recv_timeout(wait),
+        };
+        match message {
+            Ok(list) => watcher.set(list),
+            Err(RecvTimeoutError::Timeout) => {}
+            Err(RecvTimeoutError::Disconnected) => return,
+        }
+        while let Ok(list) = inbox.try_recv() {
+            watcher.set(list);
+        }
+        if watcher.files.is_empty() {
+            wait = None;
+            continue;
+        }
+        let (found, settling) = watcher.tick();
+        if !found.is_empty() {
+            out.lock().unwrap_or_else(PoisonError::into_inner).extend(found);
+            ctx.request_repaint();
+        }
+        wait = Some(if settling { SETTLE } else { IDLE });
+    }
+}
+
+/// The app's side of the watcher.
+#[derive(Default)]
+pub struct FileWatch {
+    /// The worker's inbox (`None` until a document with a file is open).
+    inbox: Option<mpsc::Sender<Vec<Watched>>>,
+    found: Arc<Mutex<Vec<Changed>>>,
+    /// What the watcher was last told.
+    sent: Vec<Watched>,
+    /// In tests ([`PdfCraftApp::run_inline`]) there is no thread: each frame looks once.
+    inline: Watcher,
+    /// The version of each document's file that PdfCraft last read or wrote.
+    known: HashMap<DocId, Stamp>,
+    /// The notice bar's Reload was pressed for this document.
+    pub reload_request: Option<DocId>,
+}
+
+impl FileWatch {
+    /// PdfCraft read or wrote `path` for `doc`: that version is not a change.
+    pub fn known_now(&mut self, doc: DocId, path: &str) {
+        if let Some(stamp) = Stamp::at(path) {
+            self.known.insert(doc, stamp);
+        }
+    }
+
+    /// Remember `stamp`, read before the file was, for `doc`.
+    pub fn known_as(&mut self, doc: DocId, stamp: Option<Stamp>) {
+        if let Some(stamp) = stamp {
+            self.known.insert(doc, stamp);
+        }
+    }
+}
+
+impl PdfCraftApp {
+    /// The documents to watch: every open one with a file, while the preference is on.
+    fn watched(&self) -> impl Iterator<Item = (DocId, &str, Option<Stamp>)> {
+        self.views.iter().filter(|_| self.reload_changed_files).filter_map(|v| {
+            let path = self.session.get(v.id)?.path.as_deref()?;
+            Some((v.id, path, self.watch.known.get(&v.id).copied()))
+        })
+    }
+
+    /// Every frame: tell the watcher about files opened, closed or saved (without allocating
+    /// when nothing changed), and reload what changed on disk.
+    pub(crate) fn watch_files(&mut self) {
+        if let Some(id) = self.watch.reload_request.take() {
+            self.reload_from_disk(id);
+        }
+        let mut sent = self.watch.sent.iter();
+        let unchanged = self.watched().all(|(doc, path, known)| sent.next().is_some_and(|w| w.doc == doc && w.path == path && w.known == known))
+            && sent.next().is_none();
+        if !unchanged {
+            let list: Vec<Watched> = self.watched().map(|(doc, path, known)| Watched { doc, path: path.to_owned(), known }).collect();
+            let open: Vec<DocId> = self.views.iter().map(|v| v.id).collect();
+            self.watch.known.retain(|doc, _| open.contains(doc));
+            if self.send_to_watcher(list.clone()) {
+                self.watch.sent = list;
+            }
+        }
+        if self.run_inline {
+            let (found, _) = self.watch.inline.tick();
+            self.watch.found.lock().unwrap_or_else(PoisonError::into_inner).extend(found);
+        }
+        let found = std::mem::take(&mut *self.watch.found.lock().unwrap_or_else(PoisonError::into_inner));
+        for c in found {
+            self.file_changed(c);
+        }
+    }
+
+    /// Hand `list` to the watcher, starting it when needed. `false`: not delivered (no context
+    /// yet, or the worker couldn't start or ended); the next frame tries again.
+    fn send_to_watcher(&mut self, list: Vec<Watched>) -> bool {
+        if self.run_inline {
+            self.watch.inline.set(list);
+            return true;
+        }
+        if self.watch.inbox.is_none() {
+            if list.is_empty() {
+                return true;
+            }
+            let Some(ctx) = self.ctx.clone() else { return false };
+            let (tx, rx) = mpsc::channel();
+            let out = self.watch.found.clone();
+            if std::thread::Builder::new().name("pdfcraft-watch".into()).spawn(move || run(rx, out, ctx)).is_err() {
+                return false;
+            }
+            self.watch.inbox = Some(tx);
+        }
+        let delivered = self.watch.inbox.as_ref().is_some_and(|tx| tx.send(list).is_ok());
+        if !delivered {
+            // The worker ended (it panicked): start a new one next frame.
+            self.watch.inbox = None;
+        }
+        delivered
+    }
+
+    /// A watched file has a new version: reload its document, or ask first when it has unsaved
+    /// changes.
+    fn file_changed(&mut self, c: Changed) {
+        let Some(i) = self.views.iter().position(|v| v.id == c.doc) else { return };
+        // PdfCraft wrote this version itself (a save), or it was handled already.
+        if self.watch.known.get(&c.doc) == Some(&c.stamp) {
+            return;
+        }
+        self.watch.known.insert(c.doc, c.stamp);
+        if self.has_unsaved_work(i) {
+            if let Some(view) = self.views.get_mut(i) {
+                view.disk_changed = true;
+            }
+            return;
+        }
+        self.reload_view(i, c.bytes);
+    }
+
+    /// The notice bar's Reload: read the file now and replace the document, unsaved changes and
+    /// all.
+    fn reload_from_disk(&mut self, doc: DocId) {
+        let Some(i) = self.views.iter().position(|v| v.id == doc) else { return };
+        let Some(path) = self.session.get(doc).and_then(|d| d.path.clone()) else { return };
+        let stamp = Stamp::at(&path);
+        match std::fs::read(&path) {
+            Ok(bytes) => {
+                self.watch.known_as(doc, stamp);
+                self.reload_view(i, Arc::new(bytes));
+            }
+            Err(e) => {
+                let name = self.session.get(doc).map(|d| d.name.clone()).unwrap_or_default();
+                self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
+            }
+        }
+    }
+
+    /// Open `bytes` in place of tab `i`'s document, keeping the tab and the reader's place. A
+    /// version that can't be opened leaves the document as it was, and says so.
+    fn reload_view(&mut self, i: usize, bytes: Arc<Vec<u8>>) {
+        let Some(id) = self.views.get(i).map(|v| v.id) else { return };
+        match self.session.reload(id, bytes) {
+            Ok(()) => {
+                // Whatever was unsaved is gone, so there is nothing left to recover.
+                self.forget_recovery(id);
+                if let (Some(view), Some(doc)) = (self.views.get_mut(i), self.session.get(id)) {
+                    view.document_replaced(&doc.info);
+                }
+                // What the form's scripts said while it opened, as on opening.
+                let out = self.session.take_js_output(id);
+                self.handle_js(id, out);
+            }
+            Err(e) => {
+                let name = self.session.get(id).map(|d| d.name.clone()).unwrap_or_default();
+                self.notify_fmt("Couldn't reload {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
+            }
+        }
+    }
+}
diff --git a/crates/ui-egui/src/files.rs b/crates/ui-egui/src/files.rs
index d74233fd..96149f2e 100644
--- a/crates/ui-egui/src/files.rs
+++ b/crates/ui-egui/src/files.rs
@@ -29,7 +29,7 @@ fn files_picker(purpose: FilePurpose) -> rfd::AsyncFileDialog {
     if purpose == FilePurpose::RedactWords {
         return dialog.add_filter(tl!("Text"), &["txt"]);
     }
-    if !matches!(purpose, FilePurpose::CreateMultiple | FilePurpose::InsertPages) {
+    if !matches!(purpose, FilePurpose::CreateMultiple | FilePurpose::InsertPages | FilePurpose::Combine) {
         return dialog.add_filter("PDF", &["pdf"]);
     }
     let all: Vec<&str> = std::iter::once("pdf").chain(pdfcraft_engine::CONVERTIBLE).collect();
@@ -172,6 +172,16 @@ impl Default for RotateDraft {
     }
 }
 
+/// A picked file's name and bytes, or its name and why it can't be read.
+#[cfg(not(target_arch = "wasm32"))]
+fn read_named(path: &std::path::Path) -> Result<(String, Vec<u8>), (String, String)> {
+    let name = path.file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "file.pdf".into());
+    match std::fs::read(path) {
+        Ok(bytes) => Ok((name, bytes)),
+        Err(e) => Err((name, e.to_string())),
+    }
+}
+
 impl PdfCraftApp {
     /// Ask for files to add to the Combine files list (its Add files… button).
     pub fn combine_dialog(&mut self) {
@@ -239,6 +249,13 @@ impl PdfCraftApp {
     /// Read the picked files and use them.
     #[cfg(not(target_arch = "wasm32"))]
     pub(crate) fn use_paths(&mut self, purpose: FilePurpose, paths: &[std::path::PathBuf]) {
+        if purpose == FilePurpose::CreateMultiple {
+            // Each file is read when its turn comes, so the selection's bytes are not all held at once.
+            if !paths.is_empty() {
+                self.stage_create_multiple(paths.iter().map(|p| read_named(p)));
+            }
+            return;
+        }
         let mut files = Vec::new();
         let mut modified = Vec::new();
         for p in paths {
@@ -359,7 +376,7 @@ impl PdfCraftApp {
                 }
             }
             FilePurpose::Ocr => self.ocr_files(files),
-            FilePurpose::CreateMultiple => self.stage_create_multiple(files),
+            FilePurpose::CreateMultiple => self.stage_create_multiple(files.into_iter().map(Ok)),
             FilePurpose::RedactWords => {
                 let Some((name, bytes)) = files.into_iter().next() else { return };
                 if bytes.len() > crate::redact_ui::MAX_WORD_LIST_BYTES {
@@ -406,13 +423,29 @@ impl PdfCraftApp {
     /// Insert the pages of `files` (PDFs, images, text), in order, at the gap a "+" in the page
     /// grid chose, or else after the selection (or the current page); then select them.
     pub fn insert_files(&mut self, files: Vec<(String, Vec<u8>)>) {
+        self.insert_each(files.into_iter().map(Ok));
+    }
+
+    /// [`Self::insert_files`] for files read as their turn comes: one that can't be read is skipped
+    /// and named.
+    pub(crate) fn insert_each<I>(&mut self, files: I)
+    where
+        I: IntoIterator<Item = Result<(String, Vec<u8>), (String, String)>>,
+    {
         let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) else { return };
         let (id, chosen) = (view.id, view.insert_at.take());
         let after = view.target_pages().last().map_or(0, |p| p + 1);
         let count = self.session.get(id).map_or(0, |d| d.info.pages.len());
         let start = chosen.unwrap_or(after).min(count);
         let mut at = start;
-        for (name, bytes) in files {
+        for file in files {
+            let (name, bytes) = match file {
+                Ok(file) => file,
+                Err((name, error)) => {
+                    self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &error)]);
+                    continue;
+                }
+            };
             let converted =
                 self.session.convert_to_pdf(&name, &Arc::new(bytes)).and_then(|(_, pdf)| Ok((self.session.page_count_of(&name, &pdf)?, pdf)));
             match converted {
@@ -685,6 +718,9 @@ impl PdfCraftApp {
             return;
         }
         let Some((_, id)) = self.active_ids() else { return };
+        if !self.may_copy(id) {
+            return;
+        }
         let Some(doc) = self.session.get(id) else { return };
         let stem = doc.name.trim_end_matches(".pdf").trim_end_matches(".PDF").to_string();
         let ext = format.extension();
diff --git a/crates/ui-egui/src/fill_sign.rs b/crates/ui-egui/src/fill_sign.rs
index f7e45a8e..974d344c 100644
--- a/crates/ui-egui/src/fill_sign.rs
+++ b/crates/ui-egui/src/fill_sign.rs
@@ -34,7 +34,21 @@ pub enum SavedSig {
     Image(#[serde(with = "image_data")] SignatureImage),
 }
 
-mod image_data {
+impl SavedSig {
+    /// This signature as the graphic of a visible digital signature. `None` for typed text the
+    /// script font has nothing to draw for.
+    pub fn graphic(&self) -> Option<pdfcraft_engine::sign::Graphic> {
+        match self {
+            SavedSig::Drawn(strokes) => Some(pdfcraft_engine::sign::Graphic::Strokes(
+                strokes.iter().map(|s| s.iter().map(|p| [f64::from(p[0]), f64::from(p[1])]).collect()).collect(),
+            )),
+            SavedSig::Typed(text) => pdfcraft_engine::typed_signature_graphic(text),
+            SavedSig::Image(image) => Some(image.graphic()),
+        }
+    }
+}
+
+pub(crate) mod image_data {
     use base64::Engine as _;
     use pdfcraft_engine::{SignatureImage, signature_image::MAX_SIGNATURE_IMAGE_BYTES};
     use serde::{Deserialize, Deserializer, Serializer};
@@ -308,48 +322,7 @@ pub(crate) fn signature_entries(ui: &mut egui::Ui, app: &mut crate::PdfCraftApp,
                 Stroke::new(1.0, if response.hovered() { t.accent } else { t.border }),
                 egui::StrokeKind::Inside,
             );
-            let preview_rect = rect.shrink(8.0);
-            match saved {
-                SavedSig::Typed(text) => {
-                    let cache = &mut app.saved_signature_previews[i];
-                    if cache.as_ref().is_none_or(|(s, _)| s != saved) {
-                        *cache = Some((
-                            saved.clone(),
-                            ui.ctx().load_texture(format!("saved-{what}"), script_preview(text, 480, 104), egui::TextureOptions::LINEAR),
-                        ));
-                    }
-                    if let Some((_, tex)) = cache {
-                        let size = vec2(480.0, 104.0) * (preview_rect.width() / 480.0).min(preview_rect.height() / 104.0);
-                        painter.image(
-                            tex.id(),
-                            egui::Rect::from_center_size(preview_rect.center(), size),
-                            egui::Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)),
-                            Color32::WHITE,
-                        );
-                    }
-                }
-                SavedSig::Image(image) => {
-                    image_preview(ui, preview_rect, image, &mut app.saved_signature_previews[i]);
-                }
-                SavedSig::Drawn(strokes) => {
-                    let bounds = strokes
-                        .iter()
-                        .flatten()
-                        .filter(|p| p.iter().all(|v| v.is_finite()))
-                        .fold(egui::Rect::NOTHING, |r, p| r.union(egui::Rect::from_min_max(pos2(p[0], p[1]), pos2(p[0], p[1]))));
-                    if bounds.is_finite() {
-                        let scale = (preview_rect.width() / bounds.width().max(0.01)).min(preview_rect.height() / bounds.height().max(0.01));
-                        for stroke in strokes {
-                            let pts = stroke
-                                .iter()
-                                .filter(|p| p.iter().all(|v| v.is_finite()))
-                                .map(|p| preview_rect.center() + vec2(p[0] - bounds.center().x, bounds.center().y - p[1]) * scale)
-                                .collect();
-                            painter.add(egui::Shape::line(pts, Stroke::new(1.5, Color32::BLACK)));
-                        }
-                    }
-                }
-            }
+            paint_saved(ui, rect.shrink(8.0), saved, &mut app.saved_signature_previews[i], &format!("saved-{what}"));
             if response.on_hover_text(label("Place saved {what}")).clicked() {
                 command = Some(use_id);
             }
@@ -365,6 +338,47 @@ pub(crate) fn signature_entries(ui: &mut egui::Ui, app: &mut crate::PdfCraftApp,
     command
 }
 
+/// Draw a saved signature as large as fits in `rect`, centred: typed text and images through
+/// `cache` (a texture named `key`), strokes as lines.
+pub(crate) fn paint_saved(ui: &egui::Ui, rect: egui::Rect, saved: &SavedSig, cache: &mut Option<(SavedSig, egui::TextureHandle)>, key: &str) {
+    let painter = ui.painter_at(rect);
+    match saved {
+        SavedSig::Typed(text) => {
+            if cache.as_ref().is_none_or(|(s, _)| s != saved) {
+                *cache = Some((saved.clone(), ui.ctx().load_texture(key, script_preview(text, 480, 104), egui::TextureOptions::LINEAR)));
+            }
+            if let Some((_, tex)) = cache {
+                let size = vec2(480.0, 104.0) * (rect.width() / 480.0).min(rect.height() / 104.0);
+                painter.image(
+                    tex.id(),
+                    egui::Rect::from_center_size(rect.center(), size),
+                    egui::Rect::from_min_max(pos2(0.0, 0.0), pos2(1.0, 1.0)),
+                    Color32::WHITE,
+                );
+            }
+        }
+        SavedSig::Image(image) => image_preview(ui, rect, image, cache),
+        SavedSig::Drawn(strokes) => {
+            let bounds = strokes
+                .iter()
+                .flatten()
+                .filter(|p| p.iter().all(|v| v.is_finite()))
+                .fold(egui::Rect::NOTHING, |r, p| r.union(egui::Rect::from_min_max(pos2(p[0], p[1]), pos2(p[0], p[1]))));
+            if bounds.is_finite() {
+                let scale = (rect.width() / bounds.width().max(0.01)).min(rect.height() / bounds.height().max(0.01));
+                for stroke in strokes {
+                    let pts = stroke
+                        .iter()
+                        .filter(|p| p.iter().all(|v| v.is_finite()))
+                        .map(|p| rect.center() + vec2(p[0] - bounds.center().x, bounds.center().y - p[1]) * scale)
+                        .collect();
+                    painter.add(egui::Shape::line(pts, Stroke::new(1.5, Color32::BLACK)));
+                }
+            }
+        }
+    }
+}
+
 /// Preview and clicks with a Fill & Sign tool on one page.
 #[allow(clippy::too_many_arguments)]
 pub(crate) fn page_input(
@@ -457,6 +471,8 @@ pub(crate) fn type_box(ctx: &egui::Context, view: &mut DocView, info: &DocInfo,
     let mut cancel = false;
     egui::Area::new(egui::Id::new(("fill-text", view.id.0))).order(egui::Order::Foreground).fixed_pos(pos).show(ctx, |ui| {
         let Some(t) = view.fill_text.as_mut() else { return };
+        // The box is white in every theme, so the caret must not follow the theme (pale in dark mode) (#655).
+        ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(Color32::WHITE);
         let width = ((t.text.chars().count().max(8) as f32) * TEXT_SIZE as f32 * 0.6 * zoom).clamp(60.0, 600.0);
         // The area's max rect is last frame's size, which caps the edit's width; widen it so the
         // box grows as text is typed.
diff --git a/crates/ui-egui/src/forms_ui.rs b/crates/ui-egui/src/forms_ui.rs
index 3f07f9bd..b34a9e6c 100644
--- a/crates/ui-egui/src/forms_ui.rs
+++ b/crates/ui-egui/src/forms_ui.rs
@@ -4,14 +4,18 @@
 //! cancels, Tab moves to the next field). Check boxes and radio buttons toggle on click. Combo
 //! and list boxes open a list of their options. Every change is one undoable engine edit.
 
+use std::collections::HashSet;
+
 use egui::{Color32, CornerRadius, Rect, Stroke, vec2};
-use pdfcraft_engine::{Edit, FieldValue, FormField, FormFieldKind, field_flags};
+use pdfcraft_engine::{Edit, FieldValue, FormField, FormFieldKind, FormWidget, field_flags};
 use pdfcraft_render::DocInfo;
 
 use crate::canvas::{DocView, PageXform};
 use crate::theme::Tokens;
 
 const FOCUS_BLUE: Color32 = Color32::from_rgb(0x14, 0x73, 0xE6);
+/// Background of the in-place text field editor, the same in every theme.
+const FIELD_FILL: Color32 = Color32::from_rgb(0xFF, 0xFF, 0xF4);
 
 /// The field being edited.
 #[derive(Clone, Debug, PartialEq)]
@@ -37,6 +41,9 @@ pub struct FormView {
     /// The draft whose edit is queued (`DocView::pending_edit`): if the field refuses the value,
     /// the editor reopens with it rather than losing the typing.
     pub(crate) committed: Option<Focus>,
+    /// Fields modified by the user whose appearance stream has not been rasterized by the render worker yet.
+    /// Tracked as (field_name, page_index) so committed edits stay immediately visible without flicker.
+    pub unbaked: HashSet<(String, usize)>,
     /// A message for the app to show (e.g. "buttons run JavaScript").
     pub notice: Option<FormNotice>,
     /// A push button was clicked: (its field name, what it does).
@@ -262,13 +269,67 @@ pub(crate) fn paint_page(ui: &egui::Ui, painter: &egui::Painter, xf: &PageXform,
             let focused = view.forms.focus.as_ref().is_some_and(|x| x.name == f.name && x.widget == wi);
             if focused {
                 painter.rect_stroke(r.expand(1.0), CornerRadius::same(2), Stroke::new(2.0, FOCUS_BLUE), egui::StrokeKind::Outside);
-            } else if fillable(f) && pointer.is_some_and(|p| r.contains(p)) {
-                painter.rect_stroke(r, CornerRadius::same(1), Stroke::new(1.0, FOCUS_BLUE.gamma_multiply(0.8)), egui::StrokeKind::Outside);
+            } else {
+                if view.forms.unbaked.contains(&(f.name.clone(), page)) {
+                    paint_unbaked_widget(painter, xf, f, w, r);
+                }
+                if fillable(f) && pointer.is_some_and(|p| r.contains(p)) {
+                    painter.rect_stroke(r, CornerRadius::same(1), Stroke::new(1.0, FOCUS_BLUE.gamma_multiply(0.8)), egui::StrokeKind::Outside);
+                }
             }
         }
     }
 }
 
+fn paint_unbaked_widget(painter: &egui::Painter, xf: &PageXform, f: &FormField, w: &FormWidget, r: Rect) {
+    match f.kind {
+        FormFieldKind::Text | FormFieldKind::Combo | FormFieldKind::List => {
+            let text = f.value.first().map(String::as_str).unwrap_or("");
+            painter.rect_filled(r, CornerRadius::same(1), Color32::from_rgb(0xFF, 0xFF, 0xF4));
+            painter.rect_stroke(r, CornerRadius::same(1), Stroke::new(1.0, Color32::from_gray(180)), egui::StrokeKind::Inside);
+            if !text.is_empty() {
+                let unrotated_w = if xf.rot % 180 == 90 { xf.ph } else { xf.pw };
+                let zoom = xf.rect.width() / unrotated_w.max(1.0);
+                let da = f.da.split_whitespace().collect::<Vec<_>>();
+                let size = da
+                    .iter()
+                    .position(|x| *x == "Tf")
+                    .and_then(|i| da.get(i.wrapping_sub(1)))
+                    .and_then(|s| s.parse::<f32>().ok())
+                    .filter(|s| *s > 0.0);
+                let font_size = (size.unwrap_or(((w.rect[3] - w.rect[1]) as f32 * 0.6).clamp(6.0, 12.0)) * zoom).clamp(6.0, 64.0);
+                let display_text = if f.has(field_flags::PASSWORD) { "•".repeat(text.chars().count()) } else { text.to_string() };
+                let p = painter.with_clip_rect(r);
+                let (align, pos) = match f.quadding {
+                    1 => (egui::Align2::CENTER_TOP, egui::pos2(r.center().x, r.min.y + 1.0)),
+                    2 => (egui::Align2::RIGHT_TOP, egui::pos2(r.max.x - 3.0, r.min.y + 1.0)),
+                    _ => (egui::Align2::LEFT_TOP, egui::pos2(r.min.x + 3.0, r.min.y + 1.0)),
+                };
+                p.text(pos, align, display_text, egui::FontId::proportional(font_size), Color32::BLACK);
+            }
+        }
+        FormFieldKind::CheckBox => {
+            painter.rect_filled(r, CornerRadius::same(1), Color32::from_rgb(0xFF, 0xFF, 0xF4));
+            painter.rect_stroke(r, CornerRadius::same(1), Stroke::new(1.0, Color32::from_gray(180)), egui::StrokeKind::Inside);
+            let checked = f.value.first().is_some_and(|v| v != "Off" && !v.is_empty());
+            if checked {
+                let sz = (r.height() * 0.75).clamp(8.0, 32.0);
+                painter.text(r.center(), egui::Align2::CENTER_CENTER, "✔", egui::FontId::proportional(sz), Color32::BLACK);
+            }
+        }
+        FormFieldKind::Radio => {
+            painter.rect_filled(r, CornerRadius::same(1), Color32::from_rgb(0xFF, 0xFF, 0xF4));
+            painter.rect_stroke(r, CornerRadius::same(1), Stroke::new(1.0, Color32::from_gray(180)), egui::StrokeKind::Inside);
+            let selected = f.value.first().map(String::as_str) == w.on_state.as_deref();
+            if selected {
+                let radius = (r.height().min(r.width()) * 0.25).clamp(2.0, 16.0);
+                painter.circle_filled(r.center(), radius, Color32::BLACK);
+            }
+        }
+        _ => {}
+    }
+}
+
 /// The in-place editor or option list for the focused field. Returns an edit to apply.
 pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, form: &[FormField], today: (i64, u32, u32)) -> Option<Edit> {
     let focus = view.forms.focus.clone()?;
@@ -295,11 +356,13 @@ pub(crate) fn overlay(ctx: &egui::Context, view: &mut DocView, info: &DocInfo, f
             egui::Area::new(egui::Id::new(("form-editor", view.id.0))).order(egui::Order::Foreground).fixed_pos(rect.min).show(ctx, |ui| {
                 ui.set_min_size(rect.size());
                 let Some(fx) = view.forms.focus.as_mut() else { return };
+                // The field is pale yellow in every theme, so the caret must not follow the theme (pale in dark mode) (#655).
+                ui.visuals_mut().text_cursor.stroke.color = crate::edit_text_ui::caret_color_on(FIELD_FILL);
                 let mut te = if multiline { egui::TextEdit::multiline(&mut fx.text) } else { egui::TextEdit::singleline(&mut fx.text) };
                 te = te
                     .desired_width(rect.width() - 6.0)
                     .font(egui::FontId::proportional(font))
-                    .background_color(Color32::from_rgb(0xFF, 0xFF, 0xF4))
+                    .background_color(FIELD_FILL)
                     .text_color(Color32::BLACK)
                     .margin(egui::Margin::symmetric(3, 1))
                     .password(f.has(field_flags::PASSWORD))
diff --git a/crates/ui-egui/src/home.rs b/crates/ui-egui/src/home.rs
index 2b689fef..9adfd780 100644
--- a/crates/ui-egui/src/home.rs
+++ b/crates/ui-egui/src/home.rs
@@ -5,7 +5,7 @@ use egui::{Align2, CornerRadius, Rect, Sense, Stroke, vec2};
 use pdfcraft_engine::catalog;
 
 use crate::theme::{self, Tokens};
-use crate::{LeftPanel, PdfCraftApp, icons, panels::human_size, widgets};
+use crate::{PdfCraftApp, icons, panels::human_size, widgets};
 
 const RECOMMENDED: [&str; 5] = ["organize", "comment", "form", "edit", "protect"];
 
@@ -86,8 +86,7 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                             );
                             let resp = if title_elided || blurb_elided { resp.on_hover_text(format!("{}\n{blurb}", tl!(g.label))) } else { resp };
                             if resp.clicked() {
-                                app.left = LeftPanel::Tool(g.id);
-                                app.left_open = true;
+                                app.select_tool(g.id);
                             }
                         }
                         let (rect, resp) = ui.allocate_exact_size(vec2(170.0, 104.0), Sense::click());
@@ -162,7 +161,7 @@ pub fn show(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                 let detail = ui.painter().text(
                     rect.right_center() - vec2(48.0, 0.0),
                     Align2::RIGHT_CENTER,
-                    format!("{} {}  ·  {}", r.pages, tl!("pages"), human_size(r.size)),
+                    format!("{}  ·  {}", crate::i18n::trn(crate::i18n::current(), r.pages as u64, "{n} page", "{n} pages"), human_size(r.size)),
                     theme::regular(12.0),
                     t.text_muted,
                 );
diff --git a/crates/ui-egui/src/i18n/ar.tsv b/crates/ui-egui/src/i18n/ar.tsv
index 77e350e0..f6904d3c 100644
--- a/crates/ui-egui/src/i18n/ar.tsv
+++ b/crates/ui-egui/src/i18n/ar.tsv
@@ -111,12 +111,18 @@
 	Open a PDF ({key})	فتح ملف PDF ({key})
 	Dark gray theme	سمة رمادية داكنة
 	Light theme	سمة فاتحة
+	Appearance mode	وضع المظهر
+	Light	فاتح
+	Dark	داكن
+	Active	نشط
+	Dark theme	سمة داكنة
+	Appearance settings…	إعدادات المظهر…
 	All tools	كل الأدوات
 	Read	قراءة
 	Convert	تحويل
 	E-Sign	توقيع إلكتروني
 	Print ({key})	طباعة ({key})
-	Save (M4)	حفظ (M4)
+	Save ({key})	حفظ ({key})
 	Document properties ({key})	خصائص المستند ({key})
 	Find tools and commands	البحث عن الأدوات والأوامر
 	Fit to height	ملاءمة الارتفاع
@@ -785,6 +791,7 @@
 	Rotation	التدوير
 	Appear behind page	الظهور خلف الصفحة
 	Appear on top of page	الظهور فوق الصفحة
+	Offset from centre	الإزاحة عن المركز
 	From colour	من لون
 	Page Range Options	خيارات نطاق الصفحات
 	Preview: page {p} of {n}	معاينة: صفحة {p} من {n}
@@ -849,6 +856,10 @@
 	The signature will be invisible.	سيكون التوقيع غير مرئي.
 	Distinguished name	الاسم المميز
 	Labels	التسميات
+	Graphic	رسم
+	Signer's name	اسم الموقّع
+	Fill & Sign signature	توقيع «تعبئة وتوقيع»
+	Choose image…	اختيار صورة…
 	Permitted actions after certifying	الإجراءات المسموح بها بعد التصديق
 	No changes allowed	لا يُسمح بأي تغييرات
 	Annotations, form fill-in, and digital signatures	التعليقات وتعبئة النماذج والتوقيعات الرقمية
@@ -1585,16 +1596,16 @@
 	Opened, but its security settings don't allow combining. Enter the permissions password.	فُتح، لكن إعدادات أمانه لا تسمح بالدمج. أدخل كلمة مرور الأذونات.
 	Unlocked: the combined file won't be password-protected	أُلغي القفل: الملف المدموج لن يكون محميًا بكلمة مرور
 	Unlocked {n} of {m} files	أُلغي قفل {n} من {m} ملفات
-	Drop PDFs or folders here, or choose them.	أفلت ملفات PDF أو مجلدات هنا، أو اخترها.
+	Drop PDFs, images, text files or folders here, or choose them.	أفلت ملفات PDF أو الصور أو الملفات النصية أو المجلدات هنا، أو اخترها.
 	Add folder…	إضافة مجلد…
 	Add folder and subfolders…	إضافة مجلد ومجلداته الفرعية…
 	More ways to add files	طرق أخرى لإضافة الملفات
-	Every PDF in the folder	كل ملفات PDF في المجلد
-	Every PDF in the folder and the folders inside it	كل ملفات PDF في المجلد والمجلدات التي بداخله
+	Every PDF, image and text file in the folder	كل ملفات PDF والصور والملفات النصية في المجلد
+	Every PDF, image and text file in the folder and the folders inside it	كل ملفات PDF والصور والملفات النصية في المجلد والمجلدات التي بداخله
 	Add folder	إضافة مجلد
 	Add folder and subfolders	إضافة مجلد ومجلداته الفرعية
-	No PDFs found in {folder}	لم يُعثر على ملفات PDF في {folder}
-	Added the first {n} PDFs in {folder}	أُضيفت أول {n} ملفات PDF في {folder}
+	No PDFs, images or text files found in {folder}	لم يُعثر على ملفات PDF أو صور أو ملفات نصية في {folder}
+	Added the first {n} files in {folder}	أُضيفت أول {n} ملفات في {folder}
 	Click to sort, drag to move the column. Drag its edge to resize it.	انقر للفرز، واسحب لنقل العمود. اسحب حافته لتغيير حجمه.
 	Reset columns	إعادة ضبط الأعمدة
 	Remove {n} files	إزالة {n} ملفات
@@ -1612,7 +1623,7 @@
 	{n} files need attention	{n} ملفات تحتاج إلى انتباه
 	{name} can't be combined: {why}	لا يمكن دمج {name}: {why}
 	Check the pages of {name}: {why}	تحقق من صفحات {name}: {why}
-	Add the PDFs to combine	أضف ملفات PDF المراد دمجها
+	Add the files to combine	أضف الملفات المراد دمجها
 	File name	اسم الملف
 	Warnings	التحذيرات
 	Drag to reorder	اسحب لإعادة الترتيب
@@ -1625,6 +1636,10 @@
 	Password-protected	محمي بكلمة مرور
 	Its security settings don't allow copying pages	إعدادات أمانه لا تسمح بنسخ الصفحات
 	Can't be read: {e}	تتعذر قراءته: {e}
+	Leave out files that can't be read?	هل تريد استبعاد الملفات التي تتعذر قراءتها؟
+	These files can't be read, so they won't be in the combined PDF:	تتعذر قراءة هذه الملفات، لذا لن تكون في ملف PDF المدمج:
+	Combine the rest	دمج الباقي
+	and {n} more	و{n} أخرى
 	Includes unsaved changes	يتضمن تغييرات غير محفوظة
 	Pages of {name} to combine, e.g. 1-3, 6	صفحات {name} المراد دمجها، مثلًا 1-3, 6
 	Remove {name}	إزالة {name}
@@ -1698,8 +1713,14 @@
 	watermark	علامة مائية
 	background	خلفية
 	This document isn't password-protected	هذا المستند غير محمي بكلمة مرور
-	Only the document's owner can change its security (open it with the permissions password)	مالك المستند وحده يستطيع تغيير أمانه (افتحه بكلمة مرور الأذونات)
+	Enter permissions password…	أدخل كلمة مرور الأذونات…
+	Permissions password	كلمة مرور الأذونات
+	“{name}” has security restrictions. Enter its permissions password to lift them.	«{name}» عليه قيود أمان. أدخل كلمة مرور الأذونات الخاصة به لرفعها.
+	Restrictions lifted	رُفعت القيود
+	Couldn't unlock {name}: {e}	تعذّر إلغاء قفل {name}: {e}
+	This document has no restrictions to lift	لا توجد في هذا المستند قيود لرفعها
 	The document's security settings don't allow this change	إعدادات أمان المستند لا تسمح بهذا التغيير
+	The document's security settings don't allow copying text and images	إعدادات أمان المستند لا تسمح بنسخ النصوص والصور
 	Open a document first	افتح مستندًا أولًا
 	Security will be removed when you save	سيُزال الأمان عند الحفظ
 	Click text or an image to edit it	انقر على نص أو صورة لتحريرها
@@ -2172,6 +2193,8 @@ certificate	Subject	صاحب الشهادة
 	A selected field has no widget on any page, so the fields can't be edited together.	أحد الحقول المحددة ليس له عنصر واجهة في أي صفحة، لذا لا يمكن تحرير الحقول معًا.
 	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	التعرف على النص غير مثبت: نماذجه مفقودة (شغّل `cargo xtask models`، أو اضبط PDFCRAFT_MODELS).
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} بدقة {dpi} dpi، وهي أكبر دقة يمكن رسمها بها)
+	Margins	الهوامش
+	For page sizes and margins.	لأحجام الصفحات والهوامش.
 
 # Multi-object selection and movement (#844)
 @plural	{n} object selected|{n} objects selected	تم تحديد {n} عنصر|تم تحديد {n} عنصر|تم تحديد {n} عنصرين|تم تحديد {n} عناصر|تم تحديد {n} عنصرًا|تم تحديد {n} عنصر
@@ -2216,3 +2239,31 @@ key	Space	مسافة
 	Panels	اللوحات
 	Resize panels	تغيير حجم اللوحات
 	Resize panel window	تغيير حجم نافذة اللوحة
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	صفحة PDF: {size}
+	Match page at 100%	مطابقة الورق للصفحة بنسبة 100%
+	PDF scale: {scale}%	مقياس PDF: {scale}%
+	Printer paper and scaling may differ. Check driver settings.	قد يختلف ورق الطابعة ومقياس الطباعة. تحقق من إعدادات برنامج التشغيل.
+	Drawing scale changes. Use Actual size for full-scale plans.	يتغير مقياس الرسم. استخدم الحجم الفعلي لطباعة المخططات بمقياسها الأصلي.
+	Reload documents when their files change on disk	إعادة تحميل المستندات عند تغيّر ملفاتها على القرص
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	تغيّر هذا الملف على القرص. أعد تحميله لعرض النسخة الجديدة؛ ستفقد تغييراتك غير المحفوظة.
+	Reload	إعادة تحميل
+	Couldn't reload {name}: {e}	تعذّرت إعادة تحميل {name}: {e}
+	Select page {label}	تحديد الصفحة {label}
+	Rotate page {label} counterclockwise	تدوير الصفحة {label} عكس اتجاه عقارب الساعة
+	Rotate page {label} clockwise	تدوير الصفحة {label} باتجاه عقارب الساعة
+	Delete page {label}	حذف الصفحة {label}
+	Mouse wheel scroll speed	سرعة التمرير بعجلة الماوس
+scroll speed	Slow	بطيئة
+scroll speed	Normal	عادية
+scroll speed	Fast	سريعة
+	Enhance camera image	تحسين صورة الكاميرا
+	Drag the corners onto the document's edges, then choose Enhance page.	اسحب الزوايا إلى حواف المستند، ثم اختر تحسين الصفحة.
+	Enhance page	تحسين الصفحة
+	Done adding text	إنهاء إضافة النص
+	Discard this text (Esc)	تجاهل هذا النص (Esc)
+	Clean-up	تنظيف
+	Original	الأصل
+	Greyscale	تدرج رمادي
+	Black and white	أبيض وأسود
diff --git a/crates/ui-egui/src/i18n/bg.tsv b/crates/ui-egui/src/i18n/bg.tsv
index c777b282..3da0853c 100644
--- a/crates/ui-egui/src/i18n/bg.tsv
+++ b/crates/ui-egui/src/i18n/bg.tsv
@@ -470,6 +470,7 @@
 	Rotation	Завъртане
 	Appear behind page	Под съдържанието на страницата
 	Appear on top of page	Над съдържанието на страницата
+	Offset from centre	Отместване от центъра
 	From colour	От цвят
 	Page Range Options	Опции за диапазон на страниците
 	Preview: page {p} of {n}	Преглед: страница {p} от {n}
@@ -534,6 +535,10 @@
 	The signature will be invisible.	Подписът ще бъде невидим.
 	Distinguished name	Отличително име
 	Labels	Етикети
+	Graphic	Графика
+	Signer's name	Име на подписващия
+	Fill & Sign signature	Подпис от „Попълни и подпиши“
+	Choose image…	Избор на изображение…
 	Permitted actions after certifying	Разрешени действия след сертифициране
 	No changes allowed	Не се разрешават промени
 	Annotations, form fill-in, and digital signatures	Анотации, попълване на формуляри и цифрови подписи
@@ -1089,8 +1094,14 @@
 	Open a PDF ({key})	Отвори PDF файл ({key})
 	Dark gray theme	Тъмносива тема
 	Light theme	Светла тема
+	Appearance mode	Режим на облика
+	Light	Светъл
+	Dark	Тъмен
+	Active	Активен
+	Dark theme	Тъмна тема
+	Appearance settings…	Настройки на облика…
 	Print ({key})	Печат ({key})
-	Save (M4)	Запиши (M4)
+	Save ({key})	Запиши ({key})
 	Document properties ({key})	Свойства на документа ({key})
 	Action Wizard…	Съветник за действия…
 	Add Bates numbering…	Добави номериране на Бейтс…
@@ -1546,16 +1557,16 @@
 	Opened, but its security settings don't allow combining. Enter the permissions password.	Файлът е отворен, но настройките му за защита не позволяват обединяване. Въведете паролата за разрешения.
 	Unlocked: the combined file won't be password-protected	Отключен: обединеният файл няма да бъде защитен с парола
 	Unlocked {n} of {m} files	Отключени са {n} от {m} файла
-	Drop PDFs or folders here, or choose them.	Пуснете тук PDF файлове или папки или ги изберете.
+	Drop PDFs, images, text files or folders here, or choose them.	Пуснете тук PDF файлове, изображения, текстови файлове или папки или ги изберете.
 	Add folder…	Добави папка…
 	Add folder and subfolders…	Добави папка и подпапки…
 	More ways to add files	Още начини за добавяне на файлове
-	Every PDF in the folder	Всички PDF файлове в папката
-	Every PDF in the folder and the folders inside it	Всички PDF файлове в папката и в папките в нея
+	Every PDF, image and text file in the folder	Всички PDF файлове, изображения и текстови файлове в папката
+	Every PDF, image and text file in the folder and the folders inside it	Всички PDF файлове, изображения и текстови файлове в папката и в папките в нея
 	Add folder	Добави папка
 	Add folder and subfolders	Добави папка и подпапки
-	No PDFs found in {folder}	Не са открити PDF файлове в {folder}
-	Added the first {n} PDFs in {folder}	Добавени са първите {n} PDF файла от {folder}
+	No PDFs, images or text files found in {folder}	Не са открити PDF файлове, изображения или текстови файлове в {folder}
+	Added the first {n} files in {folder}	Добавени са първите {n} файла от {folder}
 	Click to sort, drag to move the column. Drag its edge to resize it.	Щракнете за сортиране, плъзнете, за да преместите колоната. Плъзнете ръба на колоната, за да промените размера.
 	Reset columns	Нулирай колоните
 	Remove {n} files	Премахни {n} файла
@@ -1573,7 +1584,7 @@
 	{n} files need attention	{n} файла изискват внимание
 	{name} can't be combined: {why}	{name} не може да бъде обединен: {why}
 	Check the pages of {name}: {why}	Проверете страниците на {name}: {why}
-	Add the PDFs to combine	Добавете PDF файловете за обединяване
+	Add the files to combine	Добавете файловете за обединяване
 	File name	Име на файла
 	Warnings	Предупреждения
 	Drag to reorder	Плъзнете, за да пренаредите
@@ -1586,6 +1597,10 @@
 	Password-protected	Защитен с парола
 	Its security settings don't allow copying pages	Настройките му за защита не позволяват копиране на страници
 	Can't be read: {e}	Не може да бъде прочетен: {e}
+	Leave out files that can't be read?	Да се пропуснат ли файловете, които не могат да бъдат прочетени?
+	These files can't be read, so they won't be in the combined PDF:	Тези файлове не могат да бъдат прочетени, затова няма да бъдат в обединения PDF:
+	Combine the rest	Обедини останалите
+	and {n} more	и още {n}
 	Includes unsaved changes	Съдържа незаписани промени
 	Pages of {name} to combine, e.g. 1-3, 6	Страници от {name} за обединяване, напр. 1-3, 6
 	Remove {name}	Премахни {name}
@@ -1661,8 +1676,14 @@
 	watermark	воден знак
 	background	фон
 	This document isn't password-protected	Този документ не е защитен с парола
-	Only the document's owner can change its security (open it with the permissions password)	Само собственикът на документа може да промени защитата му (отворете го с паролата за разрешения)
+	Enter permissions password…	Въведете паролата за разрешения…
+	Permissions password	Парола за разрешения
+	“{name}” has security restrictions. Enter its permissions password to lift them.	„{name}“ има ограничения за защита. Въведете паролата за разрешения, за да ги премахнете.
+	Restrictions lifted	Ограниченията са премахнати
+	Couldn't unlock {name}: {e}	{name} не може да се отключи: {e}
+	This document has no restrictions to lift	Този документ няма ограничения за премахване
 	The document's security settings don't allow this change	Настройките за защита на документа не позволяват тази промяна
+	The document's security settings don't allow copying text and images	Настройките за защита на документа не позволяват копиране на текст и изображения
 	Open a document first	Първо отворете документ
 	Security will be removed when you save	Защитата ще бъде премахната при записване
 	Click text or an image to edit it	Щракнете върху текст или изображение, за да го редактирате
@@ -2089,6 +2110,8 @@ action wizard	Start	Старт
 	Printer properties	Свойства на принтера
 	Reset to printer defaults	Възстанови настройките по подразбиране на принтера
 	This printer offers no settings of its own.	Този принтер няма собствени настройки.
+	Margins	Полета
+	For page sizes and margins.	За размери на страници и полета.
 	Scroll tabs left	Превърти разделите наляво
 	Scroll tabs right	Превърти разделите надясно
 
@@ -2158,3 +2181,31 @@ key	Space	Интервал
 	Resize panel window	Преоразмери прозореца на панела
 	Tools	Инструменти
 	Inspector	Инспектор
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	PDF страница: {size}
+	Match page at 100%	Хартия по страницата, мащаб 100%
+	PDF scale: {scale}%	Мащаб на PDF: {scale}%
+	Printer paper and scaling may differ. Check driver settings.	Хартията и мащабът на принтера може да се различават. Проверете настройките на драйвера.
+	Drawing scale changes. Use Actual size for full-scale plans.	Мащабът на чертежа се променя. Използвайте Действителен размер за планове в оригинален мащаб.
+	Reload documents when their files change on disk	Презареждай документите, когато файловете им се променят на диска
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Този файл е променен на диска. Презаредете го, за да видите новата версия; незаписаните ви промени ще бъдат загубени.
+	Reload	Презареди
+	Couldn't reload {name}: {e}	Неуспешно презареждане на {name}: {e}
+	Select page {label}	Избиране на страница {label}
+	Rotate page {label} counterclockwise	Завъртане на страница {label} обратно на часовниковата стрелка
+	Rotate page {label} clockwise	Завъртане на страница {label} по часовниковата стрелка
+	Delete page {label}	Изтриване на страница {label}
+	Mouse wheel scroll speed	Скорост на превъртане с колелцето на мишката
+scroll speed	Slow	Ниска
+scroll speed	Normal	Нормална
+scroll speed	Fast	Висока
+	Enhance camera image	Подобри снимка от камера
+	Drag the corners onto the document's edges, then choose Enhance page.	Плъзнете ъглите до краищата на документа, след това изберете „Подобри страницата“.
+	Enhance page	Подобри страницата
+	Done adding text	Готово с добавянето на текст
+	Discard this text (Esc)	Отхвърли този текст (Esc)
+	Clean-up	Почистване
+	Original	Оригинал
+	Greyscale	Нива на сивото
+	Black and white	Черно-бяло
diff --git a/crates/ui-egui/src/i18n/cs.tsv b/crates/ui-egui/src/i18n/cs.tsv
index 0d4741fa..c579e549 100644
--- a/crates/ui-egui/src/i18n/cs.tsv
+++ b/crates/ui-egui/src/i18n/cs.tsv
@@ -1,12 +1,23 @@
-# Czech (cs) catalog. Format: see the header of ja.tsv
-# (context <TAB> source <TAB> translation; @id, @plural and other contexts; escapes \n \t \\).
-# Plural forms (see `plural_cs` in i18n/mod.rs): one (1) | few (2–4) | other (0, 5+).
+# Czech (cs) catalog. Columns, separated by a TAB:  context <TAB> source <TAB> translation
+#
+#   context  empty                a plain UI string; `source` is the English text in the code
+#            @id                  a command id (e.g. file.saveAs): wins over the English text for
+#                                 that menu item, so one id can read differently from its twin
+#            @plural              `source` is "one|other" (English forms); the translation lists the
+#                                 Czech forms "one|few|other" (1 | 2–4 | 0, 5+), see `plural_cs` in
+#                                 i18n/mod.rs
+#            anything else        a disambiguating context passed to `tr_ctx`
+#   escapes  \n  \t  \\  inside a column. `{name}` placeholders must appear in both columns.
+#   lines starting with # and blank lines are ignored.
 #
 # Clean-room: written from the meaning of the English labels, following common Czech desktop
 # conventions (menus are nouns, commands are infinitives); not taken from Adobe Acrobat's Czech
 # localisation or any other product's translation. Terminology: annotations are "komentáře",
-# pages are "stránky", form fields are "formulářová pole". Product and format names (PdfCraft,
-# PDF, Word, HTML…) stay in Latin letters; the trailing "…" of dialog commands is kept.
+# pages are "stránky", form fields are "formulářová pole", redaction is "začernění", flattening is
+# "sloučení se stránkou", tags are "tagy" (to tag = "označkovat"). Product and format names
+# (PdfCraft, PDF, PDF/A, OCR, XFA, Word, HTML…) stay in Latin letters; the trailing "…" of dialog
+# commands is kept. Messages with a count but no `@plural` entry use count-neutral wording
+# ("Vybráno stránek: {n}"), because Czech has three plural forms.
 
 	Menu	Nabídka
 	File	Soubor
@@ -37,7 +48,7 @@
 	Remove from Recent	Odebrat z nedávných souborů
 	Remove {name} from Recent	Odebrat {name} z nedávných souborů
 	Clear	Vymazat
-	Pin folder to Home…	Připnout složku na úvodní stránku…
+	Pin folder to Home…	Připnout složku na úvodní obrazovku…
 	No recent files	Žádné nedávné soubory
 	New blank PDF	Nový prázdný dokument PDF
 	Create PDF from file…	Vytvořit PDF ze souboru…
@@ -121,16 +132,22 @@
 	Fit one full page	Celá jedna stránka
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Používá se, když PDF nepožaduje rozložení ani zvětšení. Plynulé posouvání mezi stránkami neskáče.
 	Reopen the files that were open when PdfCraft last closed	Znovu otevřít soubory, které byly otevřené při posledním zavření aplikace PdfCraft
+	Reload documents when their files change on disk	Znovu načítat dokumenty při změně jejich souborů na disku
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Tento soubor se na disku změnil. Znovu jej načtěte, abyste viděli novou verzi; neuložené změny budou ztraceny.
+	Reload	Znovu načíst
+	Couldn't reload {name}: {e}	Soubor {name} nelze znovu načíst: {e}
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Vyberte obrázek PNG nebo JPEG (nejvýše 4 MiB). Průhlednost bude zachována.
 	Couldn't import the signature image: {e}	Obrázek podpisu nelze importovat: {e}
 	Portable mode is off: {folder} can't be written ({error}). Settings are kept in your user folder instead.	Přenosný režim je vypnutý: do složky {folder} nelze zapisovat ({error}). Nastavení se místo toho ukládá do vaší uživatelské složky.
 	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft vykresluje bez grafického procesoru, takže může být pomalý. Pomoci může aktualizace grafického ovladače.
 	Go to page…	Přejít na stránku…
+	Margins	Okraje
+	For page sizes and margins.	Pro velikosti stránek a okraje.
 	Open arrow	Otevřená šipka
-	Closed arrow	Zavřená šipka
+	Closed arrow	Uzavřená šipka
 	Butt	Tupý konec
-	Reverse open arrow	Otevřená šipka obráceně
-	Reverse closed arrow	Zavřená šipka obráceně
+	Reverse open arrow	Obrácená otevřená šipka
+	Reverse closed arrow	Obrácená uzavřená šipka
 	Slash	Lomítko
 	Scroll tabs left	Posunout karty doleva
 	Scroll tabs right	Posunout karty doprava
@@ -182,3 +199,2128 @@ key	Space	Mezerník
 	Resize panel window	Změnit velikost okna panelu
 	Tools	Nástroje
 	Inspector	Inspektor
+
+# The rest of the interface: Home, All tools, panels, dialogs, notices and history labels.
+	Folders	Složky
+	Pin a folder…	Připnout složku…
+	Pin a folder to Home	Připnout složku na úvodní obrazovku
+	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Připněte složku a uvidíte zde její nejnovější soubory PDF, třeba tu, kam ukládá skener nebo synchronizovaný cloudový disk.
+	Unpin	Odepnout
+	Unpin {folder}	Odepnout {folder}
+	Looking for PDFs…	Hledání souborů PDF…
+	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	Tato složka teď není dostupná. Mohla být přesunuta nebo je její disk či cloudová synchronizace offline.
+	No PDFs in this folder yet	V této složce zatím nejsou žádné soubory PDF
+	Show less	Zobrazit méně
+	Show {n} more	Zobrazit další ({n})
+	The newest {n} of {total} PDFs	Nejnovější soubory PDF: {n} z {total}
+	Pinned folders need the desktop app	Připnuté složky vyžadují desktopovou aplikaci
+	Choose a folder on this computer to pin	Vyberte složku v tomto počítači, kterou chcete připnout
+	{folder} is already pinned to Home	Složka {folder} už je připnutá na úvodní obrazovce
+	You can pin up to {n} folders. Unpin one first.	Připnout lze nejvýše {n} složek. Nejdříve některou odepněte.
+	Pinned {folder} to Home	Složka {folder} je připnutá na úvodní obrazovce
+	Join our Discord	Připojit se k našemu Discordu
+	Close	Zavřít
+	Next / previous match	Další / předchozí shoda
+	Copy selected text	Kopírovat vybraný text
+	Double-click	Dvojité kliknutí
+	Select a word	Vybrat slovo
+	Clear selection / close find	Zrušit výběr / zavřít hledání
+	Zoom in / out (also pinch or {key}-scroll)	Přiblížit / oddálit (také sevřením prstů nebo posouváním s {key})
+	Rotate view	Otočit zobrazení
+	First / last page	První / poslední stránka
+	Previous / next page	Předchozí / další stránka
+	Delete selected pages (Organize)	Odstranit vybrané stránky (Uspořádání)
+	Select all pages (Organize)	Vybrat všechny stránky (Uspořádání)
+	Home	Domů
+	Open	Otevřít
+	Open a PDF ({key})	Otevřít PDF ({key})
+	Dark gray theme	Tmavě šedý motiv
+	Light theme	Světlý motiv
+	All tools	Všechny nástroje
+	Read	Čtení
+	Convert	Převod
+	E-Sign	E-podpis
+	Print ({key})	Tisk ({key})
+	Save (M4)	Uložit (M4)
+	Document properties ({key})	Vlastnosti dokumentu ({key})
+	Find tools and commands	Najít nástroje a příkazy
+	Fit to height	Přizpůsobit výšce
+	Zoom in	Přiblížit
+	Zoom out	Oddálit
+	Rotate view clockwise	Otočit zobrazení po směru hodinových ručiček
+	Rotate view counterclockwise	Otočit zobrazení proti směru hodinových ručiček
+	Page navigation	Navigace stránkami
+	Previous view	Předchozí zobrazení
+	Next view	Další zobrazení
+	Use system setting	Podle nastavení systému
+	Light gray	Světle šedý
+	Dark gray	Tmavě šedý
+	Comments	Komentáře
+	Bookmarks	Záložky
+	Fields	Pole
+	Layers	Vrstvy
+	Attachments	Přílohy
+	Signatures	Podpisy
+	Accessibility Checker	Kontrola přístupnosti
+	Search	Hledání
+	Compare	Porovnání
+	Page thumbnails	Miniatury stránek
+	Form fields	Formulářová pole
+	Zoom out ({key})	Oddálit ({key})
+	Zoom in ({key})	Přiblížit ({key})
+	Rotate view clockwise ({key})	Otočit zobrazení po směru hodinových ručiček ({key})
+	Toggle fit page / fit width	Přepnout celou stránku / šířku stránky
+	Next page	Další stránka
+	Previous page	Předchozí stránka
+	Current page — type a page number or label (such as iv) and press Enter	Aktuální stránka — zadejte číslo nebo označení stránky (třeba iv) a stiskněte Enter
+	Welcome to PdfCraft	Vítá vás PdfCraft
+	An open-source PDF workbench — local, private, and scriptable.	Open-source dílna pro PDF — lokální, soukromá a skriptovatelná.
+	Join the ArtCraft community	Připojte se ke komunitě ArtCraft
+	Get help, share feedback and follow development on Discord.	Získejte pomoc, sdílejte zpětnou vazbu a sledujte vývoj na Discordu.
+	Recommended tools	Doporučené nástroje
+	Use now	Použít
+	Open file	Otevřít soubor
+	Recent	Nedávné
+	Files you open in PdfCraft appear here. Drop a PDF anywhere to open it.	Zde se zobrazí soubory, které otevřete v PdfCraftu. Soubor PDF otevřete přetažením kamkoli do okna.
+	Privacy	Soukromí
+	PdfCraft works offline. No telemetry, no account, and no cloud processing unless you add a provider.	PdfCraft funguje offline. Žádná telemetrie, žádný účet a žádné zpracování v cloudu, pokud nepřidáte poskytovatele.
+	Scripts run in a sandbox without file or network access. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Skripty běží v izolovaném prostředí bez přístupu k souborům a síti. S vypnutým JavaScriptem dál fungují standardní funkce Acrobatu pro formátování, ověření a výpočty.
+	Back to all tools	Zpět na všechny nástroje
+	Close panel	Zavřít panel
+	View less	Zobrazit méně
+	View more	Zobrazit více
+	Available	Dostupné
+	Ready	Připraveno
+	Search tools and commands…	Hledat nástroje a příkazy…
+	No matching tools	Žádné odpovídající nástroje
+	Tool	Nástroj
+	Command	Příkaz
+	Add a sticky note	Přidat rychlou poznámku
+	Add a text box	Přidat textový rámeček
+	Highlight text	Zvýraznit text
+	Underline text	Podtrhnout text
+	Strikethrough text	Přeškrtnout text
+	Squiggly underline text	Podtrhnout text vlnovkou
+	Draw freehand	Kreslit od ruky
+	Draw a line	Nakreslit čáru
+	Draw an arrow	Nakreslit šipku
+	Draw a rectangle	Nakreslit obdélník
+	Draw an oval	Nakreslit ovál
+	Draw a polygon	Nakreslit mnohoúhelník
+	Draw connected lines	Nakreslit lomenou čáru
+	Draw a cloud	Nakreslit obláček
+	Add a callout	Přidat popisek se šipkou
+	Insert text	Vložit text
+	Replace text	Nahradit text
+	Attach a file	Připojit soubor
+	Erase drawings	Vymazat kresby
+	Flatten comments	Sloučit komentáře se stránkou
+	Import comments…	Importovat komentáře…
+	Add a stamp	Přidat razítko
+	Export all comments to data file…	Exportovat všechny komentáře do datového souboru…
+	Hide all comments	Skrýt všechny komentáře
+	Summarize comments	Shrnout komentáře
+	Import form data…	Importovat data formuláře…
+	Export form data…	Exportovat data formuláře…
+	PDF/A…	PDF/A…
+	Action Wizard…	Průvodce akcemi…
+	Prepare for distribution…	Připravit k distribuci…
+	Optimize scanned documents…	Optimalizovat skenované dokumenty…
+	Compare files…	Porovnat soubory…
+	Detect form fields	Rozpoznat formulářová pole
+	Merge data files into spreadsheet…	Sloučit datové soubory do tabulky…
+	Flatten form fields	Sloučit formulářová pole se stránkou
+	Prepare a form	Připravit formulář
+	Tab order: by rows	Pořadí tabulátoru: po řádcích
+	Tab order: by columns	Pořadí tabulátoru: po sloupcích
+	Tab order: by document structure	Pořadí tabulátoru: podle struktury dokumentu
+	Add text	Přidat text
+	Edit text & images	Upravit text a obrázky
+	Add or edit links	Přidat nebo upravit odkazy
+	Create links from URLs	Vytvořit odkazy z adres URL
+	Remove all links	Odebrat všechny odkazy
+	Add Bates numbering…	Přidat Batesovo číslování…
+	Add image…	Přidat obrázek…
+	Redact text and images	Začernit text a obrázky
+	Redact pages…	Začernit stránky…
+	Find text and redact…	Najít text a začernit…
+	Redaction properties…	Vlastnosti začernění…
+	Apply redactions…	Provést začernění…
+	Clear redaction marks	Vymazat značky začernění
+	Remove hidden information…	Odebrat skryté informace…
+	Sanitize document…	Vyčistit dokument…
+	Field properties…	Vlastnosti pole…
+	Add a text field	Přidat textové pole
+	Add a checkbox	Přidat zaškrtávací políčko
+	Add a radio button	Přidat přepínač
+	Add a drop-down list	Přidat rozevírací seznam
+	Add a list box	Přidat seznam
+	Add a button	Přidat tlačítko
+	Add an image field	Přidat pole obrázku
+	Add a date field	Přidat pole data
+	Add a digital signature field	Přidat pole digitálního podpisu
+	Digitally sign	Digitálně podepsat
+	Certify (visible signature)	Certifikovat (viditelný podpis)
+	Certify (invisible signature)	Certifikovat (neviditelný podpis)
+	Validate all signatures	Ověřit všechny podpisy
+	Fill & Sign: add text	Vyplnit a podepsat: přidat text
+	Fill & Sign: checkmark	Vyplnit a podepsat: zaškrtnutí
+	Fill & Sign: cross	Vyplnit a podepsat: křížek
+	Fill & Sign: dot	Vyplnit a podepsat: tečka
+	Fill & Sign: line	Vyplnit a podepsat: čára
+	Fill & Sign: date	Vyplnit a podepsat: datum
+	Fill & Sign: sign	Vyplnit a podepsat: podpis
+	Fill & Sign: initials	Vyplnit a podepsat: iniciály
+	JavaScript console…	Konzole JavaScriptu…
+	Document JavaScripts…	Skripty JavaScript dokumentu…
+	Recognize text…	Rozpoznat text…
+	Recognize text in multiple files…	Rozpoznat text ve více souborech…
+	Check for accessibility…	Zkontrolovat přístupnost…
+	Open accessibility report	Otevřít zprávu o přístupnosti
+	Change reading options…	Změnit možnosti čtení…
+	Add alternate text…	Přidat alternativní text…
+	Add header & footer…	Přidat záhlaví a zápatí…
+	Update header & footer…	Aktualizovat záhlaví a zápatí…
+	Remove header & footer	Odebrat záhlaví a zápatí
+	Add watermark…	Přidat vodoznak…
+	Update watermark…	Aktualizovat vodoznak…
+	Remove watermark	Odebrat vodoznak
+	Add background…	Přidat pozadí…
+	Update background…	Aktualizovat pozadí…
+	Remove background	Odebrat pozadí
+	Export a PDF	Exportovat PDF
+	Export to	Exportovat do
+	Microsoft Word (.docx)	Microsoft Word (.docx)
+	Spreadsheet (.xlsx)	Tabulka (.xlsx)
+	Presentation (.pptx)	Prezentace (.pptx)
+	Image (PNG)	Obrázek (PNG)
+	Export all images	Exportovat všechny obrázky
+	HTML web page	Webová stránka HTML
+	Rich Text Format (.rtf)	Formát RTF (.rtf)
+	Text (plain)	Text (prostý)
+	PostScript / EPS	PostScript / EPS
+	Fill & Sign	Vyplnit a podepsat
+	Fill	Vyplnění
+	Checkmark	Zaškrtnutí
+	Cross	Křížek
+	Dot	Tečka
+	Line	Čára
+	Date	Datum
+	Signature	Podpis
+	Initials	Iniciály
+	Edit a PDF	Upravit PDF
+	Modify page	Úprava stránek
+	Rotate pages	Otočit stránky
+	Insert pages	Vložit stránky
+	Extract pages	Extrahovat stránky
+	Add content	Přidat obsah
+	Text	Text
+	Image	Obrázek
+	Header and footer	Záhlaví a zápatí
+	Watermark	Vodoznak
+	Link	Odkaz
+	Bates numbering	Batesovo číslování
+	Background	Pozadí
+	Attach file	Připojit soubor
+	Create a PDF	Vytvořit PDF
+	Create from	Vytvořit z
+	Single file	Jeden soubor
+	Multiple files	Více souborů
+	Images	Obrázky
+	Clipboard	Schránka
+	Blank page	Prázdná stránka
+	Combine files	Sloučit soubory
+	Combine	Sloučit
+	Add files to combine	Přidejte soubory ke sloučení
+	Page options	Možnosti stránek
+	Page grid	Mřížka stránek
+	Rotate	Otočit
+	Delete	Odstranit
+	Extract	Extrahovat
+	Insert	Vložit
+	Replace	Nahradit
+	Split	Rozdělit
+	More	Další
+	Set page boxes	Nastavit rámečky stránek
+	Page labels	Označení stránek
+	Page transitions	Přechody stránek
+	Add comments	Přidat komentáře
+	Markup	Značky
+	Sticky note	Rychlá poznámka
+	Underline	Podtržení
+	Strikethrough	Přeškrtnutí
+	Squiggly underline	Podtržení vlnovkou
+	Text box	Textový rámeček
+	Drawing	Kresba
+	Rectangle	Obdélník
+	Oval	Ovál
+	Arrow	Šipka
+	Cloud	Obláček
+	Stamp	Razítko
+	Review	Revize
+	Comment list	Seznam komentářů
+	Scan & OCR	Sken a OCR
+	Recognize text	Rozpoznat text
+	In this file	V tomto souboru
+	In multiple files	Ve více souborech
+	Enhance scanned file	Vylepšit naskenovaný soubor
+	Correct recognized text	Opravit rozpoznaný text
+	Protect a PDF	Zabezpečit PDF
+	Protect	Zabezpečení
+	Protect with password	Chránit heslem
+	Remove hidden information	Odebrat skryté informace
+	Advanced options	Pokročilé možnosti
+	Encrypt with certificate	Šifrovat certifikátem
+	Security properties	Vlastnosti zabezpečení
+	Redact a PDF	Začernit PDF
+	Redact	Začernění
+	Redact pages	Začernit stránky
+	Find text and redact	Najít text a začernit
+	Set properties	Nastavit vlastnosti
+	Sanitize document	Vyčistit dokument
+	Compress a PDF	Komprimovat PDF
+	Optimize	Optimalizace
+	Reduce file size	Zmenšit velikost souboru
+	Advanced optimization	Pokročilá optimalizace
+	Audit space usage	Analyzovat využití místa
+	Field list	Seznam polí
+	Field properties	Vlastnosti pole
+	Tab order by rows	Pořadí tabulátoru po řádcích
+	Tab order by columns	Pořadí tabulátoru po sloupcích
+	Import data	Importovat data
+	Export data	Exportovat data
+	Add form components	Přidat prvky formuláře
+	Text field	Textové pole
+	Checkbox	Zaškrtávací políčko
+	Radio button	Přepínač
+	Drop-down list	Rozevírací seznam
+	List box	Seznam
+	Button	Tlačítko
+	Image field	Pole obrázku
+	Date field	Pole data
+	Digital signature	Digitální podpis
+	Stamps	Razítka
+	Stamp palette	Paleta razítek
+	Use a certificate	Použít certifikát
+	Certificates	Certifikáty
+	Timestamp	Časové razítko
+	Use print production	Použít přípravu pro tisk
+	Print production	Příprava pro tisk
+	Output preview	Náhled výstupu
+	Preflight	Předtisková kontrola
+	Convert colors	Převést barvy
+	Add printer marks	Přidat tiskové značky
+	Fix hairlines	Opravit vlasové čáry
+	Measure objects	Měřit objekty
+	Measure	Měření
+	Measuring tool	Nástroj pro měření
+	Geospatial location	Geoprostorová poloha
+	Compare files	Porovnat soubory
+	Select files to compare	Vyberte soubory k porovnání
+	Use guided actions	Použít akce s průvodcem
+	Actions list	Seznam akcí
+	Action Wizard	Průvodce akcemi
+	Make accessible	Zpřístupnit
+	Prepare for distribution	Připravit k distribuci
+	Optimize scanned documents	Optimalizovat skenované dokumenty
+	Archive documents	Archivovat dokumenty
+	Prepare for accessibility	Zajistit přístupnost
+	Accessibility	Přístupnost
+	Automatically tag PDF	Automaticky označkovat PDF
+	Change reading options	Změnit možnosti čtení
+	Check for accessibility	Zkontrolovat přístupnost
+	Add alternate text	Přidat alternativní text
+	Fix reading order	Opravit pořadí čtení
+	Apply PDF standards	Použít standardy PDF
+	Standards	Standardy
+	Save as PDF/A	Uložit jako PDF/A
+	Save as PDF/X	Uložit jako PDF/X
+	Save as PDF/UA	Uložit jako PDF/UA
+	Add search index	Přidat vyhledávací index
+	Index	Index
+	Manage embedded index	Spravovat vložený index
+	Use JavaScript	Použít JavaScript
+	JavaScript	JavaScript
+	Console	Konzole
+	Document JavaScripts	Skripty JavaScript dokumentu
+	Document actions	Akce dokumentu
+	AI assistant	AI asistent
+	Bring your own model (off by default)	Vlastní model (ve výchozím stavu vypnuto)
+	Summarize	Shrnout
+	Ask about this document	Zeptat se na tento dokument
+	Translate	Přeložit
+	pages	str.
+	Planned	Plánováno
+	Planned for milestone	Plánováno pro milník
+	open to see what it will include	otevřete a uvidíte, co bude obsahovat
+	Optional: needs an AI provider you configure	Volitelné: vyžaduje poskytovatele AI, kterého nastavíte
+	Coming in milestone	Přijde v milníku
+	Items marked Ready work today.	Položky označené Připraveno fungují už dnes.
+	Preview	Náhled
+	Edit fields	Upravit pole
+	Try the form as people filling it in will see it	Vyzkoušejte formulář tak, jak ho uvidí ti, kdo ho budou vyplňovat
+	Redact all	Začernit vše
+	Clear all	Vymazat vše
+	Rotate page	Otočit stránku
+	Delete page	Odstranit stránku
+	Move page	Přesunout stránku
+	Move pages	Přesunout stránky
+	Duplicate page	Duplikovat stránku
+	Replace page	Nahradit stránku
+	Replace pages	Nahradit stránky
+	Crop page	Oříznout stránku
+	Cancel	Zrušit
+	Don't save	Neukládat
+	Apply	Použít
+	Run	Spustit
+	Sanitize	Vyčistit
+	Mark all	Označit vše
+	Save changes to “{name}” before closing?	Uložit změny v „{name}“ před zavřením?
+	Your changes will be lost if you don't save them.	Pokud změny neuložíte, budou ztraceny.
+	Password required	Vyžadováno heslo
+	“{name}” is protected. Enter a password to open it.	Soubor „{name}“ je chráněný. Zadejte heslo pro jeho otevření.
+	Password	Heslo
+	Incorrect password. Try again.	Nesprávné heslo. Zkuste to znovu.
+	Recognize Text	Rozpoznat text
+	Password protection will be applied when you save	Ochrana heslem se použije při uložení
+	Saved the print-ready PDF to {path}	PDF připravené k tisku bylo uloženo do {path}
+	Could not save: {e}	Nelze uložit: {e}
+	Earlier in tab order	Dříve v pořadí tabulátoru
+	Later in tab order	Později v pořadí tabulátoru
+	From:	Od:
+	To:	Do:
+	High Resolution	Vysoké rozlišení
+	Print	Tisk
+	Verify to see what the document needs.	Ověřte, co dokument potřebuje.
+	Set Page Boxes	Nastavit rámečky stránek
+	Signature panel	Panel podpisů
+	{month} {day}, {y}	{day}. {month} {y}
+	The document's security settings don't allow filling in form fields	Nastavení zabezpečení dokumentu nedovoluje vyplňovat formulářová pole
+	{name} is read-only	{name} je jen pro čtení
+	{name} has no action	{name} nemá žádnou akci
+	Previous month	Předchozí měsíc
+	Next month	Další měsíc
+	January	Leden
+	February	Únor
+	March	Březen
+	April	Duben
+	May	Květen
+	June	Červen
+	July	Červenec
+	August	Srpen
+	September	Září
+	October	Říjen
+	November	Listopad
+	December	Prosinec
+	Done	Hotovo
+	This certificate is in your list of trusted certificates.	Tento certifikát je ve vašem seznamu důvěryhodných certifikátů.
+	This certificate is trusted through a certificate above it in the chain.	Tento certifikát je důvěryhodný díky certifikátu nad ním v řetězci.
+	This certificate is not trusted. Signatures made with it show an unknown identity.	Tento certifikát není důvěryhodný. Podpisy vytvořené tímto certifikátem mají neznámou identitu.
+	Add to Trusted Certificates	Přidat k důvěryhodným certifikátům
+	Export…	Exportovat…
+	PDF Optimizer	Optimalizace PDF
+	Discard Objects	Zahodit objekty
+	Discard User Data	Zahodit uživatelská data
+	Clean Up	Vyčištění
+	Color Images	Barevné obrázky
+	Grayscale Images	Obrázky ve stupních šedi
+	Bicubic downsampling to	Bikubické převzorkování na
+	for images above	u obrázků nad
+	Compression	Komprese
+	ZIP	ZIP
+	Retain existing	Ponechat stávající
+	Minimum	Minimální
+	Low	Nízká
+	High	Vysoká
+	Maximum	Maximální
+	Each image is measured where pages draw it; an image is replaced only if the result is smaller.	Každý obrázek se měří tam, kde ho stránky vykreslují; obrázek se nahradí, jen pokud bude výsledek menší.
+	Discard all links, actions and JavaScript	Zahodit všechny odkazy, akce a JavaScript
+	Discard alternate images	Zahodit alternativní obrázky
+	Discard embedded page thumbnails	Zahodit vložené miniatury stránek
+	Discard document tags	Zahodit tagy dokumentu
+	Discard embedded print settings	Zahodit vložené nastavení tisku
+	Discard bookmarks	Zahodit záložky
+	Discard hidden layer content	Zahodit obsah skrytých vrstev
+	Discard all comments, forms and multimedia	Zahodit všechny komentáře, formuláře a multimédia
+	Discard document information and metadata	Zahodit informace o dokumentu a metadata
+	Discard all object data (file attachments)	Zahodit všechna data objektů (připojené soubory)
+	Discard private data of other applications	Zahodit soukromá data jiných aplikací
+	Discard hidden text	Zahodit skrytý text
+	Use Flate to encode streams that are not encoded	Kódovat nekódované proudy metodou Flate
+	Remove invalid links and bookmarks	Odebrat neplatné odkazy a záložky
+	Remove unreferenced named destinations	Odebrat nepoužívané pojmenované cíle
+	Compress document structure (object streams)	Komprimovat strukturu dokumentu (proudy objektů)
+	Remove unused objects and merge identical ones	Odebrat nepoužívané objekty a sloučit shodné
+	Audit space usage…	Analyzovat využití místa…
+	Space Audit	Analýza využití místa
+	Bytes	Bajty
+	Content Streams	Proudy obsahu
+	X Object Forms	Objekty Form XObject
+	Structure Info	Informace o struktuře
+	Thumbnails	Miniatury
+	Named Destinations	Pojmenované cíle
+	Color Spaces	Barevné prostory
+	Shadings	Stínování
+	Patterns (graphics objects)	Vzorky (grafické objekty)
+	Extended Graphics States	Rozšířené grafické stavy
+	Embedded Files	Vložené soubory
+	Document Overhead	Režie dokumentu
+	Total	Celkem
+	Text Field Properties	Vlastnosti textového pole
+	Check Box Properties	Vlastnosti zaškrtávacího políčka
+	Radio Button Properties	Vlastnosti přepínače
+	Dropdown Properties	Vlastnosti rozevíracího seznamu
+	List Box Properties	Vlastnosti seznamu
+	Button Properties	Vlastnosti tlačítka
+	Digital Signature Properties	Vlastnosti digitálního podpisu
+	Position	Umístění
+	Options	Možnosti
+	Validate	Ověření
+	Calculate	Výpočet
+	Actions	Akce
+	This field is locked. Unlock it to change its properties.	Toto pole je zamčené. Chcete-li změnit jeho vlastnosti, odemkněte ho.
+	Tooltip:	Popisek:
+	Common Properties	Společné vlastnosti
+	Read Only	Jen pro čtení
+	Required	Povinné
+	Font Size:	Velikost písma:
+	Text Color:	Barva textu:
+	Borders and Colors	Ohraničení a barvy
+	Border Color:	Barva ohraničení:
+	Fill Color:	Barva výplně:
+	No color	Bez barvy
+	Beveled	Zkosená
+	Left:	Vlevo:
+	Bottom:	Dole:
+	Width:	Šířka:
+	Height:	Výška:
+	Points from the page's bottom-left corner.	V bodech od levého dolního rohu stránky.
+	Alignment:	Zarovnání:
+	Default Value:	Výchozí hodnota:
+	Multi-line	Víceřádkové
+	Scroll long text	Posouvat dlouhý text
+	Allow Rich Text Formatting	Povolit formátovaný text
+	Limit of	Omezit na
+	characters	znaků
+	Field is used for file selection	Pole slouží k výběru souboru
+	Check spelling	Kontrolovat pravopis
+	Comb of	Rozdělit na
+	Export Value: {on}	Hodnota pro export: {on}
+	Check box is checked by default	Zaškrtávací políčko je ve výchozím stavu zaškrtnuté
+	Button is checked by default	Přepínač je ve výchozím stavu vybraný
+	Buttons with the same name and value are selected in unison	Přepínače se stejným názvem a hodnotou se vybírají současně
+	Item:	Položka:
+	Item List	Seznam položek
+	Up	Nahoru
+	Delete {o}	Odstranit {o}
+	Add the choices people pick from.	Přidejte možnosti, ze kterých se bude vybírat.
+	Default:	Výchozí:
+	(none)	(žádná)
+	Sort items	Seřadit položky
+	Allow user to enter custom text	Povolit zadání vlastního textu
+	Multiple selection	Vícenásobný výběr
+	Commit selected value immediately	Potvrdit vybranou hodnotu okamžitě
+	Number	Číslo
+	Percentage	Procento
+	Time	Čas
+	Special	Speciální
+	Select format category:	Vyberte kategorii formátu:
+	The value is shown as typed.	Hodnota se zobrazí tak, jak byla zadána.
+	Decimal places:	Desetinná místa:
+	Separator style:	Styl oddělovače:
+	Currency symbol:	Symbol měny:
+	Before the number	Před číslem
+	Negative number style:	Styl záporného čísla:
+	Format:	Formát:
+	Custom:	Vlastní:
+	Zip Code	PSČ (USA)
+	Zip Code + 4	PSČ + 4 (USA)
+	Phone Number	Telefonní číslo (USA)
+	Social Security Number	Číslo sociálního zabezpečení (USA)
+	Arbitrary Mask	Libovolná maska
+	Mask:	Maska:
+	9 digit, A letter, O letter or digit, X any character	9 číslice, A písmeno, O písmeno nebo číslice, X libovolný znak
+	Example: {sample}	Příklad: {sample}
+	Field value is not validated	Hodnota pole se neověřuje
+	Field value is in range:	Hodnota pole je v rozsahu:
+	Add an Action	Přidat akci
+	Select Trigger:	Vyberte spouštěč:
+	Mouse Up	Uvolnění tlačítka myši
+	Mouse Down	Stisknutí tlačítka myši
+	Mouse Enter	Najetí kurzoru
+	Mouse Exit	Odjetí kurzoru
+	On Focus	Při získání fokusu
+	On Blur	Při ztrátě fokusu
+	Select Action:	Vyberte akci:
+	Open a web link	Otevřít webový odkaz
+	Reset a form	Resetovat formulář
+	Execute a menu item	Spustit položku nabídky
+	Show a field	Zobrazit pole
+	Hide a field	Skrýt pole
+	Submit a form	Odeslat formulář
+	Fields to reset (comma-separated; empty: all)	Pole k resetování (oddělená čárkami; prázdné: všechna)
+	Print, NextPage, PrevPage, FirstPage or LastPage	Print, NextPage, PrevPage, FirstPage nebo LastPage
+	Field names (comma-separated)	Názvy polí (oddělené čárkami)
+	URL to submit to	Adresa URL pro odeslání
+	Script:	Skript:
+	Value:	Hodnota:
+	No actions	Žádné akce
+	Value is not calculated	Hodnota se nepočítá
+	Value is the	Hodnota je
+	sum (+)	součet (+)
+	product (x)	součin (x)
+	average	průměr
+	minimum	nejmenší hodnota
+	maximum	největší hodnota
+	of the following fields:	následujících polí:
+	Simplified field notation:	Zjednodušený zápis polí:
+	Field names with + - * / and parentheses; put \\ before spaces in names.	Názvy polí s + - * / a závorkami; mezery v názvech uvozujte znakem \\.
+	Format text	Formát textu
+	Bold	Tučné
+	Italic	Kurzíva
+	Align left	Zarovnat doleva
+	Centre	Na střed
+	Align right	Zarovnat doprava
+	Justify	Do bloku
+	Standard fonts; text outside Windows-1252 isn't supported yet.	Standardní písma; text mimo Windows-1252 zatím není podporován.
+	Edit image	Upravit obrázek
+	Rotate counterclockwise	Otočit proti směru hodinových ručiček
+	Rotate clockwise	Otočit po směru hodinových ručiček
+	Flip horizontal	Převrátit vodorovně
+	Flip vertical	Převrátit svisle
+	Replace image	Nahradit obrázek
+	Crop (% trimmed from each side)	Oříznout (% z každé strany)
+	Click on the page to add text; each click starts a new box, and ✓ finishes. Drag items to move them, drag a corner to resize, double-click text to edit it.	Kliknutím na stránku přidáte text; každé kliknutí založí nový rámeček a ✓ úpravy dokončí. Položky přesunete přetažením, velikost změníte tažením za roh, text upravíte dvojitým kliknutím.
+	Choose an image	Vyberte obrázek
+	Export to Image	Exportovat jako obrázek
+	Export to Text	Exportovat jako text
+	Export All Images	Exportovat všechny obrázky
+	Resolution	Rozlišení
+	Format	Formát
+	Quality	Kvalita
+	One {f} file per page, named after the document.	Jeden soubor {f} na stránku, pojmenovaný podle dokumentu.
+	Exclude images smaller than	Vyloučit obrázky menší než
+	No limit	Bez omezení
+	Each image once, named after the document and page. JPEG images are saved unchanged; others as PNG.	Každý obrázek jednou, pojmenovaný podle dokumentu a stránky. Obrázky JPEG se uloží beze změny, ostatní jako PNG.
+	Plain text in reading order; pages are separated by form feeds.	Prostý text v pořadí čtení; stránky jsou oddělené znakem nové stránky.
+	Create {what}	Vytvořit {what}
+	initials	iniciály
+	signature	podpis
+	Create Custom Stamp	Vytvořit vlastní razítko
+	From {file}	Ze souboru {file}
+	Category:	Kategorie:
+	e.g. My stamps	např. Moje razítka
+	Name:	Název:
+	Delete stamp	Odstranit razítko
+	Create custom stamp…	Vytvořit vlastní razítko…
+	From a PDF page or an image	Ze stránky PDF nebo z obrázku
+	Line spacing	Řádkování
+	Character spacing	Mezery mezi znaky
+	Horizontal scale	Vodorovné měřítko
+	Rotate Clockwise	Otočit po směru hodinových ručiček
+	Rotate Counterclockwise	Otočit proti směru hodinových ručiček
+	Flip Horizontal	Převrátit vodorovně
+	Flip Vertical	Převrátit svisle
+	Replace Image…	Nahradit obrázek…
+	Save Image As…	Uložit obrázek jako…
+	Check for updates	Zkontrolovat aktualizace
+	No check has run yet.	Kontrola zatím neproběhla.
+	Checking for a newer version…	Hledání novější verze…
+	PdfCraft {v} is available.	Je k dispozici PdfCraft {v}.
+	You have version {c}. Download the new version from its release page.	Máte verzi {c}. Novou verzi si stáhněte z její stránky s vydáním.
+	PdfCraft {c} is up to date.	PdfCraft {c} je aktuální.
+	Couldn't check for updates: {e}	Aktualizace nelze zkontrolovat: {e}
+	You have version {c}. All releases are listed at {page}.	Máte verzi {c}. Všechna vydání najdete na {page}.
+	Asks GitHub for the latest release. Nothing is downloaded or installed automatically.	Zjistí na GitHubu nejnovější vydání. Nic se automaticky nestahuje ani neinstaluje.
+	Download	Stáhnout
+	Later	Později
+	none	žádná
+	Declared conformance: {shown}	Deklarovaná shoda: {shown}
+	Output intent: {list}	Výstupní záměr: {list}
+	Conformance level:	Úroveň shody:
+	No problems found: the document conforms to {level}.	Nenalezeny žádné problémy: dokument vyhovuje standardu {level}.
+	 (page {p})	 (stránka {p})
+	  · not fixable here	  · zde nelze opravit
+	Verify	Ověřit
+	Box	Rámeček
+	Units	Jednotky
+	Set to zero	Nastavit na nulu
+	Current page ({n})	Aktuální stránka ({n})
+	Subset	Podmnožina
+	Update	Aktualizovat
+	Add	Přidat
+	{verb} Header and Footer	{verb} záhlaví a zápatí
+	{verb} Watermark	{verb} vodoznak
+	{verb} Background	{verb} pozadí
+	Margins (in)	Okraje (palce)
+	Left Header Text	Text záhlaví vlevo
+	Center Header Text	Text záhlaví uprostřed
+	Right Header Text	Text záhlaví vpravo
+	Left Footer Text	Text zápatí vlevo
+	Center Footer Text	Text zápatí uprostřed
+	Right Footer Text	Text zápatí vpravo
+	Insert Page Number	Vložit číslo stránky
+	Insert Date	Vložit datum
+	Start page number	Počáteční číslo stránky
+	Source	Zdroj
+	Fit to page	Přizpůsobit stránce
+	Rotation	Otočení
+	Appear behind page	Zobrazit za stránkou
+	Appear on top of page	Zobrazit nad stránkou
+	From colour	Z barvy
+	Page Range Options	Možnosti rozsahu stránek
+	Preview: page {p} of {n}	Náhled: stránka {p} z {n}
+	Applies to 1 page	Týká se 1 stránky
+	Applies to {n} pages	Počet dotčených stránek: {n}
+	Replaces the existing one on those pages.	Nahradí stávající na těchto stránkách.
+	PDF or image	PDF nebo obrázek
+	No file chosen	Není vybrán žádný soubor
+	Page number	Číslo stránky
+	Scale relative to target page	Měřítko vzhledem k cílové stránce
+	Link Properties	Vlastnosti odkazu
+	Create Link	Vytvořit odkaz
+	Link Appearance	Vzhled odkazu
+	Link Type:	Typ odkazu:
+	Visible Rectangle	Viditelný obdélník
+	Invisible Rectangle	Neviditelný obdélník
+	Highlight Style:	Styl zvýraznění:
+	Invert	Invertovat
+	Outline	Obrys
+	Inset	Zapuštění
+	Line Thickness:	Tloušťka čáry:
+	Thin	Tenká
+	Thick	Silná
+	Line Style:	Styl čáry:
+	Solid	Plná
+	Dashed	Čárkovaná
+	Color:	Barva:
+	Link Action	Akce odkazu
+	Open a web page	Otevřít webovou stránku
+	Go to a page view	Přejít na zobrazení stránky
+	Type the web address.	Zadejte webovou adresu.
+	This document has no signatures.	Tento dokument nemá žádné podpisy.
+	The Keychain's digital IDs couldn't be listed: {e}	Digitální ID z Klíčenky nelze vypsat: {e}
+	Signed and saved to {path}	Podepsáno a uloženo do {path}
+	Couldn't open revision {n}: {e}	Revizi {n} nelze otevřít: {e}
+	Couldn't open the signed version: {e}	Podepsanou verzi nelze otevřít: {e}
+	Sign with a Digital ID	Podepsat digitálním ID
+	Choose the digital ID that you want to use for signing:	Vyberte digitální ID, kterým chcete podepisovat:
+	Keychain  ·  	Klíčenka  ·  
+	Windows store  ·  	Úložiště Windows  ·  
+	Issued by: 	Vydal: 
+	, Expires: 	, platnost do: 
+	No digital IDs yet.	Zatím žádná digitální ID.
+	Configure New Digital ID	Nastavit nové digitální ID
+	Continue	Pokračovat
+	Configure a Digital ID for Signing	Nastavení digitálního ID pro podepisování
+	Use a Digital ID from a file	Použít digitální ID ze souboru
+	Create a new Digital ID (self-signed, saved to a password-protected file)	Vytvořit nové digitální ID (samopodepsané, uložené do souboru chráněného heslem)
+	Name	Jméno
+	Organizational Unit	Organizační jednotka
+	Organization Name	Název organizace
+	Email Address	E-mailová adresa
+	Country/Region	Země/oblast
+	Key Algorithm	Algoritmus klíče
+	Confirm Password	Potvrzení hesla
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	Platí 5 let, pro digitální podpisy. Samopodepsaná ID ostatní obvykle nepovažují za důvěryhodná.
+	File (.p12, .pfx)	Soubor (.p12, .pfx)
+	Digital ID	Digitální ID
+	Browse…	Procházet…
+	{verb} as "{name}"	{verb} jako „{name}“
+	Certify	Certifikovat
+	The signature will be invisible.	Podpis bude neviditelný.
+	Distinguished name	Rozlišující jméno
+	Labels	Popisky
+	Graphic	Grafika
+	Signer's name	Jméno podepisující osoby
+	Fill & Sign signature	Podpis z nástroje Vyplnit a podepsat
+	Choose image…	Vybrat obrázek…
+	Permitted actions after certifying	Povolené akce po certifikaci
+	No changes allowed	Nejsou povoleny žádné změny
+	Annotations, form fill-in, and digital signatures	Anotace, vyplňování formulářů a digitální podpisy
+	Form fill-in and digital signatures	Vyplňování formulářů a digitální podpisy
+	The key is in the macOS Keychain, which may ask to allow PdfCraft to use it.	Klíč je v Klíčence systému macOS, která se může zeptat, zda PdfCraftu povolit jeho použití.
+	The key is in the Windows certificate store, which may ask to allow PdfCraft to use it.	Klíč je v úložišti certifikátů Windows, které se může zeptat, zda PdfCraftu povolit jeho použití.
+	Digital ID password	Heslo digitálního ID
+	Back	Zpět
+	Validate all	Ověřit vše
+	Sign this field…	Podepsat toto pole…
+	Signature is valid:	Podpis je platný:
+	Signature validity is UNKNOWN:	Platnost podpisu je NEZNÁMÁ:
+	Signature is INVALID:	Podpis je NEPLATNÝ:
+	Signature Details	Podrobnosti podpisu
+	Reason	Důvod
+	Signing time	Čas podpisu
+	Algorithm	Algoritmus
+	Signer	Podepsal
+	Issued by	Vydal
+	Valid	Platný
+	Field	Pole
+	Field: {field} on page {p}	Pole: {field} na stránce {p}
+	Add to trusted certificates	Přidat k důvěryhodným certifikátům
+	View signed version	Zobrazit podepsanou verzi
+	Show certificate…	Zobrazit certifikát…
+	Export certificate…	Exportovat certifikát…
+	Certificate Viewer	Prohlížeč certifikátů
+	This dialog shows the details of a certificate and its chain.	Toto dialogové okno zobrazuje podrobnosti certifikátu a jeho řetězce.
+	Trust	Důvěryhodnost
+	Issued to	Vydáno pro
+	Valid from	Platný od
+	Valid to	Platný do
+	Intended usage	Zamýšlené použití
+	Any	Libovolné
+	Version	Verze
+	Serial number	Sériové číslo
+	Issuer	Vydavatel
+	Validity starts	Začátek platnosti
+	Validity ends	Konec platnosti
+	Public key	Veřejný klíč
+	Key usage	Použití klíče
+	Not present	Není uvedeno
+	Self-signed	Samopodepsaný
+	Edit Action	Upravit akci
+	New Action	Nová akce
+	Action name:	Název akce:
+	Description:	Popis:
+	Steps	Kroky
+	Add the steps this action runs, in order.	Přidejte kroky, které tato akce provede, v daném pořadí.
+	Add Step	Přidat krok
+	An action with this name already exists.	Akce s tímto názvem už existuje.
+	New Action…	Nová akce…
+	Edit…	Upravit…
+	Add watermark	Přidat vodoznak
+	Add header	Přidat záhlaví
+	Add footer	Přidat zápatí
+	Set document title	Nastavit název dokumentu
+	Run a JavaScript	Spustit JavaScript
+	Prepare for Distribution	Připravit k distribuci
+	Remove hidden information and flatten comments and form fields, so recipients see only the pages.	Odebere skryté informace a sloučí komentáře a formulářová pole se stránkou, takže příjemci uvidí jen stránky.
+	Optimize Scanned Documents	Optimalizovat skenované dokumenty
+	Make scans searchable, then make them smaller.	Umožní ve skenech vyhledávat a pak je zmenší.
+	Add Page Numbers	Přidat čísla stránek
+	Number every page in the footer.	Očísluje všechny stránky v zápatí.
+	Mark as Confidential	Označit jako důvěrné
+	A diagonal CONFIDENTIAL watermark on every page.	Diagonální vodoznak CONFIDENTIAL na každé stránce.
+	Sanitize Documents	Vyčistit dokumenty
+	Remove hidden information, metadata, scripts and embedded content, and rewrite the files.	Odebere skryté informace, metadata, skripty a vložený obsah a soubory znovu zapíše.
+	Type text	Napsat text
+	Text to insert	Text k vložení
+	Replacement text	Náhradní text
+	Edit text…	Upravit text…
+	Add a sticky note here	Přidat sem rychlou poznámku
+	{kind} Properties	Vlastnosti: {kind}
+	Appearance	Vzhled
+	General	Obecné
+	Review History	Historie revizí
+	This comment's appearance can't be changed yet.	Vzhled tohoto komentáře zatím nelze změnit.
+	Icon	Ikona
+	Thickness	Tloušťka
+	Modified	Změněno
+	No status has been set.	Nebyl nastaven žádný stav.
+	Compare Files	Porovnat soubory
+	Old file:	Starý soubor:
+	Open the older version first	Nejdřív otevřete starší verzi
+	New file:	Nový soubor:
+	Text is compared word by word; the differences are shown on the new file.	Text se porovnává slovo po slovu; rozdíly se zobrazí v novém souboru.
+	Compare this file with an older version: Compare files… in All tools.	Porovnání tohoto souboru se starší verzí: Porovnat soubory… ve Všech nástrojích.
+	No differences in the text.	V textu nejsou žádné rozdíly.
+	{n} {kind}	{kind}: {n}
+	Inserted	Vloženo
+	Deleted	Odstraněno
+	Replaced	Nahrazeno
+	Visual	Vizuální
+	Mark as comments	Označit jako komentáře
+	Report…	Zpráva…
+	{kind} · page {p}	{kind} · stránka {p}
+	Set Alternate Text	Nastavit alternativní text
+	This document has no tagged figures.	Tento dokument nemá žádné označkované obrázky.
+	 on page {p}	 na stránce {p}
+	Figure {i} of {n}{page}	Obrázek {i} z {n}{page}
+	No preview	Bez náhledu
+	Alternate text	Alternativní text
+	Describe the figure	Popište obrázek
+	Decorative figure	Dekorativní obrázek
+	Previous figure	Předchozí obrázek
+	Next figure	Další obrázek
+	Save & Close	Uložit a zavřít
+	Accessibility Checker Options	Možnosti kontroly přístupnosti
+	Report Options	Možnosti zprávy
+	Create accessibility report	Vytvořit zprávu o přístupnosti
+	Page Range	Rozsah stránek
+	All pages in document	Všechny stránky dokumentu
+	Checking Options ({on} of 32 in all categories)	Možnosti kontroly (zapnuto {on} z 32 ve všech kategoriích)
+	Show this dialog when the Checker starts	Zobrazit toto okno při spuštění kontroly
+	Select All	Vybrat vše
+	Clear All	Zrušit výběr
+	Start Checking	Spustit kontrolu
+	This document hasn't been checked yet.	Tento dokument zatím nebyl zkontrolován.
+	No issues found	Nenalezeny žádné problémy
+	1 issue	1 problém
+	{n} issues	Počet problémů: {n}
+	{label} (1 issue)	{label} (1 problém)
+	{label} ({n} issues)	{label} (problémy: {n})
+	Check again	Zkontrolovat znovu
+	Report	Zpráva
+	Show the accessibility report	Zobrazit zprávu o přístupnosti
+	Collapse	Sbalit
+	Expand	Rozbalit
+	{rule} - {status}	{rule} – {status}
+	Passed	Splněno
+	Failed	Nesplněno
+	Needs manual check	Vyžaduje ruční kontrolu
+	Skipped	Přeskočeno
+	Fix	Opravit
+	Skip Rule	Přeskočit pravidlo
+	Explain	Vysvětlit
+	Check Again	Zkontrolovat znovu
+	Show Report	Zobrazit zprávu
+	Options…	Možnosti…
+	Go to the page	Přejít na stránku
+	Page Content	Obsah stránky
+	Forms	Formuláře
+	Alternate Text	Alternativní text
+	Tables	Tabulky
+	Lists	Seznamy
+	Headings	Nadpisy
+	Accessibility permission flag	Příznak oprávnění přístupnosti
+	Accessibility permission flag is set	Příznak oprávnění přístupnosti je nastaven
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Nastavení zabezpečení musí asistivním technologiím dovolit číst obsah („Povolit přístup k textu pro čtečky obrazovky“). Změňte zabezpečení dokumentu tak, aby to dovolovalo.
+	Image-only PDF	PDF jen s obrázky
+	Document is not image-only PDF	Dokument není PDF jen s obrázky
+	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	Stránky, které jsou jen obrázky textu, nelze předčítat ani v nich vyhledávat. Rozpoznáním textu (OCR) přidáte textovou vrstvu.
+	Document is tagged PDF	Dokument je označkované PDF
+	Tags give the document a logical structure that assistive technology follows. Tag the document (Automatically tag PDF).	Tagy dávají dokumentu logickou strukturu, kterou asistivní technologie sledují. Označkujte dokument (Automaticky označkovat PDF).
+	Logical Reading Order	Logické pořadí čtení
+	Document structure provides a logical reading order	Struktura dokumentu poskytuje logické pořadí čtení
+	Check that the tags read in the order a sighted reader would. Use the Reading Order tool or the Tags panel to correct it.	Zkontrolujte, že tagy jdou v pořadí, v jakém by četl vidící čtenář. Opravte je nástrojem Pořadí čtení nebo v panelu Tagy.
+	Primary language	Hlavní jazyk
+	Text language is specified	Jazyk textu je určen
+	Screen readers choose their voice from the document's language. Set it in Document Properties > Advanced > Language.	Čtečky obrazovky volí hlas podle jazyka dokumentu. Nastavte ho v okně Vlastnosti dokumentu > Rozšířené > Jazyk.
+	Document title is showing in title bar	V záhlaví okna se zobrazuje název dokumentu
+	The window should show a meaningful title rather than the file name. Set a title and Initial View > Show: Document Title.	Okno by mělo místo názvu souboru zobrazovat smysluplný název. Nastavte název a Úvodní zobrazení > Zobrazit: Název dokumentu.
+	Bookmarks are present in large documents	Velké dokumenty obsahují záložky
+	Documents of more than 20 pages need bookmarks for navigation. Add bookmarks for the main sections.	Dokumenty s více než 20 stránkami potřebují k navigaci záložky. Přidejte záložky hlavních oddílů.
+	Color contrast	Barevný kontrast
+	Document has appropriate color contrast	Dokument má vhodný barevný kontrast
+	Text must contrast enough with its background for people with low vision. Check the colours by eye or with a contrast tool.	Text musí dostatečně kontrastovat s pozadím kvůli lidem se slabým zrakem. Zkontrolujte barvy okem nebo nástrojem pro kontrast.
+	Tagged content	Označkovaný obsah
+	All page content is tagged	Veškerý obsah stránek je označkovaný
+	Everything on a page must be tagged or marked as an artifact (decoration, headers, footers). Tag the untagged content.	Vše na stránce musí být označkované nebo označené jako artefakt (dekorace, záhlaví, zápatí). Označkujte neoznačkovaný obsah.
+	Tagged annotations	Označkované anotace
+	All annotations are tagged	Všechny anotace jsou označkované
+	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	Komentáře, odkazy a pole musí být ve stromu tagů, aby je čtečky oznámily. Označkujte anotace.
+	Tab order	Pořadí tabulátoru
+	Tab order is consistent with structure order	Pořadí tabulátoru odpovídá pořadí struktury
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	Stránky s odkazy, komentáři nebo poli by se měly procházet tabulátorem v pořadí struktury. Oprava nastaví pořadí tabulátoru každé stránky na Podle struktury dokumentu.
+	Character encoding	Kódování znaků
+	Reliable character encoding is provided	Je zajištěno spolehlivé kódování znaků
+	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	Písma musí mapovat své znaky na Unicode, aby šel text číst a kopírovat. Opravte písma nebo PDF vytvořte znovu.
+	Tagged multimedia	Označkovaná multimédia
+	All multimedia objects are tagged	Všechny multimediální objekty jsou označkované
+	Video, sound and rich media must be tagged to be announced. Tag the multimedia annotations.	Video, zvuk a multimédia musí být označkovaná, aby je čtečky oznámily. Označkujte multimediální anotace.
+	Screen flicker	Blikání obrazovky
+	Page will not cause screen flicker	Stránka nezpůsobí blikání obrazovky
+	Animation that flashes can cause seizures. Check scripts and media for flicker.	Blikající animace může vyvolat záchvat. Zkontrolujte skripty a média, zda neblikají.
+	Scripts	Skripty
+	No inaccessible scripts	Žádné nepřístupné skripty
+	Timed responses	Časově omezené odpovědi
+	Page does not require timed responses	Stránka nevyžaduje časově omezené odpovědi
+	People may need more time to respond. Check that nothing has a time limit.	Lidé mohou na odpověď potřebovat více času. Zkontrolujte, že nic nemá časový limit.
+	Navigation links	Navigační odkazy
+	Navigation links are not repetitive	Navigační odkazy se neopakují
+	Repeated navigation links should be skippable. Check links that appear on every page.	Opakované navigační odkazy by mělo jít přeskočit. Zkontrolujte odkazy, které jsou na každé stránce.
+	Tagged form fields	Označkovaná formulářová pole
+	All form fields are tagged	Všechna formulářová pole jsou označkovaná
+	Form fields must be in the tag tree (Form tags) to be announced. Tag the form fields.	Formulářová pole musí být ve stromu tagů (tagy Form), aby je čtečky oznámily. Označkujte formulářová pole.
+	Field descriptions	Popisy polí
+	All form fields have description	Všechna formulářová pole mají popis
+	Each field needs a tooltip that says what to enter. Add one in Field Properties > General > Tooltip.	Každé pole potřebuje popisek, který říká, co zadat. Přidejte ho v okně Vlastnosti pole > Obecné > Popisek.
+	Figures alternate text	Alternativní text obrázků
+	Figures require alternate text	Obrázky vyžadují alternativní text
+	Pictures need alternate text that describes them, or must be marked decorative. Add alternate text to each figure.	Obrázky potřebují alternativní text, který je popisuje, nebo musí být označené jako dekorativní. Přidejte alternativní text ke každému obrázku.
+	Nested alternate text	Vnořený alternativní text
+	Alternate text that will never be read	Alternativní text, který nebude nikdy přečten
+	Alternate text inside an element that already has alternate text is never read. Remove the inner alternate text.	Alternativní text uvnitř prvku, který už alternativní text má, se nikdy nepřečte. Odeberte vnitřní alternativní text.
+	Associated with content	Spojen s obsahem
+	Alternate text must be associated with some content	Alternativní text musí být spojen s nějakým obsahem
+	Alternate text on an element without page content is never reached. Remove it or attach the element to content.	Alternativní text u prvku bez obsahu stránky se nikdy nepřečte. Odeberte ho nebo prvek připojte k obsahu.
+	Hides annotation	Skrývá anotaci
+	Alternate text should not hide annotation	Alternativní text by neměl skrývat anotaci
+	Alternate text on an element that contains a link or field hides that annotation from assistive technology. Move the alternate text.	Alternativní text u prvku, který obsahuje odkaz nebo pole, tuto anotaci před asistivními technologiemi skryje. Přesuňte alternativní text.
+	Other elements alternate text	Alternativní text ostatních prvků
+	Other elements that require alternate text	Ostatní prvky, které vyžadují alternativní text
+	Formulas and similar non-text elements need alternate text. Add alternate text to them.	Vzorce a podobné netextové prvky potřebují alternativní text. Přidejte jim alternativní text.
+	Rows	Řádky
+	TR must be a child of Table, THead, TBody, or TFoot	TR musí být potomkem Table, THead, TBody nebo TFoot
+	Table cells belong in a row. Fix the table's tags.	Buňky tabulky patří do řádku. Opravte tagy tabulky.
+	Headers	Záhlaví
+	Tables should have headers	Tabulky by měly mít záhlaví
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	Buňky záhlaví (TH) sdělují posluchačům, co který sloupec nebo řádek obsahuje. Označte buňky záhlaví.
+	Regularity	Pravidelnost
+	Tables must contain the same number of columns in each row and rows in each column	Tabulky musí mít v každém řádku stejný počet sloupců a v každém sloupci stejný počet řádků
+	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	Nepravidelné tabulky matou při pohybu po buňkách. Dejte každému řádku stejný počet buněk (včetně sloučených).
+	Summary	Souhrn
+	Tables must have a summary	Tabulky musí mít souhrn
+	A summary describes the table's purpose and layout. Add a Summary attribute to each table.	Souhrn popisuje účel a uspořádání tabulky. Přidejte ke každé tabulce atribut Summary.
+	List items	Položky seznamu
+	LI must be a child of L	LI musí být potomkem L
+	List items belong in a list. Fix the list's tags.	Položky seznamu patří do seznamu. Opravte tagy seznamu.
+	Lbl and LBody	Lbl a LBody
+	Lbl and LBody must be children of LI	Lbl a LBody musí být potomky LI
+	List labels and bodies belong in a list item. Fix the list's tags.	Návěští a těla seznamu patří do položky seznamu. Opravte tagy seznamu.
+	Appropriate nesting	Správné vnoření
+	Heading levels shouldn't skip (an H1 followed by an H3). Retag the headings.	Úrovně nadpisů by se neměly přeskakovat (H1 následovaný H3). Označkujte nadpisy znovu.
+	TH and TD	TH a TD
+	TH and TD must be children of TR	TH a TD musí být potomky TR
+	Mark Page Range	Označit rozsah stránek
+	Pages from	Stránky od
+	Single word or phrase	Jedno slovo nebo fráze
+	Text to find	Hledaný text
+	Patterns	Vzory
+	Phone Numbers	Telefonní čísla
+	Email Addresses	E-mailové adresy
+	Credit Cards	Platební karty
+	Social Security Numbers	Čísla sociálního zabezpečení (USA)
+	Dates	Kalendářní data
+	Text in images isn't found; recognise text (OCR) first.	Text v obrázcích se nenajde; nejdřív rozpoznejte text (OCR).
+	No matches.	Žádné shody.
+	{n} match(es) marked for redaction.	K začernění označeno shod: {n}.
+	Redaction Tool Properties	Vlastnosti nástroje Začernění
+	Redacted area fill colour:	Barva výplně začerněné oblasti:
+	Use overlay text	Použít překryvný text
+	Custom text:	Vlastní text:
+	Redaction code:	Kód začernění:
+	Font:	Písmo:
+	Font size:	Velikost písma:
+	Auto-size text to fit redaction region	Automaticky přizpůsobit velikost textu oblasti začernění
+	Font colour:	Barva písma:
+	Repeat overlay text	Opakovat překryvný text
+	Text alignment:	Zarovnání textu:
+	Center	Na střed
+	Apply redactions	Provést začernění
+	You are about to apply 1 redaction mark. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Chystáte se použít 1 značku začernění. Text, obrázky a kresby pod značkami a komentáře a formulářová pole, která je překrývají, budou trvale odstraněny.
+	You are about to apply {n} redaction marks. Text, images and drawings under the marks, and comments and form fields that overlap them, are removed permanently.	Chystáte se použít značky začernění (počet: {n}). Text, obrázky a kresby pod značkami a komentáře a formulářová pole, která je překrývají, budou trvale odstraněny.
+	Save the document afterwards: saving rewrites the whole file so no trace of the removed content stays in it.	Dokument poté uložte: uložení přepíše celý soubor, takže v něm nezůstane žádná stopa po odstraněném obsahu.
+	Select the items to remove from this document.	Vyberte položky, které chcete z dokumentu odebrat.
+	Metadata	Metadata
+	File attachments	Připojené soubory
+	Comments and markups	Komentáře a značky
+	Hidden text	Skrytý text
+	Hidden layers	Skryté vrstvy
+	Links, actions and JavaScripts	Odkazy, akce a skripty JavaScript
+	Private data of other applications	Soukromá data jiných aplikací
+	None found	Nic nenalezeno
+	Form fields are flattened: their values stay visible. Saving rewrites the whole file.	Formulářová pole se sloučí se stránkou: jejich hodnoty zůstanou viditelné. Uložení přepíše celý soubor.
+	Remove	Odebrat
+	Sanitizing removes hidden information from the document: metadata, file attachments, comments, form fields (flattened), hidden text and layers, bookmarks, links, actions and scripts, and private application data.	Vyčištění odebere z dokumentu skryté informace: metadata, připojené soubory, komentáře, formulářová pole (sloučí se se stránkou), skrytý text a vrstvy, záložky, odkazy, akce a skripty a soukromá data aplikací.
+	Save the document afterwards; saving rewrites the whole file so nothing removed stays in it.	Dokument poté uložte; uložení přepíše celý soubor, takže v něm nic odebraného nezůstane.
+	Printer:	Tiskárna:
+	Save as PDF	Uložit jako PDF
+	{name} (default)	{name} (výchozí)
+	Copies:	Kopie:
+	Collate	Kompletovat
+	Print in grayscale	Tisknout ve stupních šedi
+	Two-sided:	Oboustranně:
+	Off	Vypnuto
+	Flip on long edge	Převrátit podle delší strany
+	Flip on short edge	Převrátit podle kratší strany
+	Paper:	Papír:
+	Pages to Print	Stránky k tisku
+	More options:	Další možnosti:
+	All pages in range	Všechny stránky v rozsahu
+	Odd pages only	Jen liché stránky
+	Even pages only	Jen sudé stránky
+	Reverse pages	Obrátit pořadí stránek
+	Page Sizing & Handling	Velikost a zpracování stránek
+	Size	Velikost
+	Poster	Plakát
+	Multiple	Více stránek
+	Booklet	Brožura
+	Fit	Přizpůsobit
+	Shrink oversized pages	Zmenšit příliš velké stránky
+	Custom scale:	Vlastní měřítko:
+	Tile scale:	Měřítko dlaždic:
+	Overlap:	Překryv:
+	Cut marks	Ořezové značky
+	Pages per sheet:	Stránek na list:
+	Page order:	Pořadí stránek:
+	Horizontal	Vodorovně
+	Horizontal reversed	Vodorovně obráceně
+	Vertical	Svisle
+	Vertical reversed	Svisle obráceně
+	Print page border	Tisknout okraj stránky
+	Auto-rotate pages	Automaticky otáčet stránky
+	Booklet subset:	Strany brožury:
+	Both sides	Obě strany
+	Front side only	Jen přední strana
+	Back side only	Jen zadní strana
+	Binding:	Vazba:
+	Left	Vlevo
+	Right	Vpravo
+	Orientation:	Orientace:
+	Auto portrait/landscape	Automaticky na výšku/na šířku
+	Portrait	Na výšku
+	Landscape	Na šířku
+	Comments & Forms	Komentáře a formuláře
+	Document	Dokument
+	Document and markups	Dokument a značky
+	Document and stamps	Dokument a razítka
+	Form fields only	Jen formulářová pole
+	Previous sheet	Předchozí list
+	Next sheet	Další list
+	No sheets	Žádné listy
+	Sheet {s} of {n}	List {s} z {n}
+	Removed 1 hidden item. Save to remove them from the file.	Odebrána 1 skrytá položka. Uložením ji odstraníte ze souboru.
+	Removed {n} hidden items. Save to remove them from the file.	Odebráno skrytých položek: {n}. Uložením je odstraníte ze souboru.
+	Document sanitized. Save to finish: saving rewrites the whole file.	Dokument byl vyčištěn. Dokončete to uložením: uložení přepíše celý soubor.
+	Applied 1 redaction mark. Save to remove the content from the file.	Použita 1 značka začernění. Uložením odstraníte obsah ze souboru.
+	Applied {n} redaction marks. Save to remove the content from the file.	Použito značek začernění: {n}. Uložením odstraníte obsah ze souboru.
+	JavaScript Console	Konzole JavaScriptu
+	JavaScript is turned off (Preferences ▸ JavaScript).	JavaScript je vypnutý („Předvolby > JavaScript“).
+	Output appears here.	Zde se zobrazí výstup.
+	Script Name:	Název skriptu:
+	This document has no document-level scripts.	Tento dokument nemá žádné skripty na úrovni dokumentu.
+	No form fields were detected	Nebyla rozpoznána žádná formulářová pole
+	Detected 1 form field	Rozpoznáno 1 formulářové pole
+	Detected {n} form fields	Rozpoznáno formulářových polí: {n}
+	{field}: {e}	{field}: {e}
+	Current page	Aktuální stránka
+	Selected pages	Vybrané stránky
+	Document language	Jazyk dokumentu
+	Output	Výstup
+	Searchable Image (Exact)	Prohledávatelný obraz (přesný)
+	Adds invisible text over each word; the page image is not changed	Přidá nad každé slovo neviditelný text; obraz stránky se nezmění
+	Downsample to	Převzorkovat na
+	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	Rozpoznávání textu není nainstalováno: chybí soubory jeho modelů. Přeinstalujte PdfCraft nebo nastavte PDFCRAFT_MODELS na složku, ve které jsou.
+	Settings	Nastavení
+	Optional	Volitelné
+	Planned · {m}	Plánováno · {m}
+	Planned for milestone {m} — open to see what it will include	Plánováno pro milník {m} — otevřete a uvidíte, co bude obsahovat
+	Coming in milestone {m}. Items marked Ready work today.	Přijde v milníku {m}. Položky označené Připraveno fungují už dnes.
+	1 mark	1 značka
+	{n} marks	Značky: {n}
+	Dynamic	Dynamická
+	Sign Here	Podepište zde
+	Standard Business	Standardní obchodní
+	Choose a stamp, then click on the page to place it.	Vyberte razítko a klikněte na stránku, kam ho chcete umístit.
+	Note	Poznámka
+	Polyline	Lomená čára
+	Attachment	Příloha
+	Callout	Popisek se šipkou
+	Typewriter	Psací stroj
+	Checked	Zaškrtnuto
+	Unchecked	Nezaškrtnuto
+	Marked	Označeno
+	Locked	Zamčeno
+	Search comments	Hledat v komentářích
+	Add a comment	Přidat komentář
+	No comments yet.	Zatím žádné komentáře.
+	Pick a tool in the quick bar, or type above.	Vyberte nástroj v rychlé liště nebo pište výše.
+	No comments match.	Žádné komentáře neodpovídají.
+	Unknown author	Neznámý autor
+	No colour	Bez barvy
+	Remove checkmark	Odebrat zaškrtnutí
+	Mark with checkmark	Označit zaškrtnutím
+	Reply	Odpovědět
+	Add a reply	Přidat odpověď
+	Post	Odeslat
+	Page {label}	Stránka {label}
+	{kind} — click to show it on the page	{kind} — kliknutím zobrazíte na stránce
+	Set status	Nastavit stav
+	Copy text	Kopírovat text
+	Properties…	Vlastnosti…
+	Make Current Properties Default	Nastavit aktuální vlastnosti jako výchozí
+	More options	Další možnosti
+	Sort by	Seřadit podle
+	Author	Autor
+	Type	Typ
+	Colour	Barva
+	Show all comments	Zobrazit všechny komentáře
+	Create PDF comment summary…	Vytvořit souhrn komentářů v PDF…
+	Export all to data file…	Exportovat vše do datového souboru…
+	Filter comments	Filtrovat komentáře
+	Status	Stav
+	Accepted	Přijato
+	Rejected	Odmítnuto
+	Cancelled	Zrušeno
+	Completed	Dokončeno
+	Show all	Zobrazit vše
+	Yellow	Žlutá
+	Orange	Oranžová
+	Red	Červená
+	Pink	Růžová
+	Purple	Fialová
+	Blue	Modrá
+	Light blue	Světle modrá
+	Green	Zelená
+	Gray	Šedá
+	Black	Černá
+	Bookmark options	Možnosti záložek
+	Expand all bookmarks	Rozbalit všechny záložky
+	Expand top-level bookmarks	Rozbalit záložky nejvyšší úrovně
+	Collapse all bookmarks	Sbalit všechny záložky
+	New bookmark ({key})	Nová záložka ({key})
+	This document has no bookmarks.	Tento dokument nemá žádné záložky.
+	This document has no layers.	Tento dokument nemá žádné vrstvy.
+	This document has no attachments.	Tento dokument nemá žádné přílohy.
+	Hide layer	Skrýt vrstvu
+	Show layer	Zobrazit vrstvu
+	Set layer visibility	Nastavit viditelnost vrstvy
+	on page {label}	na stránce {label}
+	Save attachment…	Uložit přílohu…
+	Open in a new tab	Otevřít na nové kartě
+	This document has no pages.	Tento dokument nemá žádné stránky.
+	Find text	Najít text
+	No matches	Žádné shody
+	Searching… {s}/{p}	Hledání… {s}/{p}
+	{c} of {n}{more}	{c} z {n}{more}
+	Previous ({key})	Předchozí ({key})
+	Next ({key})	Další ({key})
+	Find options	Možnosti hledání
+	Whole words only	Jen celá slova
+	Case-sensitive	Rozlišovat velikost písmen
+	Close (Esc)	Zavřít (Esc)
+	Align	Zarovnat
+	Top	Nahoře
+	Bottom	Dole
+	Center horizontally	Vycentrovat vodorovně
+	Center vertically	Vycentrovat svisle
+	Distribute	Rozmístit
+	Horizontally	Vodorovně
+	Vertically	Svisle
+	Set Fields to Same Size	Nastavit polím stejnou velikost
+	Height	Výška
+	Width	Šířka
+	Both	Obojí
+	Duplicate…	Duplikovat…
+	All pages	Všechny stránky
+	Odd pages	Liché stránky
+	Even pages	Sudé stránky
+	Landscape pages	Stránky na šířku
+	Portrait pages	Stránky na výšku
+	Move earlier	Přesunout dříve
+	Move later	Přesunout později
+	Back to the document	Zpět do dokumentu
+	Protect Using Password	Chránit heslem
+	Requires user to enter a password for:	Vyžadovat od uživatele heslo pro:
+	Viewing	Zobrazení
+	Editing	Úpravy
+	Type Password	Zadejte heslo
+	Re-type Password	Zadejte heslo znovu
+	Strength: {s}	Síla: {s}
+	Strong	Silné
+	Medium	Střední
+	Weak	Slabé
+	Advanced Options {chevron}	Pokročilé možnosti {chevron}
+	Compatibility	Kompatibilita
+	Acrobat X and later (256-bit AES)	Acrobat X a novější (256bitové AES)
+	Acrobat 7.0 and later (128-bit AES)	Acrobat 7.0 a novější (128bitové AES)
+	Acrobat 5.0 and later (128-bit RC4)	Acrobat 5.0 a novější (128bitové RC4)
+	Acrobat 3.0 and later (40-bit RC4)	Acrobat 3.0 a novější (40bitové RC4)
+	Encrypt	Šifrovat
+	All document contents	Veškerý obsah dokumentu
+	All document contents except metadata	Veškerý obsah dokumentu kromě metadat
+	Printing allowed	Povolený tisk
+	Low Resolution (150 dpi)	Nízké rozlišení (150 dpi)
+	Changes allowed	Povolené změny
+	Inserting, deleting, and rotating pages	Vkládání, odstraňování a otáčení stránek
+	Filling in form fields and signing existing signature fields	Vyplňování formulářových polí a podepisování existujících podpisových polí
+	Commenting, filling in form fields, and signing existing signature fields	Komentování, vyplňování formulářových polí a podepisování existujících podpisových polí
+	Any except extracting pages	Cokoli kromě extrakce stránek
+	Enable copying of text, images, and other content	Povolit kopírování textu, obrázků a dalšího obsahu
+	Enable text access for screen reader devices for the visually impaired	Povolit přístup k textu pro čtečky obrazovky pro zrakově postižené
+	Type a password.	Zadejte heslo.
+	The passwords don't match.	Hesla se neshodují.
+	This compatibility level supports only plain ASCII passwords.	Tato úroveň kompatibility podporuje jen hesla z prostých znaků ASCII.
+	Anyone opening the document will need this password. It's applied when you save.	Každý, kdo dokument otevře, bude potřebovat toto heslo. Použije se při uložení.
+	The document opens without a password; this password is needed to change the restrictions. It's applied when you save.	Dokument se otevře bez hesla; toto heslo je potřeba ke změně omezení. Použije se při uložení.
+	Recover unsaved documents?	Obnovit neuložené dokumenty?
+	PdfCraft didn't shut down normally. These documents had changes that were autosaved:	PdfCraft nebyl řádně ukončen. V těchto dokumentech byly změny, které se automaticky uložily:
+	just now	právě teď
+	{n} min ago	před {n} min
+	{n} h ago	před {n} h
+	 · password-protected	 · chráněno heslem
+	Recover	Obnovit
+	Discard	Zahodit
+	Version {v}	Verze {v}
+	A clean-room, open-source PDF application written in Rust. MIT OR Apache-2.0.	Open-source aplikace pro PDF napsaná v Rustu metodou clean-room. MIT OR Apache-2.0.
+	Part of	Součást
+	Summarize Options	Možnosti souhrnu
+	Choose a layout:	Vyberte rozvržení:
+	Comments only	Jen komentáře
+	Sort comments by:	Seřadit komentáře podle:
+	Create PDF Comment Summary	Vytvořit souhrn komentářů v PDF
+	Revert to the previously saved version of “{name}”? Changes since then can't be undone afterwards.	Vrátit se k dříve uložené verzi „{name}“? Změny provedené od té doby pak nepůjde vrátit zpět.
+	Number pages	Očíslovat stránky
+	Style	Styl
+	None (prefix only)	Žádný (jen předpona)
+	Prefix	Předpona
+	Start	Začít od
+	Labels: {preview}. Later pages keep their labels.	Označení: {preview}. Další stránky si ponechají svá označení.
+	Even and Odd Pages	Sudé a liché stránky
+	Even Pages Only	Jen sudé stránky
+	Odd Pages Only	Jen liché stránky
+	Landscape and Portrait Pages	Stránky na šířku i na výšku
+	Landscape Pages	Stránky na šířku
+	Portrait Pages	Stránky na výšku
+	Duplicate Field	Duplikovat pole
+	Duplicate "{name}" onto:	Duplikovat „{name}“ na:
+	1 page selected.	Vybrána 1 stránka.
+	{n} pages selected.	Vybráno stránek: {n}.
+	Delete pages after extracting	Po extrakci stránky odstranit
+	Extract pages as separate files	Extrahovat stránky jako samostatné soubory
+	Rotate Pages	Otočit stránky
+	Direction:	Směr:
+	Clockwise 90 degrees	Po směru hodinových ručiček o 90 stupňů
+	Counterclockwise 90 degrees	Proti směru hodinových ručiček o 90 stupňů
+	180 degrees	180 stupňů
+	Pages:	Stránky:
+	All	Vše
+	Selection	Výběr
+	From	Od
+	Rotate:	Otočit:
+	Repairs	Opravy
+	Repair log	Protokol oprav
+	Split document	Rozdělit dokument
+	Number of pages	Počet stránek
+	Pages per file	Stránek na soubor
+	File size	Velikost souboru
+	At most	Nejvýše
+	Top-level bookmarks ({n})	Záložky nejvyšší úrovně ({n})
+	Before each selected page (select pages in Organize)	Před každou vybranou stránkou (stránky vyberte v Uspořádání)
+	Creates 1 file from {n} pages.	Z {n} stránek vytvoří 1 soubor.
+	Creates {f} files from {n} pages.	Z {n} stránek vytvoří soubory (počet: {f}).
+	Each file holds as many of the {n} pages as fit.	Každý soubor pojme tolik z {n} stránek, kolik se vejde.
+	Replace Pages	Nahradit stránky
+	Original: replace pages	Původní: nahradit stránky
+	to	až
+	to {n}	až {n}
+	Replacement: pages of {name}	Náhrada: stránky souboru {name}
+	of {name}	z {name}
+	Only the page content changes: links, comments, form fields and bookmarks on the original pages stay.	Mění se jen obsah stránek: odkazy, komentáře, formulářová pole a záložky na původních stránkách zůstanou.
+	The replacement file doesn't have that many pages.	Náhradní soubor nemá tolik stránek.
+	Tagged PDF	Označkované PDF
+	Document Properties	Vlastnosti dokumentu
+	Description	Popis
+	Initial View	Úvodní zobrazení
+	Security	Zabezpečení
+	Fonts	Písma
+	Advanced	Rozšířené
+	Title	Název
+	Subject	Předmět
+	Keywords	Klíčová slova
+	Application	Aplikace
+	PDF producer	Producent PDF
+	Layout and Magnification	Rozvržení a zvětšení
+	Navigation tab	Navigační karta
+	Page Only	Jen stránka
+	Bookmarks Panel and Page	Panel záložek a stránka
+	Pages Panel and Page	Panel stránek a stránka
+	Attachments Panel and Page	Panel příloh a stránka
+	Layers Panel and Page	Panel vrstev a stránka
+	Page layout	Rozvržení stránky
+	Default	Výchozí
+	Single Page	Jedna stránka
+	Single Page Continuous	Jedna stránka souvisle
+	Two-Up (Facing)	Dvě stránky (protilehlé)
+	Two-Up Continuous (Facing)	Dvě stránky souvisle (protilehlé)
+	Two-Up (Cover Page)	Dvě stránky (titulní stránka)
+	Two-Up Continuous (Cover Page)	Dvě stránky souvisle (titulní stránka)
+	Magnification	Zvětšení
+	Actual Size	Skutečná velikost
+	Fit Page	Celá stránka
+	Fit Width	Přizpůsobit šířce
+	Fit Height	Přizpůsobit výšce
+	Fit Visible	Přizpůsobit viditelnému obsahu
+	Open to page	Otevřít na stránce
+	of {pages}	z {pages}
+	Window Options	Možnosti okna
+	Resize window to initial page	Změnit velikost okna podle úvodní stránky
+	Center window on screen	Vycentrovat okno na obrazovce
+	Open in Full Screen mode	Otevřít v režimu celé obrazovky
+	Show:	Zobrazit:
+	File Name	Název souboru
+	Document Title	Název dokumentu
+	User Interface Options	Možnosti uživatelského rozhraní
+	Hide menu bar	Skrýt řádek nabídek
+	Hide toolbars	Skrýt panely nástrojů
+	Hide window controls	Skrýt ovládací prvky okna
+	Security method	Metoda zabezpečení
+	No security	Bez zabezpečení
+	Restrictions	Omezení
+	None — everything is allowed	Žádná — vše je povoleno
+	Password security	Zabezpečení heslem
+	Encryption	Šifrování
+	Opened with	Otevřeno pomocí
+	— (protection is applied when you save)	— (ochrana se použije při uložení)
+	Owner password (no restrictions apply)	Heslo vlastníka (žádná omezení neplatí)
+	User password	Heslo uživatele
+	Change settings…	Změnit nastavení…
+	Printing	Tisk
+	Not allowed	Nepovoleno
+	Allowed	Povoleno
+	High resolution	Vysoké rozlišení
+	Low resolution	Nízké rozlišení
+	Changing the document	Změny dokumentu
+	Document assembly	Sestavení dokumentu
+	Content copying	Kopírování obsahu
+	Content copying for accessibility	Kopírování obsahu kvůli přístupnosti
+	Commenting	Komentování
+	Filling of form fields	Vyplňování formulářových polí
+	No fonts are referenced by the pages.	Stránky neodkazují na žádná písma.
+	PDF version	Verze PDF
+	Location	Umístění
+	Page size	Velikost stránky
+	Yes	Ano
+	No	Ne
+	Revisions	Revize
+	View revision {n}	Zobrazit revizi {n}
+	Open the file as it was saved then	Otevřít soubor tak, jak byl tehdy uložen
+	Binding	Vazba
+	Left Edge	Levý okraj
+	Right Edge	Pravý okraj
+	Language	Jazyk
+	Saved {place}: {before} → {after} ({pct}% smaller){detail}	Uloženo {place}: {before} → {after} (o {pct} % menší){detail}
+	Couldn't save the image: {e}	Obrázek nelze uložit: {e}
+	Adding images arrives on the web with file pickers for images	Přidávání obrázků přijde na web s výběrem obrázkových souborů
+	Replacing images on page {p} arrives on the web with image pickers ({i})	Nahrazování obrázků na stránce {p} přijde na web s výběrem obrázků ({i})
+	{name}: choosing images arrives on the web with file pickers for images	{name}: výběr obrázků přijde na web s výběrem obrázkových souborů
+	Replacing images arrives on the web with image file pickers	Nahrazování obrázků přijde na web s výběrem obrázkových souborů
+	Couldn't create a PDF: {e}	PDF nelze vytvořit: {e}
+	The clipboard has no image or text	Ve schránce není obrázek ani text
+	On the web, open or drop an image to convert it	Na webu obrázek k převodu otevřete nebo přetáhněte
+	Couldn't optimize the file: {e}	Soubor nelze optimalizovat: {e}
+	Couldn't write {path}: {e}	Nelze zapsat {path}: {e}
+	The form asks to be submitted to {u}; PdfCraft doesn't send form data. Save the document to keep your entries.	Formulář žádá o odeslání na {u}; PdfCraft data formulářů neodesílá. Své údaje zachováte uložením dokumentu.
+	{s} actions run in the JavaScript engine (M6)	Akce {s} se spouštějí v JavaScriptovém stroji (M6)
+	{name}: the {other} action isn't supported yet	{name}: akce {other} zatím není podporována
+	{name} submits the form to {url}; PdfCraft doesn't send form data. Save the document to keep your entries.	{name} odesílá formulář na {url}; PdfCraft data formulářů neodesílá. Své údaje zachováte uložením dokumentu.
+	Export stopped: {e}	Export byl zastaven: {e}
+	Exported 1 image	Exportován 1 obrázek
+	Exported {n} images	Exportováno obrázků: {n}
+	 ({s} not exported: {first})	 (neexportováno: {s}, první: {first})
+	Exported the text of 1 page	Exportován text 1 stránky
+	Exported the text of {n} pages	Exportován text stránek: {n}
+	{msg} to {dir}	{msg} (složka {dir})
+	Exporting… {d} of {t}	Export… {d} z {t}
+	Choose a folder for the exported files	Vyberte složku pro exportované soubory
+	New {tool} comments will look like this one	Nové komentáře typu {tool} budou vypadat jako tento
+	This document can't be checked: it couldn't be read for editing	Tento dokument nelze zkontrolovat: nepodařilo se ho načíst pro úpravy
+	The checker found no problems in this document.	Kontrola v tomto dokumentu nenašla žádné problémy.
+	The checker found 1 problem which may prevent the document from being fully accessible.	Kontrola našla 1 problém, který může bránit plné přístupnosti dokumentu.
+	The checker found {n} problems which may prevent the document from being fully accessible.	Kontrola našla problémy, které mohou bránit plné přístupnosti dokumentu (počet: {n}).
+	The text is the same	Text je stejný
+	1 difference found	Nalezen 1 rozdíl
+	{n} differences found	Nalezeno rozdílů: {n}
+	Added 1 comment	Přidán 1 komentář
+	Added {n} comments	Přidáno komentářů: {n}
+	Choose a folder for the results	Vyberte složku pro výsledky
+	Files for {name}	Soubory pro {name}
+	An action is already running	Akce už běží
+	Running action… file {d} of {t}	Probíhá akce… soubor {d} z {t}
+	No unlinked web addresses were found in the text	V textu nebyly nalezeny žádné webové adresy bez odkazu
+	Created 1 link	Vytvořen 1 odkaz
+	Created {n} links	Vytvořeno odkazů: {n}
+	Text recognition is already running	Rozpoznávání textu už běží
+	Recognizing text… file {d} of {t}	Rozpoznávání textu… soubor {d} z {t}
+	Recognizing text… page {d} of {t}	Rozpoznávání textu… stránka {d} z {t}
+	Recognized 1 word	Rozpoznáno 1 slovo
+	Recognized {n} words	Rozpoznáno slov: {n}
+	{words} on {pages}	{words} ({pages})
+	; 1 page already had text	; 1 stránka už text obsahovala
+	; {n} pages already had text	; stránky, které už text obsahovaly: {n}
+	Recognized {w} words in 1 file	Rozpoznáno slov v 1 souboru: {w}
+	Recognized {w} words in {n} files	Rozpoznáno slov: {w} (souborů: {n})
+	; failed: {list}	; selhalo: {list}
+	1 file done	Hotov 1 soubor
+	{n} files done	Hotovo souborů: {n}
+	The selected area has been copied ({w} × {h} pixels)	Vybraná oblast byla zkopírována ({w} × {h} pixelů)
+	Couldn't take the snapshot: {e}	Snímek nelze pořídit: {e}
+	Couldn't recover {name}: {e}	{name} nelze obnovit: {e}
+	The document now conforms to {level}; save it to keep the changes	Dokument nyní vyhovuje standardu {level}; změny zachováte uložením
+	Fixed what could be fixed; 1 problem remains	Opraveno, co šlo; zbývá 1 problém
+	Fixed what could be fixed; {n} problems remain	Opraveno, co šlo; zbývající problémy: {n}
+	Custom stamps arrive on the web with file pickers for images	Vlastní razítka přijdou na web s výběrem obrázkových souborů
+	{file} is too large for a stamp (at most {n} MB)	{file} je pro razítko příliš velký (nejvýše {n} MB)
+	Sent to {printer}	Odesláno na {printer}
+	Sent to {printer}: {msg}	Odesláno na {printer}: {msg}
+	Choose a folder for the searchable files	Vyberte složku pro prohledávatelné soubory
+	Files are combined from top to bottom. Leave Pages empty to take every page.	Soubory se slučují shora dolů. Ponecháte-li Stránky prázdné, použijí se všechny stránky.
+	Unlock…	Odemknout…
+	Select a password-protected file first	Nejdřív vyberte soubor chráněný heslem
+	Enter the permissions password to allow combining	Zadejte heslo oprávnění, které povolí slučování
+	Enter the password that opens it	Zadejte heslo, které ho otevře
+	Unlock {name}	Odemknout {name}
+	Unlock {n} files	Odemknout soubory ({n})
+	The same password is tried on each file.	Stejné heslo se zkusí u každého souboru.
+	Hide password	Skrýt heslo
+	Show password	Zobrazit heslo
+	Wrong password	Nesprávné heslo
+	The password is only used to read the file; it isn't saved.	Heslo se použije jen ke čtení souboru; neukládá se.
+	Unlock	Odemknout
+	Opened, but its security settings don't allow combining. Enter the permissions password.	Otevřeno, ale nastavení zabezpečení nedovoluje slučování. Zadejte heslo oprávnění.
+	Unlocked: the combined file won't be password-protected	Odemčeno: sloučený soubor nebude chráněný heslem
+	Unlocked {n} of {m} files	Odemčeno souborů: {n} z {m}
+	Add folder…	Přidat složku…
+	Add folder and subfolders…	Přidat složku a podsložky…
+	More ways to add files	Další způsoby přidání souborů
+	Add folder	Přidat složku
+	Add folder and subfolders	Přidat složku a podsložky
+	Click to sort, drag to move the column. Drag its edge to resize it.	Kliknutím seřadíte, tažením přesunete sloupec. Velikost změníte tažením za jeho okraj.
+	Reset columns	Obnovit sloupce
+	Remove {n} files	Odebrat soubory ({n})
+	{n} selected	Vybráno: {n}
+	sorted ascending	seřazeno vzestupně
+	sorted descending	seřazeno sestupně
+	Protected: the combined file won't keep its security settings	Chráněný: sloučený soubor si nezachová nastavení zabezpečení
+	Add open documents	Přidat otevřené dokumenty
+	All open documents	Všechny otevřené dokumenty
+	No documents are open	Nejsou otevřené žádné dokumenty
+	Select a file first	Nejdřív vyberte soubor
+	1 file	1 soubor
+	{n} files	Soubory: {n}
+	1 file needs attention	1 soubor vyžaduje pozornost
+	{n} files need attention	Soubory vyžadující pozornost: {n}
+	{name} can't be combined: {why}	{name} nelze sloučit: {why}
+	Check the pages of {name}: {why}	Zkontrolujte stránky souboru {name}: {why}
+	File name	Název souboru
+	Warnings	Upozornění
+	Drag to reorder	Přetažením změníte pořadí
+	{k} of {n}	{k} z {n}
+	? of {n}	? z {n}
+	Added more than once	Přidáno vícekrát
+	yesterday	včera
+	{n} days ago	před {n} dny
+	No pages selected	Nejsou vybrány žádné stránky
+	Password-protected	Chráněno heslem
+	Its security settings don't allow copying pages	Nastavení zabezpečení nedovoluje kopírovat stránky
+	Can't be read: {e}	Nelze přečíst: {e}
+	Includes unsaved changes	Obsahuje neuložené změny
+	Pages of {name} to combine, e.g. 1-3, 6	Stránky souboru {name} ke sloučení, např. 1-3, 6
+	Remove {name}	Odebrat {name}
+	Add files…	Přidat soubory…
+	Add at least two files	Přidejte alespoň dva soubory
+	Couldn't add {name}: {e}	{name} nelze přidat: {e}
+	Couldn't combine files: {e}	Soubory nelze sloučit: {e}
+	Export comments	Exportovat komentáře
+	Export form data	Exportovat data formuláře
+	Comment and form data	Data komentářů a formulářů
+	Export	Exportovat
+	Select data files to merge	Vyberte datové soubory ke sloučení
+	Form data and PDF forms	Data formulářů a formuláře PDF
+	Save the spreadsheet	Uložit tabulku
+	Save the accessibility report	Uložit zprávu o přístupnosti
+	Save image	Uložit obrázek
+	Export certificate	Exportovat certifikát
+	Choose a folder for the extracted pages	Vyberte složku pro extrahované stránky
+	Choose a folder for the split files	Vyberte složku pro rozdělené soubory
+	Couldn't use {name}: {e}	{name} nelze použít: {e}
+	Couldn't extract pages: {e}	Stránky nelze extrahovat: {e}
+	Couldn't write {name}: {e}	{name} nelze zapsat: {e}
+	Wrote 1 file to {dir}	Zapsán 1 soubor do {dir}
+	Wrote {n} files to {dir}	Zapsáno souborů: {n} (složka {dir})
+	No pages match those choices	Těmto volbám neodpovídají žádné stránky
+	Couldn't split: {e}	Nelze rozdělit: {e}
+	Couldn't summarize comments: {e}	Komentáře nelze shrnout: {e}
+	Couldn't open the result: {e}	Výsledek nelze otevřít: {e}
+	Importing data arrives on the web with file pickers for data files	Import dat přijde na web s výběrem datových souborů
+	Exported to {path}	Exportováno do {path}
+	Merging data files needs the desktop app	Sloučení datových souborů vyžaduje desktopovou aplikaci
+	Merged 1 file into {path}	1 soubor sloučen do {path}
+	Merged {n} files into {path}	Do {path} sloučeno souborů: {n}
+	Combined {n} files	Sloučeno souborů: {n}
+	Extracted 1 page	Extrahována 1 stránka
+	Extracted {n} pages	Extrahováno stránek: {n}
+	Created a comment summary	Souhrn komentářů vytvořen
+	Couldn't open {name}: {e}	{name} nelze otevřít: {e}
+	Couldn't read {name}: {e}	{name} nelze přečíst: {e}
+	Couldn't save: {e}	Nelze uložit: {e}
+	Downloading attachments on the web arrives with M3.10 ({n} bytes ready)	Stahování příloh na webu přijde s M3.10 (připraveno {n} bajtů)
+	`{command}` {when}	Příkaz `{command}` {when}
+	ships in milestone {m}	přijde v milníku {m}
+	needs an AI provider (off by default)	vyžaduje poskytovatele AI (ve výchozím stavu vypnuto)
+	is available	je k dispozici
+	is not available yet	zatím není k dispozici
+	{label} failed: {e}	Akce {label} selhala: {e}
+	Undid {label}	Vráceno zpět: {label}
+	Redid {label}	Znovu provedeno: {label}
+	A document needs at least one page: copy instead	Dokument musí mít alespoň jednu stránku: použijte místo toho kopírování
+	Cut {what}	Vyjmuto: {what}
+	Copied {what}	Zkopírováno: {what}
+	1 page	1 stránka
+	{n} pages	{n} str.
+	Copy or cut pages first	Nejdřív stránky zkopírujte nebo vyjměte
+	Couldn't save {name}: {e}	{name} nelze uložit: {e}
+	Saved {name}	Uloženo: {name}
+	Saved, but reopening failed: {e}	Uloženo, ale opětovné otevření selhalo: {e}
+	Downloaded {name}	Staženo: {name}
+	Couldn't download {name}: {e}	{name} nelze stáhnout: {e}
+	Reverted to the last saved version	Vráceno k poslední uložené verzi
+	That didn't work: an internal error stopped it ({m}). Your documents are unchanged.	Nepodařilo se: zastavila to vnitřní chyba ({m}). Vaše dokumenty se nezměnily.
+	Nothing to undo	Není co vrátit zpět
+	Nothing to redo	Není co provést znovu
+	This document has no form fields you can fill in	Tento dokument nemá žádná formulářová pole k vyplnění
+	This document has no comments to flatten	Tento dokument nemá žádné komentáře ke sloučení se stránkou
+	This document has no form fields to flatten	Tento dokument nemá žádná formulářová pole ke sloučení se stránkou
+	There are no redaction marks (mark text, areas or pages first)	Nejsou žádné značky začernění (nejdřív označte text, oblasti nebo stránky)
+	This document has no {kind} to change	V dokumentu není co změnit: {kind}
+	header or footer	záhlaví nebo zápatí
+	watermark	vodoznak
+	background	pozadí
+	This document isn't password-protected	Tento dokument není chráněný heslem
+	Only the document's owner can change its security (open it with the permissions password)	Zabezpečení může změnit jen vlastník dokumentu (otevřete ho heslem oprávnění)
+	The document's security settings don't allow this change	Nastavení zabezpečení dokumentu tuto změnu nedovoluje
+	The document's security settings don't allow copying text and images	Nastavení zabezpečení dokumentu nedovoluje kopírovat text a obrázky
+	Open a document first	Nejdřív otevřete dokument
+	Security will be removed when you save	Zabezpečení se odebere při uložení
+	Click text or an image to edit it	Kliknutím na text nebo obrázek ho upravíte
+	Drag a rectangle to create a link; double-click a link to edit it	Tažením obdélníku vytvoříte odkaz; dvojitým kliknutím na odkaz ho upravíte
+	There are no redaction marks to apply	Nejsou žádné značky začernění k použití
+	Drag to draw the area where the signature should appear.	Tažením nakreslete oblast, kde se má zobrazit podpis.
+	Couldn't fit the visible content: {e}	Viditelný obsah nelze přizpůsobit: {e}
+	Drag a rectangle around the area to copy	Tažením obdélníku označte oblast ke zkopírování
+	Click on the page to add a {tool}, or drag to set its size	Kliknutím na stránku přidáte: {tool}; tažením nastavíte velikost
+	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	Tažením obdélníku na stránce ji oříznete; dvojitým kliknutím na stránku otevřete Nastavit rámečky stránek
+	Keep tool selected: on	Ponechat nástroj vybraný: zapnuto
+	Keep tool selected	Ponechat nástroj vybraný
+	Opacity	Krytí
+	Line thickness	Tloušťka čáry
+	What word or phrase would you like to search for?	Jaké slovo nebo frázi chcete hledat?
+	Searching… {s} of {p} pages	Hledání… stránka {s} z {p}
+	 (searching… {s} of {p} pages)	 (hledání… stránka {s} z {p})
+	1 instance	1 výskyt
+	{n} instances	Výskyty: {n}
+	Go to this result	Přejít na tento výsledek
+	Highlight	Zvýraznění
+	Draw	Kreslení
+	Polygon	Mnohoúhelník
+	Connected lines	Lomená čára
+	Eraser	Guma
+	Sign	Podepsat
+	Certified by {by}	Certifikováno: {by}
+	At least one signature is invalid.	Alespoň jeden podpis je neplatný.
+	Signed and all signatures are valid.	Podepsáno a všechny podpisy jsou platné.
+	At least one signature has problems.	Alespoň jeden podpis má problémy.
+	This document is secured. Some changes are restricted by its security settings.	Tento dokument je zabezpečený. Některé změny omezuje jeho nastavení zabezpečení.
+	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	Toto je dynamický formulář XFA, který PdfCraft zatím neumí zobrazit. Vidíte zástupnou stránku souboru.
+	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	Tento formulář obsahuje také data XFA, která PdfCraft zatím nečte. Pole můžete vyplnit, ale Acrobat může místo nich zobrazit hodnoty XFA.
+	This document contains {n} interactive form fields.	Tento dokument obsahuje interaktivní formulářová pole (počet: {n}).
+	This file was damaged and has been repaired. Saving keeps the repaired version.	Tento soubor byl poškozený a byl opraven. Uložením se zachová opravená verze.
+	Dismiss	Zavřít
+	Hide field highlights	Skrýt zvýraznění polí
+	Highlight fields	Zvýraznit pole
+	Security settings	Nastavení zabezpečení
+	Details	Podrobnosti
+	Select (V)	Výběr (V)
+	Hand (H)	Ruka (H)
+	Delete pages (Delete)	Odstranit stránky (Delete)
+	Insert a blank page after the selection	Vložit prázdnou stránku za výběr
+	Insert pages from a file…	Vložit stránky ze souboru…
+	Extract pages to a new document	Extrahovat stránky do nového dokumentu
+	Split into files…	Rozdělit na soubory…
+	Select pages	Vybrat stránky
+	Cut	Vyjmout
+	Copy	Kopírovat
+	Paste after	Vložit za
+	Rename	Přejmenovat
+	Set to current page ({n})	Nastavit na aktuální stránku ({n})
+	Move up	Posunout nahoru
+	Move down	Posunout dolů
+	Indent	Zvětšit odsazení
+	Outdent	Zmenšit odsazení
+	This document has no form fields.	Tento dokument nemá žádná formulářová pole.
+	Tab order: move a field with its arrows.	Pořadí tabulátoru: pole přesunete jeho šipkami.
+	Unplaced	Neumístěno
+	Has JavaScript actions (run in M6)	Obsahuje akce JavaScriptu (spustí se v M6)
+	Page	Stránka
+	None	Žádné
+	Delete selected fields	Odstranit vybraná pole
+	Diagnostic details	Diagnostické podrobnosti
+	The operation failed.	Operace selhala.
+	no such document	takový dokument neexistuje
+	nothing to undo	není co vrátit zpět
+	nothing to redo	není co provést znovu
+	this document is signed: rewriting it would invalidate its signatures (save it incrementally instead)	tento dokument je podepsaný: přepsáním by jeho podpisy přestaly platit (uložte ho raději přírůstkově)
+	the document is protected by a password	dokument je chráněný heslem
+	the password is incorrect	heslo je nesprávné
+	the document has no page tree	dokument nemá strom stránek
+	a document must keep at least one page	dokument musí mít alespoň jednu stránku
+	a bookmark cannot be moved inside itself	záložku nelze přesunout do ní samé
+	the title must not be empty	název nesmí být prázdný
+	the document has no form fields	dokument nemá žádná formulářová pole
+	there are no redaction marks to apply	nejsou žádné značky začernění k použití
+	there are no pages to print	nejsou žádné stránky k tisku
+	the document has no tags	dokument nemá žádné tagy
+	{0}: {1}	{0}: {1}
+	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	modely pro rozpoznávání textu nejsou nainstalované (přeinstalujte PdfCraft nebo nastavte PDFCRAFT_MODELS na složku, ve které jsou)
+	the image is empty	obrázek je prázdný
+	this file isn't XFDF, FDF, XML or text form data	tento soubor neobsahuje data formuláře ve formátu XFDF, FDF, XML ani v textovém
+	nothing in the file matches this document	nic v souboru neodpovídá tomuto dokumentu
+	This page couldn't be displayed.\n{e}	Tuto stránku nelze zobrazit.\n{e}
+	Go to page {p}	Přejít na stránku {p}
+	{s} action	Akce {s}
+	Page {p} of {n}	Stránka {p} z {n}
+	1 page selected	Vybrána 1 stránka
+	{n} pages selected	Vybráno stránek: {n}
+	{name} — unsaved changes	{name} — neuložené změny
+	{kind} field	Pole typu {kind}
+	Select a file for the stamp	Vyberte soubor pro razítko
+	JavaScript, e.g. getField("total").value	JavaScript, např. getField("total").value
+	Font: Helvetica	Písmo: Helvetica
+	e.g. en-US	např. cs-CZ
+	Rendering: hayro (bootstrap) · UI: egui · Icons: Lucide (ISC) · Fonts: Inter, JetBrains Mono, Dancing Script (OFL)	Vykreslování: hayro (zaváděcí) · UI: egui · Ikony: Lucide (ISC) · Písma: Inter, JetBrains Mono, Dancing Script (OFL)
+	CheckBox	Zaškrtávací políčko
+	Radio	Přepínač
+	PushButton	Tlačítko
+	Combo	Kombinované pole
+	List	Seznam
+	Unknown	Neznámé
+	The document has no XMP metadata	Dokument nemá metadata XMP
+	The title in the metadata and the document information differ	Název v metadatech a v informacích o dokumentu se liší
+	The document is encrypted	Dokument je šifrovaný
+	Device colour is used, but there is no PDF/A output intent	Používá se barva závislá na zařízení, ale chybí výstupní záměr PDF/A
+	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	Používá se DeviceCMYK: vyžaduje výstupní záměr CMYK (nepřidává se automaticky)
+	The document has additional actions (/AA)	Dokument má dodatečné akce (/AA)
+	The document has document-level JavaScript	Dokument má JavaScript na úrovni dokumentu
+	The form asks viewers to make appearances (NeedAppearances)	Formulář žádá prohlížeče, aby vytvořily vzhledy polí (NeedAppearances)
+	A form field has additional actions	Formulářové pole má dodatečné akce
+	A stream uses LZW compression	Proud používá kompresi LZW
+	A stream refers to an external file	Proud odkazuje na externí soubor
+	An image asks to be interpolated	Obrázek žádá o interpolaci
+	An image has alternates or OPI information	Obrázek má alternativy nebo informace OPI
+	PostScript XObjects aren't allowed	Objekty PostScript XObject nejsou povoleny
+	Embedded files must be PDF/A files themselves (use PDF/A-3 for others)	Vložené soubory musí být samy soubory PDF/A (pro ostatní použijte PDF/A-3)
+	An embedded file has no AFRelationship	Vložený soubor nemá AFRelationship
+	Select Icon	Vybrat ikonu
+	Choose images	Vyberte obrázky
+	{dpi} pixels/inch	{dpi} pixelů/palec
+	Type your {what}.	Napište {what}.
+	Draw your {what} below.	Níže nakreslete {what}.
+	Your name	Vaše jméno
+	Images and text (converted to PDF)	Obrázky a text (převedené do PDF)
+	Images and text	Obrázky a text
+	Check Box Style:	Styl zaškrtávacího políčka:
+	Button Style:	Styl přepínače:
+	Check	Zaškrtnutí
+	Circle	Kruh
+	Diamond	Kosočtverec
+	Square	Čtverec
+	Star	Hvězda
+	{month} {y}	{month} {y}
+	Change {key}	Změnit: {key}
+	Insert pages from {name}	Vložit stránky ze souboru {name}
+	Fill in {name}	Vyplnit {name}
+	Set the image of {name}	Nastavit obrázek pole {name}
+	Edit script of {name}	Upravit skript {name}
+	Import {name}	Importovat {name}
+	Add bookmark	Přidat záložku
+	Rename bookmark	Přejmenovat záložku
+	Delete bookmark	Odstranit záložku
+	Move bookmark	Přesunout záložku
+	Set bookmark destination	Nastavit cíl záložky
+	Add stamp	Přidat razítko
+	Delete comment	Odstranit komentář
+	Edit comment	Upravit komentář
+	Erase	Vymazat
+	Lock comment	Zamknout komentář
+	Unlock comment	Odemknout komentář
+	Move comment	Přesunout komentář
+	Resize comment	Změnit velikost komentáře
+	Change comment properties	Změnit vlastnosti komentáře
+	Add field	Přidat pole
+	Change field properties	Změnit vlastnosti pole
+	Delete field	Odstranit pole
+	Duplicate field	Duplikovat pole
+	Set tab order	Nastavit pořadí tabulátoru
+	Change initial view	Změnit úvodní zobrazení
+	Set alternate text	Nastavit alternativní text
+	Mark figure as decorative	Označit obrázek jako dekorativní
+	Run JavaScript	Spustit JavaScript
+	Delete document JavaScript	Odstranit JavaScript dokumentu
+	Edit document JavaScript	Upravit JavaScript dokumentu
+	Edit text	Upravit text
+	Move image	Přesunout obrázek
+	Rotate image	Otočit obrázek
+	Flip image	Převrátit obrázek
+	Delete image	Odstranit obrázek
+	Add header & footer	Přidat záhlaví a zápatí
+	Update header & footer	Aktualizovat záhlaví a zápatí
+	Update watermark	Aktualizovat vodoznak
+	Add background	Přidat pozadí
+	Update background	Aktualizovat pozadí
+	Add image	Přidat obrázek
+	Edit content	Upravit obsah
+	Delete content	Odstranit obsah
+	Remove redaction marks	Odebrat značky začernění
+	Add link	Přidat odkaz
+	Change link properties	Změnit vlastnosti odkazu
+	Delete link	Odstranit odkaz
+	Create link	Vytvořit odkaz
+	Flatten	Sloučit se stránkou
+	Add sticky note	Přidat rychlou poznámku
+	Add highlight	Přidat zvýraznění
+	Add underline	Přidat podtržení
+	Add strikethrough	Přidat přeškrtnutí
+	Add squiggly underline	Přidat podtržení vlnovkou
+	Add rectangle	Přidat obdélník
+	Add oval	Přidat ovál
+	Add arrow	Přidat šipku
+	Add line	Přidat čáru
+	Add drawing	Přidat kresbu
+	Add text box	Přidat textový rámeček
+	Add checkmark	Přidat zaškrtnutí
+	Add cross	Přidat křížek
+	Add dot	Přidat tečku
+	Add signature	Přidat podpis
+	Add redaction mark	Přidat značku začernění
+	Add cloud	Přidat obláček
+	Add polygon	Přidat mnohoúhelník
+	Add connected lines	Přidat lomenou čáru
+	Add callout	Přidat popisek se šipkou
+	Add inserted text	Přidat vložený text
+	Add file attachment	Přidat připojený soubor
+	Set status Accepted	Nastavit stav Přijato
+	Set status Rejected	Nastavit stav Odmítnuto
+	Set status Cancelled	Nastavit stav Zrušeno
+	Set status Completed	Nastavit stav Dokončeno
+	Set status None	Nastavit stav Žádný
+	Set status Unmarked	Nastavit stav Neoznačeno
+	Save as PDF/A-1b	Uložit jako PDF/A-1b
+	Save as PDF/A-2b	Uložit jako PDF/A-2b
+	Save as PDF/A-3b	Uložit jako PDF/A-3b
+	Fill & Sign: change signature	Vyplnit a podepsat: změnit podpis
+	Fill & Sign: change initials	Vyplnit a podepsat: změnit iniciály
+	Fill & Sign: remove saved signature	Vyplnit a podepsat: odebrat uložený podpis
+	Fill & Sign: remove saved initials	Vyplnit a podepsat: odebrat uložené iniciály
+	Change signature	Změnit podpis
+	Change initials	Změnit iniciály
+	Measure distance	Měřit vzdálenost
+	Measure perimeter	Měřit obvod
+	Measure area	Měřit plochu
+	Set measurement scale	Nastavit měřítko měření
+	Measurement information	Informace o měření
+	Measurement snapping	Přichytávání při měření
+	Export measurements as CSV	Exportovat měření do CSV
+	Distance	Vzdálenost
+	Perimeter	Obvod
+	Area	Plocha
+	Drawing scale	Měřítko výkresu
+	Snapping	Přichytávání
+	Export measurements	Exportovat měření
+	Open a PDF to measure it.	Otevřete PDF, které chcete měřit.
+	Click vertices. Enter or double-click finishes a perimeter or area. Click the first point to close an area.	Klikejte na vrcholy. Enter nebo dvojité kliknutí dokončí obvod či plochu. Kliknutím na první bod plochu uzavřete.
+	Shift constrains to 45 degrees. Backspace removes a vertex. Escape cancels.	Shift omezí směr na násobky 45 stupňů. Backspace odebere vrchol. Escape měření zruší.
+	Angle	Úhel
+	Click the first point to begin.	Začněte kliknutím na první bod.
+	Snap to drawing	Přichytávat ke kresbě
+	Endpoints	Koncové body
+	Midpoints	Středy
+	Intersections	Průsečíky
+	Paths	Cesty
+	Sensitivity	Citlivost
+	Unit	Jednotka
+	Decimals	Desetinná místa
+	Calibrate from two points	Kalibrovat ze dvou bodů
+	Entire page	Celá stránka
+	Viewport rectangle in page points (x, y, width, height)	Obdélník výřezu v bodech stránky (x, y, šířka, výška)
+	Viewport	Výřez
+	Apply scale	Použít měřítko
+	Saved measurements	Uložená měření
+	Saved measurements.	Měření uložena.
+	Endpoint	Koncový bod
+	Midpoint	Střed
+	Intersection	Průsečík
+	Path	Cesta
+	This drawing exceeds the snapping limit; only the first paths are used.	Tato kresba překračuje limit přichytávání; použijí se jen první cesty.
+	Some page content couldn't be read; snapping uses the rest.	Část obsahu stránky nešlo přečíst; přichytávání použije zbytek.
+	Unsupported measurements	Nepodporovaná měření
+	Label	Popisek
+	{n} measurements use an unsupported format and are left out.	Měření v nepodporovaném formátu byla vynechána (počet: {n}).
+	This area has too many overlapping paths; intersection snapping is limited.	Tato oblast má příliš mnoho překrývajících se cest; přichytávání k průsečíkům je omezené.
+	This measurement needs at least {n} points.	Toto měření potřebuje alespoň {n} bodů.
+	Change {what}	Změnit: {what}
+	Cut and stack	Rozřezat a stohovat
+	Default workspace mode	Výchozí režim pracovní plochy
+	Documents and view	Dokumenty a zobrazení
+	Open email app	Otevřít e-mailovou aplikaci
+	Open link	Otevřít odkaz
+	Open this web page?	Otevřít tuto webovou stránku?
+	Scripts run in a sandbox without file or network access. A script that asks to open a web page needs your permission first. With JavaScript off, Acrobat's standard format, validate and calculate functions still work.	Skripty běží v izolovaném prostředí bez přístupu k souborům a síti. Skript, který chce otevřít webovou stránku, nejdřív potřebuje vaše svolení. S vypnutým JavaScriptem dál fungují standardní funkce Acrobatu pro formátování, ověření a výpočty.
+	Sign yourself	Vlastní podpis
+	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	Použije se při otevírání souborů PDF. Explicitní spuštění nebo režim ovládání má v dané relaci přednost.
+	Write this email?	Napsat tento e-mail?
+	{who} in this document wants to open this address in your browser:	{who} v tomto dokumentu chce ve vašem prohlížeči otevřít tuto adresu:
+	{who} in this document wants to open your email app with this address:	{who} v tomto dokumentu chce otevřít vaši e-mailovou aplikaci s touto adresou:
+	This web address mixes letters from different alphabets, a common way to imitate another site's name.	Tato webová adresa míchá písmena z různých abeced, což je běžný způsob napodobení názvu jiného webu.
+	This web address uses letters from another alphabet, which can look like familiar ones.	Tato webová adresa používá písmena z jiné abecedy, která mohou vypadat jako známá písmena.
+	Create PDF from images	Vytvořit PDF z obrázků
+	Selected image files: {count}	Vybrané obrázkové soubory: {count}
+	Use image resolution	Použít rozlišení obrázku
+	Use each image's embedded DPI; use 72 DPI when it is absent.	Použít DPI vložené v obrázku; pokud chybí, použít 72 DPI.
+	Use 72 DPI (one point per pixel)	Použít 72 DPI (jeden bod na pixel)
+	Use custom DPI	Použít vlastní DPI
+	DPI sets the printed page size without resampling the image.	DPI určuje velikost tištěné stránky bez převzorkování obrázku.
+	Create	Vytvořit
+	Dynamic XFA form laid out from its template: {pages}, {fields}.	Dynamický formulář XFA rozvržený podle šablony: {pages}, {fields}.
+	XFA form: its fields and its XFA data are kept in step, so other viewers show what you fill in.	Formulář XFA: jeho pole a data XFA se udržují ve shodě, takže ostatní prohlížeče zobrazí, co vyplníte.
+	Switch to two-page view first to show the cover page	Titulní stránku zobrazíte, až přepnete na dvoustránkové zobrazení
+@plural	{n} page|{n} pages	{n} stránka|{n} stránky|{n} stránek
+@plural	{n} field|{n} fields	{n} pole|{n} pole|{n} polí
+	Optimizing… removing user data	Optimalizace… odebírání uživatelských dat
+	Optimizing… image {d} of {t}	Optimalizace… obrázek {d} z {t}
+	Optimizing… cleaning up	Optimalizace… čištění
+	Optimizing… merging identical objects	Optimalizace… slučování shodných objektů
+	Optimizing… writing the copy	Optimalizace… zápis kopie
+	Cancelling…	Ruší se…
+	Created a PDF from {n} files	PDF vytvořeno ze souborů (počet: {n})
+	PDF, images and text	PDF, obrázky a text
+	Insert a file before page {label}	Vložit soubor před stránku {label}
+	Insert a file at the end	Vložit soubor na konec
+	Save pages	Uložit stránky
+	Save these pages as one PDF	Uložit tyto stránky jako jedno PDF
+	No changes to save	Žádné změny k uložení
+	Created a PDF from {n} files; left out: {names}	PDF vytvořeno ze souborů (počet: {n}); vynecháno: {names}
+	Created a PDF from the first {n} files	PDF vytvořeno z prvních souborů (počet: {n})
+	Optimization is already running	Optimalizace už běží
+	Optimization cancelled	Optimalizace zrušena
+	Couldn't optimize the file	Soubor nelze optimalizovat
+	Files are combined in this order. Leave Pages empty to take every page.	Soubory se slučují v tomto pořadí. Ponecháte-li Stránky prázdné, použijí se všechny stránky.
+	Show	Zobrazit
+	Sort	Seřadit
+	Reverse the order	Obrátit pořadí
+	Grab bag	Volný seznam
+	Table	Tabulka
+	Username	Uživatelské jméno
+	Display name	Zobrazované jméno
+	Real name	Skutečné jméno
+	Name (A–Z)	Jméno (A–Z)
+	Merged PRs	Sloučené PR
+	PRs	PR
+	Commits	Commity
+	Lines added	Přidané řádky
+	+LOC	+LOC
+	Lines deleted	Odstraněné řádky
+	−LOC	−LOC
+	Line delta	Rozdíl řádků
+	ΔLOC	ΔLOC
+	Binary assets added	Přidané binární soubory
+	+Bin	+Bin
+	Binary assets removed	Odstraněné binární soubory
+	−Bin	−Bin
+	First commit	První commit
+	First	První
+	Last commit	Poslední commit
+	Last	Poslední
+	No contributor data was built into this copy.	Tato kopie neobsahuje údaje o přispěvatelích.
+	No model credits were built into this copy.	Tato kopie neobsahuje uvedení modelů.
+	{n} contributors · {c} commits	Přispěvatelé: {n} · commity: {c}
+	Company	Společnost
+	Model	Model
+	% of all commits	% všech commitů
+	Lines +/−	Řádky +/−
+	@{login}: {prs} PRs, {commits} commits, +{added} / −{deleted} lines (Δ {delta}), +{bin_added} / −{bin_deleted} binary assets, {first} – {last}	@{login}: PR: {prs}, commity: {commits}, +{added} / −{deleted} řádků (Δ {delta}), +{bin_added} / −{bin_deleted} binárních souborů, {first} – {last}
+	None of those files can be made into a PDF; use PDFs, images or .txt files	Ze žádného z těchto souborů nelze vytvořit PDF; použijte soubory PDF, obrázky nebo soubory .txt
+	About	O aplikaci
+	Contributors	Přispěvatelé
+	Models	Modely
+	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Pokračujte, jen pokud tomuto dokumentu důvěřujete. Adresa může nést informace z dokumentu, například to, co jste zadali do jeho formuláře.
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Tiskněte jednostranně. Listy udržujte v pořadí, rozřežte je podle značek a pak stohy skládejte zleva doprava a shora dolů.
+comment menu	Edit	Upravit
+	Undo {action}	Zpět: {action}
+	Redo {action}	Znovu: {action}
+signature pad	Type	Napsat
+action wizard	Start	Spustit
+calendar date	January	ledna
+calendar date	February	února
+calendar date	March	března
+calendar date	April	dubna
+calendar date	May	května
+calendar date	June	června
+calendar date	July	července
+calendar date	August	srpna
+calendar date	September	září
+calendar date	October	října
+calendar date	November	listopadu
+calendar date	December	prosince
+	Inserted text	Vložený text
+	Add {what}	Přidat {what}
+	Use {what}	Použít {what}
+	Place saved {what}	Umístit uložené: {what}
+	Remove saved {what}	Odebrat uložené: {what}
+	A link	Odkaz
+	A button	Tlačítko
+	A script	Skript
+	{who} in this document tried to open an address PdfCraft won't open: {e}.	Pokus o otevření adresy, kterou PdfCraft neotevře ({who} v tomto dokumentu): {e}.
+	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	Pokus o otevření adresy, kterou PdfCraft neotevře ({who} v tomto dokumentu): {e}. Z dokumentů se otevírají jen webové (http, https) a e-mailové (mailto) odkazy.
+	Another file dialog is still open. Finish with it first.	Je stále otevřené jiné dialogové okno se soubory. Nejdřív ho dokončete.
+	Couldn't show the file picker. Please try again.	Výběr souborů nelze zobrazit. Zkuste to prosím znovu.
+	The document changed while you were choosing a file, so nothing was changed.	Dokument se změnil, zatímco jste vybírali soubor, proto se nic nezměnilo.
+	The document was closed before it could be saved.	Dokument byl zavřen dříve, než mohl být uložen.
+	The pages were extracted but not deleted, because the document changed while you were choosing a folder.	Stránky byly extrahovány, ale neodstraněny, protože se dokument změnil, zatímco jste vybírali složku.
+	That didn't work: an internal error stopped it ({m}).	Nepodařilo se: zastavila to vnitřní chyba ({m}).
+	The Windows store's digital IDs couldn't be listed: {e}	Digitální ID z úložiště Windows nelze vypsat: {e}
+	Align fields	Zarovnat pole
+	Distribute fields	Rozmístit pole
+	Match field sizes	Sjednotit velikost polí
+	Mark for redaction	Označit k začernění
+	Mark pages for redaction	Označit stránky k začernění
+	Change document properties	Změnit vlastnosti dokumentu
+	Mark differences	Označit rozdíly
+	Run form script	Spustit skript formuláře
+	Scripted content must be usable with a keyboard and assistive technology. Check the document's scripts.	Skriptovaný obsah musí jít ovládat klávesnicí a asistivními technologiemi. Zkontrolujte skripty dokumentu.
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	Řádky tabulky patří přímo do tabulky nebo do jejího záhlaví, těla či zápatí. Opravte tagy tabulky.
+	Basic constraints	Základní omezení
+	Certificate authority	Certifikační autorita
+	End entity	Koncová entita
+	SHA-1 digest	Otisk SHA-1
+	SHA-256 digest	Otisk SHA-256
+	Squiggly	Vlnovka
+	Home / End	Home / End
+	H / Space (hold)	H / mezerník (podržet)
+	Line ending	Zakončení čáry
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Standardní písma neumí vykreslit „{c}“ ({code}). Jako text lze zatím přidávat jen západoevropské znaky.
+	Larger pages	Větší stránky
+	Smaller pages	Menší stránky
+	Reset page size	Obnovit velikost stránek
+	Flatten Fill & Sign when saving	Při ukládání sloučit obsah Vyplnit a podepsat se stránkou
+	Text, marks and signatures become part of the page. Other comments stay editable.	Text, značky a podpisy se stanou součástí stránky. Ostatní komentáře zůstanou upravitelné.
+	Date format	Formát data
+	Fill & Sign dates	Datum pro Vyplnit a podepsat
+	Pattern	Vzor
+	Today: {date}	Dnes: {date}
+	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy nebo yy rok · m nebo mm měsíc · mmm nebo mmmm název měsíce · d nebo dd den · ddd nebo dddd den v týdnu. H, h, M, s a t jsou písmena času a samostatně je použít nelze: chcete-li písmeno zobrazit tak, jak je, napište před něj {escape}.
+	Same as interface ({language})	Stejný jako rozhraní ({language})
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} zatím nelze zapsat do PDF: text Vyplnit a podepsat podporuje jen západoevropské znaky. Zvolte číselný formát, například dd.mm.yyyy.
+	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Otevře předvolby ovladače tiskárny. Ukládají se pro každý tisk z tohoto počítače; počet kopií, oboustranný tisk, stupně šedi a papír zvolené zde platí dál.
+	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	Vlastní nastavení ovladače tiskárny pro tento tisk: zásobník papíru, typ papíru, dokončovací úpravy a další.
+	Couldn't open the printer's preferences: {e}	Předvolby tiskárny nelze otevřít: {e}
+	Printer properties	Vlastnosti tiskárny
+	Reset to printer defaults	Obnovit výchozí nastavení tiskárny
+	This printer offers no settings of its own.	Tato tiskárna nenabízí žádné vlastní nastavení.
+certificate	Subject	Subjekt
+	Comb of characters	Rozdělení na znaky
+	The document changed while you were editing field properties.	Dokument se změnil, zatímco jste upravovali vlastnosti polí.
+	The document is no longer open.	Dokument už není otevřený.
+	The field properties dialog is no longer open.	Dialogové okno vlastností polí už není otevřené.
+	The field properties could not be changed.	Vlastnosti polí nelze změnit.
+	The selected fields could not be found. Select them again.	Vybraná pole nebyla nalezena. Vyberte je znovu.
+	The field {name} no longer exists.	Pole {name} už neexistuje.
+	A selected field has no widget on any page, so the fields can't be edited together.	Vybrané pole nemá na žádné stránce widget, takže pole nelze upravit společně.
+	Text recognition isn't installed: its models are missing (run `cargo xtask models`, or set PDFCRAFT_MODELS).	Rozpoznávání textu není nainstalováno: chybí jeho modely (spusťte `cargo xtask models` nebo nastavte PDFCRAFT_MODELS).
+	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 (stránky: {n}, s rozlišením {dpi} dpi, největším, v jakém je lze vykreslit)
+
+# Labels added upstream since the catalog was completed: the Combine grid, printing, the comment
+# fill colour, the bookmarks panel and document information keys in history labels.
+	Grid view	Zobrazení mřížky
+	List view	Zobrazení seznamu
+	Expand all	Rozbalit vše
+	Collapse all	Sbalit vše
+	Files are combined in the order shown. Drag them to change it.	Soubory se slučují v zobrazeném pořadí. Pořadí změníte přetažením.
+	Pages: {k} of {n}	Stránky: {k} z {n}
+	Check the pages	Zkontrolujte stránky
+	Switch to List view to change the pages it takes.	Stránky, které se ze souboru použijí, změníte v zobrazení seznamu.
+	Preview unavailable: {e}	Náhled není k dispozici: {e}
+	Remove page	Odebrat stránku
+	Remove {n} pages	Odebrat stránky ({n})
+	Looking for printers…	Hledání tiskáren…
+	Sending to {printer}…	Odesílání na {printer}…
+	Fill colour	Barva výplně
+	Fill colour: none	Barva výplně: žádná
+	No fill	Bez výplně
+	Some bookmarks are not shown here: the panel lists a limited number, nested a limited depth.	Některé záložky se zde nezobrazují: panel ukazuje jen omezený počet záložek do omezené hloubky vnoření.
+	Creator	Aplikace
+	Producer	Producent PDF
+	Offset from centre	Posun od středu
+	Add the files to combine	Přidejte soubory ke sloučení
+	Added the first {n} files in {folder}	Přidáno prvních {n} souborů ze složky {folder}
+	Combine the rest	Sloučit zbývající
+	Drop PDFs, images, text files or folders here, or choose them.	Přetáhněte sem soubory PDF, obrázky, textové soubory nebo složky, případně je vyberte.
+	Every PDF, image and text file in the folder	Všechny soubory PDF, obrázky a textové soubory ve složce
+	Every PDF, image and text file in the folder and the folders inside it	Všechny soubory PDF, obrázky a textové soubory ve složce a ve složkách v ní
+	Leave out files that can't be read?	Vynechat soubory, které nelze přečíst?
+	No PDFs, images or text files found in {folder}	Ve složce {folder} nebyly nalezeny žádné soubory PDF, obrázky ani textové soubory
+	These files can't be read, so they won't be in the combined PDF:	Tyto soubory nelze přečíst, a proto nebudou ve sloučeném PDF:
+	and {n} more	a dalších {n}
+	Drag the corners onto the document's edges, then choose Enhance page.	Přetáhněte rohy na okraje dokumentu a pak zvolte Vylepšit stránku.
+	Enhance camera image	Vylepšit snímek z kamery
+	Enhance page	Vylepšit stránku
+	Save ({key})	Uložit ({key})
+
+# Digital ID errors, the Signatures panel and the certificate viewer.
+	Enter a name.	Zadejte jméno.
+	The password must have at least 6 characters.	Heslo musí mít alespoň 6 znaků.
+	The passwords do not match.	Hesla se neshodují.
+	There is no folder to save the digital ID in.	Není k dispozici složka, do které by se digitální ID uložilo.
+	The password is incorrect.	Heslo není správné.
+	Choose a digital ID.	Vyberte digitální ID.
+	Unsigned signature field: {name}	Nepodepsané podpisové pole: {name}
+	Rev. {rev}: Signed by {name}	Rev. {rev}: Podepsáno – {name}
+	Rev. {rev}: Signed by an unknown signer	Rev. {rev}: Podepsáno – neznámý podepisující
+	Rev. {rev}: Certified by {name}	Rev. {rev}: Certifikováno – {name}
+	Rev. {rev}: Certified by an unknown signer	Rev. {rev}: Certifikováno – neznámý podepisující
+	{who}, certificate issued by {issuer}.	{who}, certifikát vydal {issuer}.
+	{who}, certificate issued by an unknown issuer.	{who}, certifikát vydal neznámý vydavatel.
+	Digital Signature	Digitální podpis
+	Non-Repudiation	Nepopiratelnost
+	Key Encipherment	Šifrování klíčů
+	Data Encipherment	Šifrování dat
+	Key Agreement	Dohoda o klíči
+	Certificate Signing	Podepisování certifikátů
+	CRL Signing	Podepisování CRL
+	Encipher Only	Pouze šifrování
+	Decipher Only	Pouze dešifrování
+
+# Form action, print, panel layout, rendering, text tooltips and OCR language messages.
+	Done adding text	Dokončit přidávání textu
+	Discard this text (Esc)	Zahodit tento text (Esc)
+	Enter a page number	Zadejte číslo stránky
+	Enter a URL	Zadejte adresu URL
+	Enter the field names	Zadejte názvy polí
+	Cut and stack needs Two-sided: Off. Print single-sided sheets.	Rozřezat a stohovat vyžaduje nastavení Oboustranně: Vypnuto. Tiskněte jednostranné listy.
+	Panel layout could not be restored: {error}	Rozložení panelů nelze obnovit: {error}
+	Panel move was not applied: {error}	Přesun panelu se neprovedl: {error}
+	Rendering…	Vykreslování…
+	Still rendering — this page is unusually complex…	Stále se vykresluje – tato stránka je neobvykle složitá…
+	English	Angličtina
+
+# Appearance preferences and the mouse wheel scroll speed (added upstream).
+	Appearance mode	Režim vzhledu
+	Light	Světlý
+	Dark	Tmavý
+	Active	Aktivní
+	Dark theme	Tmavý motiv
+	Appearance settings…	Nastavení vzhledu…
+	Mouse wheel scroll speed	Rychlost posouvání kolečkem myši
+scroll speed	Slow	Pomalá
+scroll speed	Normal	Normální
+scroll speed	Fast	Rychlá
+
+# Counts that take plural forms: optimized images, discarded items, bytes, pixels and deleted fields.
+@plural	{n} image optimized|{n} images optimized	{n} obrázek optimalizován|{n} obrázky optimalizovány|{n} obrázků optimalizováno
+@plural	{n} item discarded|{n} items discarded	{n} položka zahozena|{n} položky zahozeny|{n} položek zahozeno
+@plural	{n} byte|{n} bytes	{n} bajt|{n} bajty|{n} bajtů
+@plural	{n} pixel|{n} pixels	{n} pixel|{n} pixely|{n} pixelů
+@plural	Delete {n} field|Delete {n} fields	Odstranit {n} pole|Odstranit {n} pole|Odstranit {n} polí
+	Select page {label}	Vybrat stránku {label}
+	Rotate page {label} counterclockwise	Otočit stránku {label} proti směru hodinových ručiček
+	Rotate page {label} clockwise	Otočit stránku {label} po směru hodinových ručiček
+	Delete page {label}	Odstranit stránku {label}
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	Stránka PDF: {size}
+	Match page at 100%	Papír podle stránky, 100 %
+	PDF scale: {scale}%	Měřítko PDF: {scale} %
+	Printer paper and scaling may differ. Check driver settings.	Papír a měřítko tiskárny se mohou lišit. Zkontrolujte nastavení ovladače.
+	Drawing scale changes. Use Actual size for full-scale plans.	Měřítko výkresu se změní. Pro plány ve skutečném měřítku použijte volbu Skutečná velikost.
+
+# Permissions password and camera clean-up modes.
+	Enter permissions password…	Zadat heslo oprávnění…
+	Permissions password	Heslo oprávnění
+	“{name}” has security restrictions. Enter its permissions password to lift them.	Dokument „{name}“ má bezpečnostní omezení. Pro jejich zrušení zadejte heslo oprávnění.
+	This document has no restrictions to lift	Tento dokument nemá žádná omezení ke zrušení
+	Restrictions lifted	Omezení zrušena
+	Couldn't unlock {name}: {e}	Soubor {name} nelze odemknout: {e}
+	Clean-up	Vyčištění
+	Original	Originál
+	Greyscale	Stupně šedi
+	Black and white	Černobílé
diff --git a/crates/ui-egui/src/i18n/de.tsv b/crates/ui-egui/src/i18n/de.tsv
index db14c509..ccf07c12 100644
--- a/crates/ui-egui/src/i18n/de.tsv
+++ b/crates/ui-egui/src/i18n/de.tsv
@@ -29,7 +29,7 @@
 	Create PDF from images…	PDF aus Bildern erstellen…
 	Create PDF from multiple files…	PDF aus mehreren Dateien erstellen…
 	Create PDF from clipboard	PDF aus Zwischenablage erstellen
-	Combine files…	Dateien kombinieren…
+	Combine files…	Dateien zusammenführen…
 	Save	Speichern
 	Save as…	Speichern unter…
 	Close file	Datei schließen
@@ -54,7 +54,7 @@
 	Comments panel	Kommentarbereich
 	Form fields panel	Formularfeldbereich
 	Clear form	Formular zurücksetzen
-	Find tools and commands…	Tools und Befehle suchen…
+	Find tools and commands…	Werkzeuge und Befehle suchen…
 	Zoom	Zoom
 	Actual size	Originalgröße
 	Zoom to page level	Ganze Seite
@@ -83,14 +83,20 @@
 	Open a PDF ({key})	PDF öffnen ({key})
 	Dark gray theme	Dunkelgraues Design
 	Light theme	Helles Design
+	Appearance mode	Darstellungsmodus
+	Light	Hell
+	Dark	Dunkel
+	Active	Aktiv
+	Dark theme	Dunkles Design
+	Appearance settings…	Darstellungseinstellungen…
 	All tools	Alle Werkzeuge
 	Read	Lesen
 	Convert	Konvertieren
 	E-Sign	E-Signatur
 	Print ({key})	Drucken ({key})
-	Save (M4)	Speichern (M4)
+	Save ({key})	Speichern ({key})
 	Document properties ({key})	Dokumenteigenschaften ({key})
-	Find tools and commands	Tools und Befehle suchen
+	Find tools and commands	Werkzeuge und Befehle suchen
 	Fit to height	Seitenhöhe
 	Zoom in	Vergrößern
 	Zoom out	Verkleinern
@@ -316,9 +322,9 @@
 	Images	Bilder
 	Clipboard	Zwischenablage
 	Blank page	Leere Seite
-	Combine files	Dateien kombinieren
-	Combine	Kombinieren
-	Add files to combine	Dateien zum Kombinieren hinzufügen
+	Combine files	Dateien zusammenführen
+	Combine	Zusammenführen
+	Add files to combine	Dateien zum Zusammenführen hinzufügen
 	Page options	Seitenoptionen
 	Page grid	Seitenraster
 	Rotate	Drehen
@@ -331,7 +337,7 @@
 	Set page boxes	Seitenrahmen festlegen
 	Page labels	Seitenbeschriftungen
 	Page transitions	Seitenübergänge
-	Add comments	Kommentieren
+	Add comments	Kommentare hinzufügen
 	Markup	Markierungen
 	Sticky note	Notiz
 	Underline	Unterstreichen
@@ -676,6 +682,10 @@
 	Edit image	Bild bearbeiten
 	Rotate counterclockwise	Gegen den Uhrzeigersinn drehen
 	Rotate clockwise	Im Uhrzeigersinn drehen
+	Select page {label}	Seite {label} auswählen
+	Rotate page {label} counterclockwise	Seite {label} gegen den Uhrzeigersinn drehen
+	Rotate page {label} clockwise	Seite {label} im Uhrzeigersinn drehen
+	Delete page {label}	Seite {label} löschen
 	Flip horizontal	Horizontal spiegeln
 	Flip vertical	Vertikal spiegeln
 	Replace image	Bild ersetzen
@@ -758,6 +768,7 @@
 	Rotation	Drehung
 	Appear behind page	Hinter der Seite anzeigen
 	Appear on top of page	Vor der Seite anzeigen
+	Offset from centre	Abstand von der Mitte
 	From colour	Aus Farbe
 	Page Range Options	Optionen für Seitenbereich
 	Preview: page {p} of {n}	Vorschau: Seite {p} von {n}
@@ -822,6 +833,10 @@
 	The signature will be invisible.	Die Signatur wird unsichtbar sein.
 	Distinguished name	Distinguished Name
 	Labels	Beschriftungen
+	Graphic	Grafik
+	Signer's name	Name des Unterzeichners
+	Fill & Sign signature	Unterschrift aus „Ausfüllen und unterschreiben“
+	Choose image…	Bild auswählen…
 	Permitted actions after certifying	Erlaubte Aktionen nach dem Zertifizieren
 	No changes allowed	Keine Änderungen erlaubt
 	Annotations, form fill-in, and digital signatures	Anmerkungen, Ausfüllen von Formularen und digitale Signaturen
@@ -1633,8 +1648,14 @@
 	watermark	Wasserzeichen
 	background	Hintergrund
 	This document isn't password-protected	Dieses Dokument ist nicht passwortgeschützt
-	Only the document's owner can change its security (open it with the permissions password)	Nur der Eigentümer des Dokuments kann die Sicherheit ändern (öffne es mit dem Berechtigungspasswort)
+	Enter permissions password…	Berechtigungspasswort eingeben…
+	Permissions password	Berechtigungspasswort
+	“{name}” has security restrictions. Enter its permissions password to lift them.	„{name}“ hat Sicherheitseinschränkungen. Gib das Berechtigungspasswort ein, um sie aufzuheben.
+	Restrictions lifted	Einschränkungen aufgehoben
+	Couldn't unlock {name}: {e}	{name} konnte nicht entsperrt werden: {e}
+	This document has no restrictions to lift	Dieses Dokument hat keine Einschränkungen, die aufgehoben werden können
 	The document's security settings don't allow this change	Die Sicherheitseinstellungen des Dokuments erlauben diese Änderung nicht
+	The document's security settings don't allow copying text and images	Die Sicherheitseinstellungen des Dokuments erlauben kein Kopieren von Text und Bildern
 	Open a document first	Öffne zuerst ein Dokument
 	Security will be removed when you save	Die Sicherheit wird beim Speichern entfernt
 	Click text or an image to edit it	Klicke auf Text oder ein Bild, um es zu bearbeiten
@@ -1989,18 +2010,22 @@
 	Add folder and subfolders…	Ordner mit Unterordnern hinzufügen…
 	Add folder…	Ordner hinzufügen…
 	Add open documents	Geöffnete Dokumente hinzufügen
-	Add the PDFs to combine	Füge die zu kombinierenden PDFs hinzu
+	Add the files to combine	Füge die zu kombinierenden Dateien hinzu
 	Added more than once	Mehrfach hinzugefügt
 	All open documents	Alle geöffneten Dokumente
 	Can't be read: {e}	Kann nicht gelesen werden: {e}
+	Leave out files that can't be read?	Dateien auslassen, die nicht gelesen werden können?
+	These files can't be read, so they won't be in the combined PDF:	Diese Dateien können nicht gelesen werden und sind deshalb nicht im kombinierten PDF:
+	Combine the rest	Die übrigen kombinieren
+	and {n} more	und {n} weitere
 	Check the pages of {name}: {why}	Prüfe die Seiten von {name}: {why}
 	Click to sort, drag to move the column. Drag its edge to resize it.	Klicke zum Sortieren, ziehe zum Verschieben der Spalte. Ziehe ihren Rand, um die Breite zu ändern.
 	Drag to reorder	Ziehen zum Umsortieren
-	Drop PDFs or folders here, or choose them.	Lege PDFs oder Ordner hier ab oder wähle sie aus.
+	Drop PDFs, images, text files or folders here, or choose them.	Lege PDFs, Bilder, Textdateien oder Ordner hier ab oder wähle sie aus.
 	Enter the password that opens it	Gib das Passwort zum Öffnen ein
 	Enter the permissions password to allow combining	Gib das Berechtigungspasswort ein, um das Kombinieren zu erlauben
-	Every PDF in the folder	Jedes PDF im Ordner
-	Every PDF in the folder and the folders inside it	Jedes PDF im Ordner und in seinen Unterordnern
+	Every PDF, image and text file in the folder	Jedes PDF, jedes Bild und jede Textdatei im Ordner
+	Every PDF, image and text file in the folder and the folders inside it	Jedes PDF, jedes Bild und jede Textdatei im Ordner und in seinen Unterordnern
 	File name	Dateiname
 	Files are combined from top to bottom. Leave Pages empty to take every page.	Dateien werden von oben nach unten kombiniert. Lass „Seiten“ leer, um alle Seiten zu übernehmen.
 	Hide password	Passwort ausblenden
@@ -2064,8 +2089,8 @@
 	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Fahre nur fort, wenn du diesem Dokument vertraust. Eine Adresse kann Informationen aus dem Dokument übermitteln, etwa was du in sein Formular eingegeben hast.
 	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Einseitig drucken. Halte die Blätter in Reihenfolge, schneide an den Marken und lege die Stapel dann von links nach rechts, von oben nach unten aufeinander.
 	Unlocked {n} of {m} files	{n} von {m} Dateien entsperrt
-	No PDFs found in {folder}	Keine PDFs in {folder} gefunden
-	Added the first {n} PDFs in {folder}	Die ersten {n} PDFs aus {folder} hinzugefügt
+	No PDFs, images or text files found in {folder}	Keine PDFs, Bilder oder Textdateien in {folder} gefunden
+	Added the first {n} files in {folder}	Die ersten {n} Dateien aus {folder} hinzugefügt
 comment menu	Edit	Bearbeiten
 	Undo {action}	{action} rückgängig machen
 	Redo {action}	{action} wiederholen
@@ -2127,6 +2152,8 @@ action wizard	Start	Starten
 	Printer properties	Druckereigenschaften
 	Reset to printer defaults	Auf Druckerstandard zurücksetzen
 	This printer offers no settings of its own.	Dieser Drucker bietet keine eigenen Einstellungen.
+	Margins	Ränder
+	For page sizes and margins.	Für Seitengrößen und Ränder.
 	Scroll tabs left	Tabs nach links scrollen
 	Scroll tabs right	Tabs nach rechts scrollen
 
@@ -2196,3 +2223,27 @@ key	Space	Leertaste
 	Resize panel window	Größe des Bereichsfensters ändern
 	Tools	Werkzeuge
 	Inspector	Inspektor
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	PDF-Seite: {size}
+	Match page at 100%	Papier an Seite anpassen, 100%
+	PDF scale: {scale}%	PDF-Maßstab: {scale}%
+	Printer paper and scaling may differ. Check driver settings.	Druckerpapier und Skalierung können abweichen. Treibereinstellungen prüfen.
+	Drawing scale changes. Use Actual size for full-scale plans.	Der Zeichnungsmaßstab ändert sich. Für maßstabsgetreue Pläne Tatsächliche Größe verwenden.
+	Reload documents when their files change on disk	Dokumente neu laden, wenn sich ihre Dateien auf dem Datenträger ändern
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Diese Datei wurde auf dem Datenträger geändert. Lade sie neu, um die neue Version zu sehen; deine nicht gespeicherten Änderungen gehen dabei verloren.
+	Reload	Neu laden
+	Couldn't reload {name}: {e}	{name} konnte nicht neu geladen werden: {e}
+	Mouse wheel scroll speed	Scrollgeschwindigkeit des Mausrads
+scroll speed	Slow	Langsam
+scroll speed	Normal	Normal
+scroll speed	Fast	Schnell
+	Enhance camera image	Kamerafoto verbessern
+	Drag the corners onto the document's edges, then choose Enhance page.	Ziehen Sie die Ecken auf die Kanten des Dokuments und wählen Sie dann Seite verbessern.
+	Enhance page	Seite verbessern
+	Done adding text	Texteingabe abschließen
+	Discard this text (Esc)	Diesen Text verwerfen (Esc)
+	Clean-up	Bereinigung
+	Original	Original
+	Greyscale	Graustufen
+	Black and white	Schwarzweiß
diff --git a/crates/ui-egui/src/i18n/es.tsv b/crates/ui-egui/src/i18n/es.tsv
index 18678cde..62a6e601 100644
--- a/crates/ui-egui/src/i18n/es.tsv
+++ b/crates/ui-egui/src/i18n/es.tsv
@@ -104,12 +104,18 @@
 	Open a PDF ({key})	Abrir un PDF ({key})
 	Dark gray theme	Tema gris oscuro
 	Light theme	Tema claro
+	Appearance mode	Modo de apariencia
+	Light	Claro
+	Dark	Oscuro
+	Active	Activo
+	Dark theme	Tema oscuro
+	Appearance settings…	Ajustes de apariencia…
 	All tools	Todas las herramientas
 	Read	Leer
 	Convert	Convertir
 	E-Sign	Firma electrónica
 	Print ({key})	Imprimir ({key})
-	Save (M4)	Guardar (M4)
+	Save ({key})	Guardar ({key})
 	Document properties ({key})	Propiedades del documento ({key})
 	Find tools and commands	Buscar herramientas y comandos
 	Fit to height	Ajustar al alto
@@ -764,7 +770,7 @@
 	{verb} Header and Footer	{verb} encabezado y pie de página
 	{verb} Watermark	{verb} marca de agua
 	{verb} Background	{verb} fondo
-	Margins (in)	Márgenes (pulgadas)
+	Margins	Márgenes
 	Left Header Text	Texto del encabezado izquierdo
 	Center Header Text	Texto del encabezado central
 	Right Header Text	Texto del encabezado derecho
@@ -843,6 +849,10 @@
 	The signature will be invisible.	La firma será invisible.
 	Distinguished name	Nombre distintivo
 	Labels	Etiquetas
+	Graphic	Gráfico
+	Signer's name	Nombre del firmante
+	Fill & Sign signature	Firma de Rellenar y firmar
+	Choose image…	Elegir imagen…
 	Permitted actions after certifying	Acciones permitidas después de certificar
 	No changes allowed	No se permite ningún cambio
 	Annotations, form fill-in, and digital signatures	Anotaciones, rellenado de formularios y firmas digitales
@@ -1588,16 +1598,16 @@
 	Opened, but its security settings don't allow combining. Enter the permissions password.	Se abrió, pero su configuración de seguridad no permite combinarlo. Introduce la contraseña de permisos.
 	Unlocked: the combined file won't be password-protected	Desbloqueado: el archivo combinado no estará protegido con contraseña
 	Unlocked {n} of {m} files	Se desbloquearon {n} de {m} archivos
-	Drop PDFs or folders here, or choose them.	Suelta aquí PDF o carpetas, o elígelos.
+	Drop PDFs, images, text files or folders here, or choose them.	Suelta aquí PDF, imágenes, archivos de texto o carpetas, o elígelos.
 	Add folder…	Añadir carpeta…
 	Add folder and subfolders…	Añadir carpeta y subcarpetas…
 	More ways to add files	Más formas de añadir archivos
-	Every PDF in the folder	Todos los PDF de la carpeta
-	Every PDF in the folder and the folders inside it	Todos los PDF de la carpeta y de las carpetas que contiene
+	Every PDF, image and text file in the folder	Todos los PDF, imágenes y archivos de texto de la carpeta
+	Every PDF, image and text file in the folder and the folders inside it	Todos los PDF, imágenes y archivos de texto de la carpeta y de las carpetas que contiene
 	Add folder	Añadir carpeta
 	Add folder and subfolders	Añadir carpeta y subcarpetas
-	No PDFs found in {folder}	No se encontraron PDF en {folder}
-	Added the first {n} PDFs in {folder}	Se añadieron los primeros {n} PDF de {folder}
+	No PDFs, images or text files found in {folder}	No se encontraron PDF, imágenes ni archivos de texto en {folder}
+	Added the first {n} files in {folder}	Se añadieron los primeros {n} archivos de {folder}
 	Click to sort, drag to move the column. Drag its edge to resize it.	Haz clic para ordenar; arrastra para mover la columna. Arrastra su borde para cambiar el ancho.
 	Reset columns	Restablecer columnas
 	Remove {n} files	Quitar {n} archivos
@@ -1615,7 +1625,7 @@
 	{n} files need attention	{n} archivos necesitan atención
 	{name} can't be combined: {why}	No se puede combinar {name}: {why}
 	Check the pages of {name}: {why}	Revisa las páginas de {name}: {why}
-	Add the PDFs to combine	Añade los PDF que quieres combinar
+	Add the files to combine	Añade los archivos que quieres combinar
 	File name	Nombre de archivo
 	Warnings	Advertencias
 	Drag to reorder	Arrastra para reordenar
@@ -1628,6 +1638,10 @@
 	Password-protected	Protegido con contraseña
 	Its security settings don't allow copying pages	Su configuración de seguridad no permite copiar páginas
 	Can't be read: {e}	No se puede leer: {e}
+	Leave out files that can't be read?	¿Omitir los archivos que no se pueden leer?
+	These files can't be read, so they won't be in the combined PDF:	Estos archivos no se pueden leer, así que no estarán en el PDF combinado:
+	Combine the rest	Combinar el resto
+	and {n} more	y {n} más
 	Includes unsaved changes	Incluye cambios sin guardar
 	Pages of {name} to combine, e.g. 1-3, 6	Páginas de {name} que combinar, p. ej., 1-3, 6
 	Remove {name}	Quitar {name}
@@ -1703,8 +1717,14 @@
 	watermark	marca de agua
 	background	fondo
 	This document isn't password-protected	Este documento no está protegido con contraseña
-	Only the document's owner can change its security (open it with the permissions password)	Solo el propietario del documento puede cambiar su seguridad (ábrelo con la contraseña de permisos)
+	Enter permissions password…	Introducir contraseña de permisos…
+	Permissions password	Contraseña de permisos
+	“{name}” has security restrictions. Enter its permissions password to lift them.	«{name}» tiene restricciones de seguridad. Introduce su contraseña de permisos para quitarlas.
+	Restrictions lifted	Restricciones quitadas
+	Couldn't unlock {name}: {e}	No se pudo desbloquear {name}: {e}
+	This document has no restrictions to lift	Este documento no tiene restricciones que quitar
 	The document's security settings don't allow this change	La configuración de seguridad del documento no permite este cambio
+	The document's security settings don't allow copying text and images	La configuración de seguridad del documento no permite copiar texto ni imágenes
 	Open a document first	Abre primero un documento
 	Security will be removed when you save	La seguridad se quitará al guardar
 	Click text or an image to edit it	Haz clic en un texto o una imagen para editarlo
@@ -1814,6 +1834,8 @@
 	The document is encrypted	El documento está cifrado
 	Device colour is used, but there is no PDF/A output intent	Se usa color de dispositivo, pero no hay propósito de salida PDF/A
 	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	Se usa DeviceCMYK: necesita un propósito de salida CMYK (no se añade automáticamente)
+	DeviceCMYK is used, but the PDF/A output intent isn't a CMYK profile	Se usa DeviceCMYK, pero el propósito de salida PDF/A no es un perfil CMYK
+	DeviceRGB is used, but the PDF/A output intent isn't an RGB profile	Se usa DeviceRGB, pero el propósito de salida PDF/A no es un perfil RGB
 	The document has additional actions (/AA)	El documento tiene acciones adicionales (/AA)
 	The document has document-level JavaScript	El documento tiene JavaScript de nivel de documento
 	The form asks viewers to make appearances (NeedAppearances)	El formulario pide a los visores que generen las apariencias (NeedAppearances)
@@ -1891,6 +1913,7 @@
 	Delete link	Eliminar enlace
 	Create link	Crear enlace
 	Flatten	Acoplar
+	Flatten Fill & Sign	Acoplar Rellenar y firmar
 	Add sticky note	Añadir nota adhesiva
 	Add highlight	Añadir resaltado
 	Add underline	Añadir subrayado
@@ -2007,6 +2030,10 @@
 	Default zoom	Zoom predeterminado
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Se usa cuando un PDF no pide una presentación ni un zoom. El desplazamiento continuo nunca salta de página en página.
 	Reopen the files that were open when PdfCraft last closed	Volver a abrir los archivos que estaban abiertos al cerrar PdfCraft por última vez
+	Reload documents when their files change on disk	Recargar los documentos cuando sus archivos cambien en el disco
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Este archivo ha cambiado en el disco. Recárgalo para ver la nueva versión; se perderán tus cambios sin guardar.
+	Reload	Recargar
+	Couldn't reload {name}: {e}	No se pudo recargar {name}: {e}
 	Created a PDF from {n} files	Se creó un PDF a partir de {n} archivos
 	PDF, images and text	PDF, imágenes y texto
 	Insert a file before page {label}	Insertar un archivo antes de la página {label}
@@ -2016,10 +2043,11 @@
 	No changes to save	No hay cambios que guardar
 	Created a PDF from {n} files; left out: {names}	Se creó un PDF a partir de {n} archivos; omitidos: {names}
 	Created a PDF from the first {n} files	Se creó un PDF a partir de los primeros {n} archivos
-	None of those files can be made into a PDF; use PDFs, images or .txt files	Ninguno de esos archivos se puede convertir en PDF; use archivos PDF, imágenes o .txt
-	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Elija una imagen PNG o JPEG (hasta 4 MiB). Se conserva la transparencia.
+	None of those files can be made into a PDF; use PDFs, images or .txt files	Ninguno de esos archivos se puede convertir en PDF; usa archivos PDF, imágenes o .txt
+	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Elige una imagen PNG o JPEG (hasta 4 MiB). Se conserva la transparencia.
 	Couldn't import the signature image: {e}	No se pudo importar la imagen de la firma: {e}
 	Go to page…	Ir a la página…
+	For page sizes and margins.	Para tamaños de página y márgenes.
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Las fuentes estándar no pueden mostrar «{c}» ({code}). Por ahora solo se pueden añadir como texto caracteres de Europa occidental.
 	Open arrow	Flecha abierta
 	Closed arrow	Flecha cerrada
@@ -2067,6 +2095,148 @@
 	A selected field has no widget on any page, so the fields can't be edited together.	Un campo seleccionado no tiene ningún widget en ninguna página, así que los campos no se pueden editar juntos.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} a {dpi} ppp, el mayor tamaño al que se pueden dibujar)
 
+# What the layers below word for themselves, now that the engine hands the wording over apart from
+# the document's own words: `pdfcraft_a11y::{WORDINGS, REPORT_WORDS}`, `pdfcraft_preflight::WORDINGS`,
+# `pdfcraft_sign::pdf::{WORDINGS, kind::ALL}`, `pdfcraft_print::WORDINGS` and the engine's
+# `EDIT_LABELS`. `spanish_covers_what_the_engine_says` keeps this section complete.
+#
+# What the checker finds (a11y::WORDINGS).
+	The security settings don't allow screen readers to read the text	La configuración de seguridad no permite que los lectores de pantalla lean el texto
+	No page has text: the document appears to be images of pages	Ninguna página tiene texto: el documento parece ser imágenes de páginas
+	The document has no tags (structure tree)	El documento no tiene etiquetas (árbol de estructura)
+	The document isn't marked as tagged (MarkInfo Marked)	El documento no está marcado como etiquetado (MarkInfo Marked)
+	No document language is set	No se ha indicado el idioma del documento
+	The document has no title	El documento no tiene título
+	The window shows the file name, not the title (Initial View > Show)	La ventana muestra el nombre del archivo, no el título (Vista inicial > Mostrar)
+	{n} pages and no bookmarks	{n} páginas y ningún marcador
+	The document isn't tagged, so none of its content is	El documento no está etiquetado, así que su contenido tampoco lo está
+	Page {p}: {n} untagged content item	Página {p}: {n} elemento de contenido sin etiquetar
+	Page {p}: {n} untagged content items	Página {p}: {n} elementos de contenido sin etiquetar
+	Form field on page {p} isn't tagged	Un campo de formulario de la página {p} no está etiquetado
+	{} annotation on page {p} isn't tagged	Una anotación {} de la página {p} no está etiquetada
+	Page {p} doesn't tab in structure order	La página {p} no se tabula en el orden de la estructura
+	Font {} on page {p} doesn't map its characters to Unicode	La fuente {} de la página {p} no asigna sus caracteres a Unicode
+	Font (unnamed) on page {p} doesn't map its characters to Unicode	Una fuente sin nombre de la página {p} no asigna sus caracteres a Unicode
+	Field "{}" on page {p} has no description (tooltip)	El campo «{}» de la página {p} no tiene descripción (información sobre herramientas)
+	{ty} element: {what}	Elemento {ty}: {what}
+	{ty} element on page {p}: {what}	Elemento {ty} de la página {p}: {what}
+	no alternate text	sin texto alternativo
+	its alternate text is inside another element's and will never be read	su texto alternativo está dentro del de otro elemento y nunca se leerá
+	alternate text on an element with no page content	texto alternativo en un elemento sin contenido de página
+	alternate text hides an annotation inside it	el texto alternativo oculta una anotación que hay dentro
+	not in a Table, THead, TBody or TFoot	no está dentro de un Table, THead, TBody ni TFoot
+	not in a TR	no está dentro de un TR
+	no header cells (TH)	sin celdas de encabezado (TH)
+	rows have between {min} and {max} columns	las filas tienen entre {min} y {max} columnas
+	no summary	sin resumen
+	not in an L (list)	no está dentro de una L (lista)
+	not in an LI (list item)	no está dentro de un LI (elemento de lista)
+	the first heading is an H{n}; headings should not skip levels	el primer encabezado es un H{n}; los encabezados no deben saltarse niveles
+	H{n} follows an H{d}; headings should not skip levels	un H{n} va después de un H{d}; los encabezados no deben saltarse niveles
+	… and {n} more	… y {n} más
+# The saved accessibility report (a11y::REPORT_WORDS).
+	Accessibility Report	Informe de accesibilidad
+	Filename	Nombre del archivo
+	Report created	Informe creado
+	The checker found problems which may prevent the document from being fully accessible.	El comprobador ha encontrado problemas que pueden impedir que el documento sea del todo accesible.
+	Detailed Report	Informe detallado
+	Rule Name	Nombre de la regla
+# What the PDF/A verifier reports (preflight::WORDINGS).
+	The metadata doesn't identify the file as {}	Los metadatos no identifican el archivo como {}
+	Page {} has additional actions	La página {} tiene acciones adicionales
+	A {} action isn't allowed	No se permite una acción {}
+	{} annotations aren't allowed	No se permiten las anotaciones {}
+	A {} annotation isn't set to print, or is hidden	Una anotación {} no está marcada para imprimirse, o está oculta
+	A {} annotation has no appearance stream	Una anotación {} no tiene flujo de apariencia
+	A {} annotation has additional actions	Una anotación {} tiene acciones adicionales
+	The font {} isn't embedded	La fuente {} no está incrustada
+	A font isn't embedded	Hay una fuente que no está incrustada
+# What a signature's details say (sign::pdf::WORDINGS).
+	The signature has no valid byte range.	La firma no tiene un intervalo de bytes válido.
+	The signature's byte range does not match the file.	El intervalo de bytes de la firma no se corresponde con el archivo.
+	The signature's byte range does not exclude exactly its contents.	El intervalo de bytes de la firma no excluye exactamente su contenido.
+	The signature contents are not hexadecimal.	El contenido de la firma no es hexadecimal.
+	The signature could not be read ({}).	No se ha podido leer la firma ({}).
+	PdfCraft can't check this signature yet: {}.	PdfCraft todavía no puede comprobar esta firma: {}.
+	The signature uses the legacy adbe.x509.rsa_sha1 format.	La firma usa el formato antiguo adbe.x509.rsa_sha1.
+# What was read leniently on the way, each sentence worded where the reading happens.
+	The signature is BER-encoded (indefinite lengths) rather than DER; it was read leniently.	La firma está codificada en BER (longitudes indefinidas) en vez de en DER; se ha leído con indulgencia.
+	The signed content is a constructed (segmented) OCTET STRING, as BER allows; it was read anyway.	El contenido firmado es un OCTET STRING construido (segmentado), como permite BER; se ha leído igualmente.
+	The RSA signature value does not have the length of the key's modulus (leading zero bytes dropped or added); it was read anyway.	El valor de la firma RSA no tiene la longitud del módulo de la clave (se han quitado o añadido ceros iniciales); se ha leído igualmente.
+	The RSA signature's DigestInfo has no NULL parameter (older signers write it so); it was read anyway.	El DigestInfo de la firma RSA no lleva el parámetro NULL (los firmadores antiguos lo escriben así); se ha leído igualmente.
+	The ECDSA signature is not in canonical DER (trailing bytes, padding or a missing sign byte); it was read anyway.	La firma ECDSA no está en DER canónico (bytes de sobra, relleno o falta el byte de signo); se ha leído igualmente.
+	The ECDSA signature is the raw r and s values instead of a DER sequence; it was read anyway.	La firma ECDSA son los valores r y s en bruto en vez de una secuencia DER; se ha leído igualmente.
+	The signature algorithm and the SignerInfo's digest algorithm name different hashes; the signature was made with the SignerInfo's.	El algoritmo de la firma y el algoritmo de resumen del SignerInfo nombran hashes distintos; la firma se hizo con el del SignerInfo.
+# What a signature that validates with an old hash still does not prove.
+	This signature uses SHA-1, a weak hash algorithm: collisions in it have been demonstrated. It still validates because many documents signed years ago use it, but it should not be relied on.	Esta firma usa SHA-1, un algoritmo de hash débil: se han demostrado colisiones en él. Sigue siendo válida porque muchos documentos firmados hace años lo usan, pero no conviene fiarse de ella.
+	This signature uses RIPEMD-160, a legacy 160-bit hash algorithm that is no longer recommended for signatures. It still validates, but it should not be relied on.	Esta firma usa RIPEMD-160, un algoritmo de hash heredado de 160 bits que ya no se recomienda para firmas. Sigue siendo válida, pero no conviene fiarse de ella.
+	The document has been altered or corrupted since the signature was applied.	El documento se ha alterado o se ha dañado desde que se aplicó la firma.
+	The signer's certificate is not in the signature.	El certificado del firmante no está en la firma.
+	The signature value does not match the signer's certificate: the signature is corrupt.	El valor de la firma no se corresponde con el certificado del firmante: la firma está dañada.
+	The signature could not be checked ({}).	No se ha podido comprobar la firma ({}).
+	The signature could not be verified ({}).	No se ha podido verificar la firma ({}).
+	This document has not been modified since this signature was applied.	Este documento no se ha modificado desde que se aplicó esta firma.
+	The document has been modified since this signature was applied, but the changes are permitted ({}).	El documento se ha modificado desde que se aplicó esta firma, pero son cambios que permite ({}).
+	The document has been altered since this signature was applied in ways it does not permit ({}).	El documento se ha alterado desde que se aplicó esta firma de maneras que no permite ({}).
+	The signer's certificate was not valid at the time of signing.	El certificado del firmante no era válido en el momento de la firma.
+	The signer's certificate does not allow digital signatures (its key usage has neither digital signature nor non-repudiation).	El certificado del firmante no permite firmas digitales (su uso de clave no incluye ni firma digital ni no repudio).
+	The signer's certificate is not issued for signing documents (its extended key usage has no document-signing purpose).	El certificado del firmante no está emitido para firmar documentos (su uso extendido de clave no incluye ningún propósito de firma de documentos).
+	The signer's certificate has critical extensions PdfCraft does not recognize ({}).	El certificado del firmante tiene extensiones críticas que PdfCraft no reconoce ({}).
+# Why a certificate that matched the issuer was not used to build the chain.
+	The certificate of {} is not a CA certificate that may issue certificates, so it is not used to vouch for {}.	El certificado de {} no es un certificado de CA que pueda emitir certificados, así que no se usa para avalar a {}.
+	The certificate of {} does not allow this many CA certificates below it (path length), so it is not used to vouch for {}.	El certificado de {} no admite tantos certificados de CA por debajo (longitud de ruta), así que no se usa para avalar a {}.
+	The certificate of {} was not valid at the time of signing, so it is not used to vouch for {}.	El certificado de {} no era válido en el momento de la firma, así que no se usa para avalar a {}.
+	The signer's identity is unknown because it has not been included in your list of trusted certificates and none of its parent certificates are trusted certificates.	La identidad del firmante es desconocida porque no está en tu lista de certificados de confianza y ninguno de los certificados superiores es de confianza.
+	The signer's identity is valid.	La identidad del firmante es válida.
+	The signature includes an embedded timestamp.	La firma incluye un sello de tiempo incrustado.
+	Signing time is from the clock on the signer's computer.	La hora de la firma es la del reloj del ordenador del firmante.
+	The signature's timestamp token does not cover the signature value.	El sello de tiempo de la firma no cubre el valor de la firma.
+	The signature's timestamp token could not be verified ({}).	No se ha podido verificar el sello de tiempo de la firma ({}).
+	The embedded timestamp token is valid and its authority is trusted; trusted time is {}.	El sello de tiempo incrustado es válido y su autoridad es de confianza; la hora de confianza es {}.
+	The signature carries an unverified timestamp ({}): the timestamp authority is not in your list of trusted certificates, so the signing time claimed by the signer is used instead.	La firma lleva un sello de tiempo sin verificar ({}): la autoridad de sellado de tiempo no está en tu lista de certificados de confianza, así que se usa la hora de firma que indica el firmante.
+	The signer's certificate has been revoked ({}).	El certificado del firmante está revocado ({}).
+	The document's embedded revocation information shows that the signer's certificate has not been revoked.	La información de revocación incrustada en el documento indica que el certificado del firmante no está revocado.
+	The timestamp has no valid byte range.	El sello de tiempo no tiene un intervalo de bytes válido.
+	The timestamp's byte range does not match the file.	El intervalo de bytes del sello de tiempo no se corresponde con el archivo.
+	The timestamp's byte range does not exclude exactly its contents.	El intervalo de bytes del sello de tiempo no excluye exactamente su contenido.
+	The timestamp contents are not hexadecimal.	El contenido del sello de tiempo no es hexadecimal.
+	The timestamp token could not be read ({}).	No se ha podido leer el sello de tiempo ({}).
+	The document has been altered or corrupted since the timestamp was applied.	El documento se ha alterado o se ha dañado desde que se aplicó el sello de tiempo.
+	The timestamp authority's certificate was not valid at the time of timestamping.	El certificado de la autoridad de sellado de tiempo no era válido en el momento del sellado.
+	This document has not been modified since this timestamp was applied.	Este documento no se ha modificado desde que se aplicó este sello de tiempo.
+	The document has been modified since this timestamp was applied, but the changes are permitted ({}).	El documento se ha modificado desde que se aplicó este sello de tiempo, pero son cambios que permite ({}).
+	The document has been altered since this timestamp was applied in ways it does not permit ({}).	El documento se ha alterado desde que se aplicó este sello de tiempo de maneras que no permite ({}).
+	The timestamp token is valid and its authority is trusted.	El sello de tiempo es válido y su autoridad es de confianza.
+	The timestamp token is valid, but the timestamp authority is not in your list of trusted certificates.	El sello de tiempo es válido, pero la autoridad de sellado de tiempo no está en tu lista de certificados de confianza.
+	Unsigned signature field	Campo de firma sin firmar
+	Signature is valid	La firma es válida
+	Signature validity is unknown	La validez de la firma es desconocida
+	Signature is invalid	La firma no es válida
+# The changes a signature allows or does not allow, as they are listed in those sentences
+# (sign::pdf::kind::ALL): words in an enumeration, so no article and no capital.
+	page content	contenido de las páginas
+	form fill	relleno de formularios
+	comments	comentarios
+	document security store	almacén de seguridad del documento
+	metadata	metadatos
+	links	enlaces
+	document structure	estructura del documento
+	pages added or removed	páginas añadidas o quitadas
+	other changes	otros cambios
+	the signed version could not be read	no se ha podido leer la versión firmada
+# What can be wrong with the pages to print (print::WORDINGS).
+	page {n} is out of range (1–{count})	la página {n} está fuera del intervalo (1–{count})
+	{page} is not a page number or label	{page} no es un número ni una etiqueta de página
+# What an edit is called in the Edit menu and the history (EDIT_LABELS, BATCH_LABELS).
+	Change Title	Cambiar el título
+	Change Author	Cambiar el autor
+	Change Subject	Cambiar el asunto
+	Change Keywords	Cambiar las palabras clave
+	Run form script	Ejecutar el script del formulario
+	Save as {level}	Guardar como {level}
+	Create links	Crear enlaces
+	Mark differences	Marcar diferencias
+
 # Multi-object selection and movement (#844)
 @plural	{n} object selected|{n} objects selected	{n} objeto seleccionado|{n} objetos seleccionados
 	Drag the selection to move it. Esc clears the selection.	Arrastra la selección para moverla. Esc borra la selección.
@@ -2112,3 +2282,18 @@ key	Space	Espacio
 	Resize panel window	Cambiar tamaño de la ventana del panel
 	Tools	Herramientas
 	Inspector	Inspector
+	Select page {label}	Seleccionar la página {label}
+	Rotate page {label} counterclockwise	Girar la página {label} en sentido antihorario
+	Rotate page {label} clockwise	Girar la página {label} en sentido horario
+	Delete page {label}	Eliminar la página {label}
+	Mouse wheel scroll speed	Velocidad de desplazamiento de la rueda del ratón
+scroll speed	Slow	Lenta
+scroll speed	Normal	Normal
+scroll speed	Fast	Rápida
+	Enhance camera image	Mejorar foto de cámara
+	Drag the corners onto the document's edges, then choose Enhance page.	Arrastre las esquinas hasta los bordes del documento y elija Mejorar página.
+	Enhance page	Mejorar página
+	Clean-up	Limpieza
+	Original	Original
+	Greyscale	Escala de grises
+	Black and white	Blanco y negro
diff --git a/crates/ui-egui/src/i18n/fr.tsv b/crates/ui-egui/src/i18n/fr.tsv
index 937bed59..4e6bd6e4 100644
--- a/crates/ui-egui/src/i18n/fr.tsv
+++ b/crates/ui-egui/src/i18n/fr.tsv
@@ -83,12 +83,18 @@
 	Open a PDF ({key})	Ouvrir un PDF ({key})
 	Dark gray theme	Thème gris foncé
 	Light theme	Thème clair
+	Appearance mode	Mode d'apparence
+	Light	Clair
+	Dark	Sombre
+	Active	Actif
+	Dark theme	Thème sombre
+	Appearance settings…	Réglages d'apparence…
 	All tools	Tous les outils
 	Read	Lire
 	Convert	Convertir
 	E-Sign	Signature électronique
 	Print ({key})	Imprimer ({key})
-	Save (M4)	Enregistrer (M4)
+	Save ({key})	Enregistrer ({key})
 	Document properties ({key})	Propriétés du document ({key})
 	Find tools and commands	Rechercher des outils et des commandes
 	Fit to height	Ajuster à la hauteur
@@ -743,7 +749,7 @@
 	{verb} Header and Footer	{verb} l'en-tête et le pied de page
 	{verb} Watermark	{verb} le filigrane
 	{verb} Background	{verb} l'arrière-plan
-	Margins (in)	Marges (po)
+	Margins	Marges
 	Left Header Text	Texte de l'en-tête gauche
 	Center Header Text	Texte de l'en-tête central
 	Right Header Text	Texte de l'en-tête droit
@@ -758,6 +764,7 @@
 	Rotation	Rotation
 	Appear behind page	Afficher derrière la page
 	Appear on top of page	Afficher au-dessus de la page
+	Offset from centre	Décalage par rapport au centre
 	From colour	À partir d'une couleur
 	Page Range Options	Options d'intervalle de pages
 	Preview: page {p} of {n}	Aperçu : page {p} sur {n}
@@ -822,6 +829,10 @@
 	The signature will be invisible.	La signature sera invisible.
 	Distinguished name	Nom distinctif
 	Labels	Étiquettes
+	Graphic	Graphique
+	Signer's name	Nom du signataire
+	Fill & Sign signature	Signature de Remplir et signer
+	Choose image…	Choisir une image…
 	Permitted actions after certifying	Actions autorisées après certification
 	No changes allowed	Aucune modification autorisée
 	Annotations, form fill-in, and digital signatures	Annotations, remplissage de formulaire et signatures numériques
@@ -1632,8 +1643,14 @@
 	watermark	filigrane
 	background	arrière-plan
 	This document isn't password-protected	Ce document n'est pas protégé par mot de passe
-	Only the document's owner can change its security (open it with the permissions password)	Seul le propriétaire du document peut modifier sa protection (ouvrez-le avec le mot de passe d'autorisations)
+	Enter permissions password…	Saisir le mot de passe d'autorisations…
+	Permissions password	Mot de passe d'autorisations
+	“{name}” has security restrictions. Enter its permissions password to lift them.	«{name}» comporte des restrictions de sécurité. Saisissez son mot de passe d'autorisations pour les lever.
+	Restrictions lifted	Restrictions levées
+	Couldn't unlock {name}: {e}	Impossible de déverrouiller {name} : {e}
+	This document has no restrictions to lift	Ce document n'a aucune restriction à lever
 	The document's security settings don't allow this change	Les paramètres de protection du document n'autorisent pas cette modification
+	The document's security settings don't allow copying text and images	Les paramètres de protection du document n'autorisent pas la copie de texte et d'images
 	Open a document first	Ouvrez d'abord un document
 	Security will be removed when you save	La protection sera retirée à l'enregistrement
 	Click text or an image to edit it	Cliquez sur un texte ou une image pour le modifier
@@ -1936,6 +1953,10 @@
 	Default zoom	Zoom par défaut
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Utilisé lorsqu'un PDF ne demande ni présentation ni zoom. Le défilement continu ne saute jamais d'une page à l'autre.
 	Reopen the files that were open when PdfCraft last closed	Rouvrir les fichiers qui étaient ouverts lors de la dernière fermeture de PdfCraft
+	Reload documents when their files change on disk	Recharger les documents lorsque leurs fichiers sont modifiés sur le disque
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Ce fichier a été modifié sur le disque. Rechargez-le pour voir la nouvelle version ; vos modifications non enregistrées seront perdues.
+	Reload	Recharger
+	Couldn't reload {name}: {e}	Impossible de recharger {name} : {e}
 	Show	Afficher
 	Sort	Trier
 	Reverse the order	Inverser l'ordre
@@ -1991,18 +2012,22 @@
 	Add folder and subfolders…	Ajouter un dossier et ses sous-dossiers…
 	Add folder…	Ajouter un dossier…
 	Add open documents	Ajouter des documents ouverts
-	Add the PDFs to combine	Ajoutez les PDF à combiner
+	Add the files to combine	Ajoutez les fichiers à combiner
 	Added more than once	Ajouté plusieurs fois
 	All open documents	Tous les documents ouverts
 	Can't be read: {e}	Illisible : {e}
+	Leave out files that can't be read?	Laisser de côté les fichiers illisibles ?
+	These files can't be read, so they won't be in the combined PDF:	Ces fichiers sont illisibles ; ils ne figureront pas dans le PDF combiné :
+	Combine the rest	Combiner les autres
+	and {n} more	et {n} de plus
 	Check the pages of {name}: {why}	Vérifiez les pages de {name} : {why}
 	Click to sort, drag to move the column. Drag its edge to resize it.	Cliquer pour trier, faire glisser pour déplacer la colonne. Faire glisser son bord pour la redimensionner.
 	Drag to reorder	Faire glisser pour réordonner
-	Drop PDFs or folders here, or choose them.	Déposez ici des PDF ou des dossiers, ou choisissez-les.
+	Drop PDFs, images, text files or folders here, or choose them.	Déposez ici des PDF, des images, des fichiers texte ou des dossiers, ou choisissez-les.
 	Enter the password that opens it	Saisissez le mot de passe qui l'ouvre
 	Enter the permissions password to allow combining	Saisissez le mot de passe des autorisations pour permettre de le combiner
-	Every PDF in the folder	Tous les PDF du dossier
-	Every PDF in the folder and the folders inside it	Tous les PDF du dossier et des dossiers qu'il contient
+	Every PDF, image and text file in the folder	Tous les PDF, images et fichiers texte du dossier
+	Every PDF, image and text file in the folder and the folders inside it	Tous les PDF, images et fichiers texte du dossier et des dossiers qu'il contient
 	File name	Nom du fichier
 	Files are combined from top to bottom. Leave Pages empty to take every page.	Les fichiers sont combinés de haut en bas. Laissez Pages vide pour prendre toutes les pages.
 	Hide password	Masquer le mot de passe
@@ -2063,6 +2088,7 @@
 	Pinned {folder} to Home	{folder} épinglé à l'Accueil
 	No recent files	Aucun fichier récent
 	Go to page…	Aller à la page…
+	For page sizes and margins.	Pour les tailles de page et les marges.
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Les polices standard ne peuvent pas afficher « {c} » ({code}). Pour l'instant, seuls les caractères d'Europe occidentale peuvent être ajoutés comme texte.
 	Larger pages	Pages plus grandes
 	Smaller pages	Pages plus petites
@@ -2085,7 +2111,7 @@
 	A script	Un script
 	About	À propos
 	Add {what}	Ajouter {what}
-	Added the first {n} PDFs in {folder}	Les {n} premiers PDF de {folder} ont été ajoutés
+	Added the first {n} files in {folder}	Les {n} premiers fichiers de {folder} ont été ajoutés
 	Align fields	Aligner les champs
 	Another file dialog is still open. Finish with it first.	Une autre boîte de dialogue de fichier est encore ouverte. Terminez d'abord avec celle-ci.
 	Basic constraints	Contraintes de base
@@ -2101,7 +2127,7 @@
 	Mark pages for redaction	Marquer des pages pour biffure
 	Match field sizes	Uniformiser la taille des champs
 	Models	Modèles
-	No PDFs found in {folder}	Aucun PDF trouvé dans {folder}
+	No PDFs, images or text files found in {folder}	Aucun PDF, image ou fichier texte trouvé dans {folder}
 	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Ne continuez que si vous faites confiance à ce document. Une adresse peut transmettre des informations du document, par exemple ce que vous avez saisi dans son formulaire.
 	Place saved {what}	Placer {what} (version enregistrée)
 	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Imprimez en recto seul. Gardez les feuilles dans l'ordre, découpez aux repères, puis empilez les piles de gauche à droite et de haut en bas.
@@ -2196,3 +2222,27 @@ key	Space	Espace
 	Resize panel window	Redimensionner la fenêtre du panneau
 	Tools	Outils
 	Inspector	Inspecteur
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	Page PDF : {size}
+	Match page at 100%	Adapter le papier à la page à 100 %
+	PDF scale: {scale}%	Échelle PDF : {scale}%
+	Printer paper and scaling may differ. Check driver settings.	Le papier et l’échelle de l’imprimante peuvent différer. Vérifiez les réglages du pilote.
+	Drawing scale changes. Use Actual size for full-scale plans.	L’échelle du dessin change. Utilisez Taille réelle pour les plans à l’échelle.
+	Select page {label}	Sélectionner la page {label}
+	Rotate page {label} counterclockwise	Faire pivoter la page {label} dans le sens antihoraire
+	Rotate page {label} clockwise	Faire pivoter la page {label} dans le sens horaire
+	Delete page {label}	Supprimer la page {label}
+	Mouse wheel scroll speed	Vitesse de défilement de la molette
+scroll speed	Slow	Lente
+scroll speed	Normal	Normale
+scroll speed	Fast	Rapide
+	Enhance camera image	Améliorer la photo d'un document
+	Drag the corners onto the document's edges, then choose Enhance page.	Faites glisser les coins sur les bords du document, puis choisissez Améliorer la page.
+	Enhance page	Améliorer la page
+	Done adding text	Terminer l'ajout de texte
+	Discard this text (Esc)	Abandonner ce texte (Échap)
+	Clean-up	Nettoyage
+	Original	Original
+	Greyscale	Niveaux de gris
+	Black and white	Noir et blanc
diff --git a/crates/ui-egui/src/i18n/hu.tsv b/crates/ui-egui/src/i18n/hu.tsv
index 3abb9ba1..5ff1e26d 100644
--- a/crates/ui-egui/src/i18n/hu.tsv
+++ b/crates/ui-egui/src/i18n/hu.tsv
@@ -81,12 +81,18 @@
 	Open a PDF ({key})	PDF megnyitása ({key})
 	Dark gray theme	Sötétszürke téma
 	Light theme	Világos téma
+	Appearance mode	Megjelenési mód
+	Light	Világos
+	Dark	Sötét
+	Active	Aktív
+	Dark theme	Sötét téma
+	Appearance settings…	Megjelenési beállítások…
 	All tools	Minden eszköz
 	Read	Olvasás
 	Convert	Konvertálás
 	E-Sign	E-aláírás
 	Print ({key})	Nyomtatás ({key})
-	Save (M4)	Mentés (M4)
+	Save ({key})	Mentés ({key})
 	Document properties ({key})	Dokumentum tulajdonságai ({key})
 	Find tools and commands	Eszközök és parancsok keresése
 	Fit to height	Magassághoz igazítás
@@ -755,6 +761,7 @@
 	Rotation	Elforgatás
 	Appear behind page	Az oldal mögött
 	Appear on top of page	Az oldal előtt
+	Offset from centre	Eltolás a középponttól
 	From colour	Színből
 	Page Range Options	Oldaltartomány beállításai
 	Preview: page {p} of {n}	Előnézet: {p}. oldal / {n}
@@ -819,6 +826,10 @@
 	The signature will be invisible.	Az aláírás láthatatlan lesz.
 	Distinguished name	Megkülönböztető név
 	Labels	Címkék
+	Graphic	Grafika
+	Signer's name	Aláíró neve
+	Fill & Sign signature	A Kitöltés és aláírás aláírása
+	Choose image…	Kép kiválasztása…
 	Permitted actions after certifying	Engedélyezett műveletek hitelesítés után
 	No changes allowed	Semmilyen módosítás nem engedélyezett
 	Annotations, form fill-in, and digital signatures	Széljegyzetek, űrlapkitöltés és digitális aláírások
@@ -1622,8 +1633,14 @@
 	watermark	vízjel
 	background	háttér
 	This document isn't password-protected	Ez a dokumentum nincs jelszóval védve
-	Only the document's owner can change its security (open it with the permissions password)	Csak a dokumentum tulajdonosa módosíthatja a biztonságát (nyisd meg a jogosultsági jelszóval)
+	Enter permissions password…	Jogosultsági jelszó megadása…
+	Permissions password	Jogosultsági jelszó
+	“{name}” has security restrictions. Enter its permissions password to lift them.	„{name}” biztonsági korlátozásokat tartalmaz. Add meg a jogosultsági jelszavát a feloldásukhoz.
+	Restrictions lifted	Korlátozások feloldva
+	Couldn't unlock {name}: {e}	{name} feloldása nem sikerült: {e}
+	This document has no restrictions to lift	Ebben a dokumentumban nincs feloldható korlátozás
 	The document's security settings don't allow this change	A dokumentum biztonsági beállításai nem engedik ezt a módosítást
+	The document's security settings don't allow copying text and images	A dokumentum biztonsági beállításai nem engedik a szöveg és a képek másolását
 	Open a document first	Előbb nyiss meg egy dokumentumot
 	Security will be removed when you save	A védelem mentéskor megszűnik
 	Click text or an image to edit it	Kattints a szövegre vagy egy képre a szerkesztéshez
@@ -1978,18 +1995,22 @@
 	Add folder and subfolders…	Mappa és almappák hozzáadása…
 	Add folder…	Mappa hozzáadása…
 	Add open documents	Megnyitott dokumentumok hozzáadása
-	Add the PDFs to combine	Add hozzá az egyesítendő PDF-eket
+	Add the files to combine	Add hozzá az egyesítendő fájlokat
 	Added more than once	Többször hozzáadva
 	All open documents	Minden megnyitott dokumentum
 	Can't be read: {e}	Nem olvasható: {e}
+	Leave out files that can't be read?	Kihagyod az olvashatatlan fájlokat?
+	These files can't be read, so they won't be in the combined PDF:	Ezek a fájlok nem olvashatók, ezért nem kerülnek bele az egyesített PDF-be:
+	Combine the rest	A többi egyesítése
+	and {n} more	és még {n}
 	Check the pages of {name}: {why}	Ellenőrizd {name} oldalait: {why}
 	Click to sort, drag to move the column. Drag its edge to resize it.	Kattints a rendezéshez, húzd az oszlop áthelyezéséhez. A szélét húzva méretezd.
 	Drag to reorder	Húzás az átrendezéshez
-	Drop PDFs or folders here, or choose them.	Húzz ide PDF-eket vagy mappákat, vagy válaszd ki őket.
+	Drop PDFs, images, text files or folders here, or choose them.	Húzz ide PDF-eket, képeket, szövegfájlokat vagy mappákat, vagy válaszd ki őket.
 	Enter the password that opens it	Add meg a megnyitó jelszót
 	Enter the permissions password to allow combining	Add meg a jogosultsági jelszót az egyesítés engedélyezéséhez
-	Every PDF in the folder	A mappa minden PDF-je
-	Every PDF in the folder and the folders inside it	A mappa és az almappái minden PDF-je
+	Every PDF, image and text file in the folder	A mappa minden PDF-je, képe és szövegfájlja
+	Every PDF, image and text file in the folder and the folders inside it	A mappa és az almappái minden PDF-je, képe és szövegfájlja
 	File name	Fájlnév
 	Files are combined from top to bottom. Leave Pages empty to take every page.	A fájlok fentről lefelé egyesülnek. Hagyd üresen az Oldalak mezőt, ha minden oldalt kérsz.
 	Hide password	Jelszó elrejtése
@@ -2053,8 +2074,8 @@
 	Only continue if you trust this document. An address can carry information from the document, such as what you typed into its form.	Csak akkor folytasd, ha megbízol ebben a dokumentumban. Egy cím adatokat vihet a dokumentumból, például azt, amit az űrlapjába írtál.
 	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Nyomtass egyoldalasan. Tartsd a lapokat sorrendben, vágd el a jeleknél, majd rakd a kötegeket balról jobbra, fentről lefelé egymásra.
 	Unlocked {n} of {m} files	{n} / {m} fájl feloldva
-	No PDFs found in {folder}	Nem található PDF itt: {folder}
-	Added the first {n} PDFs in {folder}	{folder} első {n} PDF-je hozzáadva
+	No PDFs, images or text files found in {folder}	Nem található PDF, kép vagy szövegfájl itt: {folder}
+	Added the first {n} files in {folder}	{folder} első {n} fájlja hozzáadva
 comment menu	Edit	Szerkesztés
 	Undo {action}	{action} visszavonása
 	Redo {action}	{action} megismétlése
@@ -2125,6 +2146,8 @@ action wizard	Start	Indítás
 	Printer properties	Nyomtató tulajdonságai
 	Reset to printer defaults	A nyomtató alapértékeinek visszaállítása
 	This printer offers no settings of its own.	Ennek a nyomtatónak nincsenek saját beállításai.
+	Margins	Margók
+	For page sizes and margins.	Oldalméretekhez és margókhoz.
 	Scroll tabs left	Lapok görgetése balra
 	Scroll tabs right	Lapok görgetése jobbra
 
@@ -2194,3 +2217,31 @@ key	Space	Szóköz
 	Resize panel window	Panelablak átméretezése
 	Tools	Eszközök
 	Inspector	Tulajdonságvizsgáló
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	PDF-oldal: {size}
+	Match page at 100%	Papír illesztése az oldalhoz, 100%
+	PDF scale: {scale}%	PDF-méretarány: {scale}%
+	Printer paper and scaling may differ. Check driver settings.	A nyomtató papírja és méretezése eltérhet. Ellenőrizze az illesztőprogram beállításait.
+	Drawing scale changes. Use Actual size for full-scale plans.	A rajz méretaránya változik. Méretarányos tervekhez használja a Tényleges méret beállítást.
+	Reload documents when their files change on disk	Dokumentumok újratöltése, ha a fájljuk megváltozik a lemezen
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Ez a fájl megváltozott a lemezen. Töltsd újra az új változat megtekintéséhez; a nem mentett módosításaid elvesznek.
+	Reload	Újratöltés
+	Couldn't reload {name}: {e}	{name} újratöltése nem sikerült: {e}
+	Select page {label}	{label}. oldal kijelölése
+	Rotate page {label} counterclockwise	{label}. oldal elforgatása az óramutató járásával ellentétesen
+	Rotate page {label} clockwise	{label}. oldal elforgatása az óramutató járásával megegyezően
+	Delete page {label}	{label}. oldal törlése
+	Mouse wheel scroll speed	Egérgörgő görgetési sebessége
+scroll speed	Slow	Lassú
+scroll speed	Normal	Normál
+scroll speed	Fast	Gyors
+	Enhance camera image	Kamerakép javítása
+	Drag the corners onto the document's edges, then choose Enhance page.	Húzza a sarkokat a dokumentum széleire, majd válassza az Oldal javítása lehetőséget.
+	Enhance page	Oldal javítása
+	Done adding text	Szöveg hozzáadásának befejezése
+	Discard this text (Esc)	Szöveg elvetése (Esc)
+	Clean-up	Tisztítás
+	Original	Eredeti
+	Greyscale	Szürkeárnyalatos
+	Black and white	Fekete-fehér
diff --git a/crates/ui-egui/src/i18n/it.tsv b/crates/ui-egui/src/i18n/it.tsv
index d718ff51..48fe778c 100644
--- a/crates/ui-egui/src/i18n/it.tsv
+++ b/crates/ui-egui/src/i18n/it.tsv
@@ -38,7 +38,7 @@
 	Pin a folder to list its newest PDFs here, such as where your scanner or a synced cloud drive saves them.	Fissa una cartella per elencarne qui i PDF più recenti, ad esempio quella in cui salvano i file lo scanner o un servizio cloud sincronizzato.
 	Unpin	Rimuovi
 	Unpin {folder}	Rimuovi {folder}
-	Looking for PDFs…	Cerco file PDF…
+	Looking for PDFs…	Ricerca di file PDF…
 	This folder isn't available right now. It may have moved, or its drive or cloud sync is offline.	La cartella non è disponibile in questo momento. Potrebbe essere stata spostata, oppure il disco o il servizio cloud che la contiene non è in linea.
 	No PDFs in this folder yet	Ancora nessun PDF in questa cartella
 	Show less	Mostra meno
@@ -70,7 +70,7 @@
 	Copy pages	Copia pagine
 	Cut pages	Taglia pagine
 	Paste pages	Incolla pagine
-	Fit visible	Adatta al visibile
+	Fit visible	Adatta all'area visibile
 	Marquee zoom	Ingrandimento selettivo
 	Take a snapshot	Acquisisci istantanea
 	Column select	Selezione colonna
@@ -107,12 +107,18 @@
 	Open a PDF ({key})	Apri un PDF ({key})
 	Dark gray theme	Tema grigio scuro
 	Light theme	Tema chiaro
+	Appearance mode	Modalità aspetto
+	Light	Chiaro
+	Dark	Scuro
+	Active	Attivo
+	Dark theme	Tema scuro
+	Appearance settings…	Impostazioni aspetto…
 	All tools	Tutti gli strumenti
 	Read	Lettura
 	Convert	Converti
 	E-Sign	Firma elettronica
 	Print ({key})	Stampa ({key})
-	Save (M4)	Salva (M4)
+	Save ({key})	Salva ({key})
 	Document properties ({key})	Proprietà documento ({key})
 	Find tools and commands	Trova strumenti e comandi
 	Fit to height	Adatta all'altezza
@@ -603,21 +609,21 @@
 	Fill Color:	Colore riempimento:
 	No color	Nessun colore
 	Beveled	Smussato
-	Left:	Sinistra:
-	Bottom:	Basso:
+	Left:	Da sinistra:
+	Bottom:	Dal basso:
 	Width:	Larghezza:
 	Height:	Altezza:
 	Points from the page's bottom-left corner.	Punti dall'angolo inferiore sinistro della pagina.
 	Alignment:	Allineamento:
 	Default Value:	Valore predefinito:
 	Multi-line	Multiriga
-	Scroll long text	Scorri testo lungo
-	Allow Rich Text Formatting	Consenti formattazione RTF
+	Scroll long text	Consenti scorrimento del testo lungo
+	Allow Rich Text Formatting	Consenti formattazione avanzata del testo
 	Limit of	Limite di
 	characters	caratteri
 	Field is used for file selection	Campo usato per la selezione di file
 	Check spelling	Controllo ortografico
-	Comb of	Pettine di
+	Comb of	Suddividi in
 	Export Value: {on}	Valore di esportazione: {on}
 	Check box is checked by default	Casella selezionata per impostazione predefinita
 	Button is checked by default	Pulsante selezionato per impostazione predefinita
@@ -766,7 +772,7 @@
 	{verb} Header and Footer	{verb} intestazione e piè di pagina
 	{verb} Watermark	{verb} filigrana
 	{verb} Background	{verb} sfondo
-	Margins (in)	Margini (in)
+	Margins (in)	Margini (pollici)
 	Left Header Text	Testo intestazione a sinistra
 	Center Header Text	Testo intestazione al centro
 	Right Header Text	Testo intestazione a destra
@@ -781,12 +787,13 @@
 	Rotation	Rotazione
 	Appear behind page	Dietro la pagina
 	Appear on top of page	Sopra la pagina
+	Offset from centre	Scostamento dal centro
 	From colour	Da colore
 	Page Range Options	Opzioni intervallo di pagine
 	Preview: page {p} of {n}	Anteprima: pagina {p} di {n}
 	Applies to 1 page	Si applica a 1 pagina
 	Applies to {n} pages	Si applica a {n} pagine
-	Replaces the existing one on those pages.	Sostituisce quello esistente su queste pagine.
+	Replaces the existing one on those pages.	Sostituisce l'elemento esistente su quelle pagine.
 	PDF or image	PDF o immagine
 	No file chosen	Nessun file scelto
 	Page number	Numero di pagina
@@ -798,7 +805,7 @@
 	Visible Rectangle	Rettangolo visibile
 	Invisible Rectangle	Rettangolo invisibile
 	Highlight Style:	Stile di evidenziazione:
-	Invert	Inverti
+	Invert	Inversione
 	Outline	Contorno
 	Inset	Incassato
 	Line Thickness:	Spessore linea:
@@ -836,15 +843,19 @@
 	Country/Region	Paese/area geografica
 	Key Algorithm	Algoritmo della chiave
 	Confirm Password	Conferma password
-	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	Valido 5 anni, per le firme digitali. Gli ID autofirmati di solito non sono considerati attendibili da altri.
+	Valid for 5 years, for digital signatures. Self-signed IDs are usually not trusted by others.	Valido per 5 anni, per le firme digitali. Gli ID autofirmati di solito non sono considerati attendibili da altri.
 	File (.p12, .pfx)	File (.p12, .pfx)
 	Digital ID	ID digitale
 	Browse…	Sfoglia…
-	{verb} as "{name}"	{verb} come "{name}"
+	{verb} as "{name}"	{verb} come “{name}”
 	Certify	Certifica
 	The signature will be invisible.	La firma sarà invisibile.
 	Distinguished name	Nome distinto
 	Labels	Etichette
+	Graphic	Grafica
+	Signer's name	Nome del firmatario
+	Fill & Sign signature	Firma di Compila e firma
+	Choose image…	Scegli immagine…
 	Permitted actions after certifying	Azioni consentite dopo la certificazione
 	No changes allowed	Nessuna modifica consentita
 	Annotations, form fill-in, and digital signatures	Annotazioni, compilazione moduli e firme digitali
@@ -860,7 +871,7 @@
 	Signature is INVALID:	La firma NON È VALIDA:
 	Signature Details	Dettagli firma
 	Reason	Motivo
-	Signing time	Ora della firma
+	Signing time	Data e ora della firma
 	Algorithm	Algoritmo
 	Signer	Firmatario
 	Issued by	Rilasciato da
@@ -921,7 +932,7 @@
 	{kind} Properties	Proprietà {kind}
 	Appearance	Aspetto
 	General	Generale
-	Review History	Cronologia revisione
+	Review History	Cronologia revisioni
 	This comment's appearance can't be changed yet.	L'aspetto di questo commento non può ancora essere modificato.
 	Icon	Icona
 	Thickness	Spessore
@@ -994,7 +1005,7 @@
 	Headings	Titoli
 	Accessibility permission flag	Flag di autorizzazione all'accessibilità
 	Accessibility permission flag is set	Il flag di autorizzazione all'accessibilità è impostato
-	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Le impostazioni di sicurezza devono consentire alle tecnologie assistive di leggere il contenuto ("Abilita l'accesso al testo per i lettori di schermo"). Modifica la protezione del documento per consentirlo.
+	Security settings must allow assistive technology to read the content ("Enable text access for screen reader devices"). Change the document's security to allow it.	Le impostazioni di sicurezza devono consentire alle tecnologie assistive di leggere il contenuto (“Abilita l'accesso al testo per i lettori di schermo per ipovedenti”). Modifica la protezione del documento per consentirlo.
 	Image-only PDF	PDF di sole immagini
 	Document is not image-only PDF	Il documento non è un PDF di sole immagini
 	Pages that are only pictures of text can't be read aloud or searched. Recognize text (OCR) to add a text layer.	Le pagine che sono solo immagini di testo non possono essere lette ad alta voce né ricercate. Riconosci il testo (OCR) per aggiungere un livello di testo.
@@ -1021,7 +1032,7 @@
 	Comments, links and fields must be in the tag tree to be announced. Tag the annotations.	Commenti, collegamenti e campi devono trovarsi nell'albero dei tag per essere annunciati. Aggiungi i tag alle annotazioni.
 	Tab order	Ordine di tabulazione
 	Tab order is consistent with structure order	L'ordine di tabulazione è coerente con l'ordine della struttura
-	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	Le pagine con collegamenti, commenti o campi dovrebbero seguire l'ordine della struttura. La correzione imposta l'ordine di tabulazione di ogni pagina su Usa struttura del documento.
+	Pages with links, comments or fields should tab in structure order. The fix sets each page's tab order to Use Document Structure.	Le pagine con collegamenti, commenti o campi dovrebbero seguire l'ordine della struttura. La correzione imposta l'ordine di tabulazione di ogni pagina su “per struttura del documento”.
 	Character encoding	Codifica dei caratteri
 	Reliable character encoding is provided	È fornita una codifica dei caratteri affidabile
 	Fonts must map their characters to Unicode so text can be read and copied. Fix the fonts or recreate the PDF.	I caratteri devono associare i propri glifi a Unicode perché il testo possa essere letto e copiato. Correggi i caratteri o ricrea il PDF.
@@ -1150,7 +1161,7 @@
 	Page Sizing & Handling	Dimensionamento e gestione pagine
 	Size	Dimensione
 	Poster	Poster
-	Multiple	Multiple
+	Multiple	Più pagine per foglio
 	Booklet	Opuscolo
 	Fit	Adatta
 	Shrink oversized pages	Riduci pagine troppo grandi
@@ -1240,7 +1251,7 @@
 	Add a reply	Aggiungi una risposta
 	Post	Pubblica
 	Page {label}	Pagina {label}
-	{kind} — click to show it on the page	{kind}: fai clic per mostrarlo sulla pagina
+	{kind} — click to show it on the page	{kind}: fai clic per mostrare l'elemento sulla pagina
 	Set status	Imposta stato
 	Copy text	Copia testo
 	Properties…	Proprietà…
@@ -1370,7 +1381,7 @@
 	Style	Stile
 	None (prefix only)	Nessuno (solo prefisso)
 	Prefix	Prefisso
-	Start	Inizio
+	Start	Inizia da
 	Labels: {preview}. Later pages keep their labels.	Etichette: {preview}. Le pagine successive mantengono le loro etichette.
 	Even and Odd Pages	Pagine pari e dispari
 	Even Pages Only	Solo pagine pari
@@ -1379,7 +1390,7 @@
 	Landscape Pages	Pagine orizzontali
 	Portrait Pages	Pagine verticali
 	Duplicate Field	Duplica campo
-	Duplicate "{name}" onto:	Duplica "{name}" su:
+	Duplicate "{name}" onto:	Duplica “{name}” su:
 	1 page selected.	1 pagina selezionata.
 	{n} pages selected.	{n} pagine selezionate.
 	Delete pages after extracting	Elimina le pagine dopo l'estrazione
@@ -1405,7 +1416,7 @@
 	Before each selected page (select pages in Organize)	Prima di ogni pagina selezionata (seleziona le pagine in Organizza)
 	Creates 1 file from {n} pages.	Crea 1 file da {n} pagine.
 	Creates {f} files from {n} pages.	Crea {f} file da {n} pagine.
-	Each file holds as many of the {n} pages as fit.	Ogni file contiene quante più pagine possibile delle {n}.
+	Each file holds as many of the {n} pages as fit.	Ogni file contiene il maggior numero possibile delle {n} pagine.
 	Replace Pages	Sostituisci pagine
 	Original: replace pages	Originale: sostituisci le pagine
 	to	a
@@ -1564,8 +1575,8 @@
 	Couldn't take the snapshot: {e}	Impossibile acquisire l'istantanea: {e}
 	Couldn't recover {name}: {e}	Impossibile recuperare {name}: {e}
 	The document now conforms to {level}; save it to keep the changes	Il documento ora è conforme a {level}; salvalo per mantenere le modifiche
-	Fixed what could be fixed; 1 problem remains	Corretto il correggibile; rimane 1 problema
-	Fixed what could be fixed; {n} problems remain	Corretto il correggibile; rimangono {n} problemi
+	Fixed what could be fixed; 1 problem remains	Problemi risolvibili corretti; rimane 1 problema
+	Fixed what could be fixed; {n} problems remain	Problemi risolvibili corretti; rimangono {n} problemi
 	Custom stamps arrive on the web with file pickers for images	Sul web, i timbri personalizzati arriveranno con i selettori di file per immagini
 	{file} is too large for a stamp (at most {n} MB)	{file} è troppo grande per un timbro (massimo {n} MB)
 	Sent to {printer}	Inviato a {printer}
@@ -1577,7 +1588,7 @@
 	Unlock…	Sblocca…
 	Select a password-protected file first	Seleziona prima un file protetto da password
 	Enter the permissions password to allow combining	Inserisci la password delle autorizzazioni per consentire la combinazione
-	Enter the password that opens it	Inserisci la password che lo apre
+	Enter the password that opens it	Inserisci la password di apertura
 	Unlock {name}	Sblocca {name}
 	Unlock {n} files	Sblocca {n} file
 	The same password is tried on each file.	La stessa password viene provata su ogni file.
@@ -1588,21 +1599,22 @@
 	Unlock	Sblocca
 	Opened, but its security settings don't allow combining. Enter the permissions password.	Aperto, ma le sue impostazioni di sicurezza non consentono la combinazione. Inserisci la password delle autorizzazioni.
 	Unlocked: the combined file won't be password-protected	Sbloccato: il file combinato non sarà protetto da password
-	Unlocked {n} of {m} files	Sbloccati {n} file su {m}
+	Drop PDFs, images, text files or folders here, or choose them.	Trascina qui PDF, immagini, file di testo o cartelle, oppure sceglili.
+	Unlocked {n} of {m} files	File sbloccati: {n} su {m}
 	Drop PDFs or folders here, or choose them.	Trascina qui PDF o cartelle, oppure sceglili.
 	Add folder…	Aggiungi cartella…
 	Add folder and subfolders…	Aggiungi cartella e sottocartelle…
 	More ways to add files	Altri modi per aggiungere file
-	Every PDF in the folder	Tutti i PDF nella cartella
-	Every PDF in the folder and the folders inside it	Tutti i PDF nella cartella e nelle sue sottocartelle
+	Every PDF, image and text file in the folder	Tutti i PDF, le immagini e i file di testo nella cartella
+	Every PDF, image and text file in the folder and the folders inside it	Tutti i PDF, le immagini e i file di testo nella cartella e nelle sue sottocartelle
 	Add folder	Aggiungi cartella
 	Add folder and subfolders	Aggiungi cartella e sottocartelle
-	No PDFs found in {folder}	Nessun PDF trovato in {folder}
-	Added the first {n} PDFs in {folder}	Aggiunti i primi {n} PDF di {folder}
+	No PDFs, images or text files found in {folder}	Nessun PDF, immagine o file di testo trovato in {folder}
+	Added the first {n} files in {folder}	Aggiunti i primi {n} file di {folder}
 	Click to sort, drag to move the column. Drag its edge to resize it.	Fai clic per ordinare, trascina per spostare la colonna. Trascinane il bordo per ridimensionarla.
 	Reset columns	Reimposta colonne
 	Remove {n} files	Rimuovi {n} file
-	{n} selected	{n} selezionati
+	{n} selected	Selezionati: {n}
 	sorted ascending	ordine crescente
 	sorted descending	ordine decrescente
 	Protected: the combined file won't keep its security settings	Protetto: il file combinato non manterrà le impostazioni di sicurezza
@@ -1616,7 +1628,7 @@
 	{n} files need attention	{n} file richiedono attenzione
 	{name} can't be combined: {why}	Impossibile combinare {name}: {why}
 	Check the pages of {name}: {why}	Controlla le pagine di {name}: {why}
-	Add the PDFs to combine	Aggiungi i PDF da combinare
+	Add the files to combine	Aggiungi i file da combinare
 	File name	Nome file
 	Warnings	Avvisi
 	Drag to reorder	Trascina per riordinare
@@ -1629,6 +1641,10 @@
 	Password-protected	Protetto da password
 	Its security settings don't allow copying pages	Le sue impostazioni di sicurezza non consentono di copiare le pagine
 	Can't be read: {e}	Impossibile leggerlo: {e}
+	Leave out files that can't be read?	Escludere i file che non si possono leggere?
+	These files can't be read, so they won't be in the combined PDF:	Questi file non si possono leggere, quindi non saranno nel PDF combinato:
+	Combine the rest	Combina gli altri
+	and {n} more	e altri {n}
 	Includes unsaved changes	Include modifiche non salvate
 	Pages of {name} to combine, e.g. 1-3, 6	Pagine di {name} da combinare, es. 1-3, 6
 	Remove {name}	Rimuovi {name}
@@ -1703,8 +1719,14 @@
 	watermark	filigrana
 	background	sfondo
 	This document isn't password-protected	Questo documento non è protetto da password
-	Only the document's owner can change its security (open it with the permissions password)	Solo il proprietario del documento può modificarne la protezione (aprilo con la password delle autorizzazioni)
+	Enter permissions password…	Inserisci password delle autorizzazioni…
+	Permissions password	Password delle autorizzazioni
+	“{name}” has security restrictions. Enter its permissions password to lift them.	“{name}” ha restrizioni di sicurezza. Inserisci la password delle autorizzazioni per rimuoverle.
+	Restrictions lifted	Restrizioni rimosse
+	Couldn't unlock {name}: {e}	Impossibile sbloccare {name}: {e}
+	This document has no restrictions to lift	Questo documento non ha restrizioni da rimuovere
 	The document's security settings don't allow this change	Le impostazioni di sicurezza del documento non consentono questa modifica
+	The document's security settings don't allow copying text and images	Le impostazioni di sicurezza del documento non consentono di copiare testo e immagini
 	Open a document first	Apri prima un documento
 	Security will be removed when you save	La protezione verrà rimossa al salvataggio
 	Click text or an image to edit it	Fai clic su un testo o un'immagine per modificarlo
@@ -1713,7 +1735,7 @@
 	Drag to draw the area where the signature should appear.	Trascina per disegnare l'area in cui deve comparire la firma.
 	Couldn't fit the visible content: {e}	Impossibile adattare il contenuto visibile: {e}
 	Drag a rectangle around the area to copy	Trascina un rettangolo intorno all'area da copiare
-	Click on the page to add a {tool}, or drag to set its size	{tool}: fai clic sulla pagina per aggiungerlo, oppure trascina per impostarne la dimensione
+	Click on the page to add a {tool}, or drag to set its size	{tool}: fai clic sulla pagina per aggiungere l'elemento, oppure trascina per impostarne la dimensione
 	Drag a rectangle on a page to crop it; double-click a page for Set Page Boxes	Trascina un rettangolo su una pagina per ritagliarla; fai doppio clic su una pagina per Imposta riquadri pagina
 	Keep tool selected: on	Mantieni strumento selezionato: attivo
 	Keep tool selected	Mantieni strumento selezionato
@@ -1738,7 +1760,7 @@
 	This document is secured. Some changes are restricted by its security settings.	Questo documento è protetto. Alcune modifiche sono limitate dalle sue impostazioni di sicurezza.
 	This is a dynamic XFA form, which PdfCraft can't display yet. What you see is the file's placeholder page.	Questo è un modulo XFA dinamico, che PdfCraft non è ancora in grado di visualizzare. Quella che vedi è la pagina segnaposto del file.
 	This form also contains XFA data, which PdfCraft doesn't read yet. You can fill its fields, but Acrobat may show the XFA values instead.	Questo modulo contiene anche dati XFA, che PdfCraft non legge ancora. Puoi compilarne i campi, ma Acrobat potrebbe mostrare invece i valori XFA.
-	This document contains {n} interactive form fields.	Questo documento contiene {n} campi modulo interattivi.
+	This document contains {n} interactive form fields.	Campi modulo interattivi in questo documento: {n}.
 	This file was damaged and has been repaired. Saving keeps the repaired version.	Questo file era danneggiato ed è stato riparato. Il salvataggio mantiene la versione riparata.
 	Dismiss	Ignora
 	Hide field highlights	Nascondi evidenziazione campi
@@ -1809,7 +1831,7 @@
 	List	Elenco
 	Unknown	Sconosciuto
 	The document has no XMP metadata	Il documento non ha metadati XMP
-	The title in the metadata and the document information differ	Il titolo nei metadati e nelle informazioni del documento non coincide
+	The title in the metadata and the document information differ	I titoli nei metadati e nelle informazioni del documento non coincidono
 	The document is encrypted	Il documento è cifrato
 	Device colour is used, but there is no PDF/A output intent	Viene usato un colore dipendente dal dispositivo, ma manca un output intent PDF/A
 	DeviceCMYK is used: it needs a CMYK output intent (not added automatically)	Viene usato DeviceCMYK: richiede un output intent CMYK (non aggiunto automaticamente)
@@ -1969,7 +1991,7 @@
 	Some page content couldn't be read; snapping uses the rest.	Parte del contenuto della pagina non è leggibile; l'aggancio usa il resto.
 	Unsupported measurements	Misure non supportate
 	Label	Etichetta
-	{n} measurements use an unsupported format and are left out.	{n} misure usano un formato non supportato e vengono escluse.
+	{n} measurements use an unsupported format and are left out.	Misure in un formato non supportato, escluse: {n}.
 	This area has too many overlapping paths; intersection snapping is limited.	Quest'area ha troppi tracciati sovrapposti; l'aggancio alle intersezioni è limitato.
 	This measurement needs at least {n} points.	Questa misura richiede almeno {n} punti.
 	Switch to two-page view first to show the cover page	Passa prima alla visualizzazione doppia per mostrare la copertina
@@ -2065,14 +2087,14 @@
 	Basic constraints	Vincoli di base
 	Butt	Piatta
 	Change document properties	Modifica le proprietà del documento
-	Clear Recent Files	Cancella file recenti
+	Clear Recent Files	Svuota elenco recenti
 	Closed arrow	Freccia chiusa
-	Contributors	Collaboratori
+	Contributors	Contributori
 	Couldn't open the printer's preferences: {e}	Impossibile aprire le preferenze della stampante: {e}
-	Couldn't show the file picker. Please try again.	Impossibile mostrare la selezione file. Riprova.
+	Couldn't show the file picker. Please try again.	Impossibile mostrare la finestra di selezione file. Riprova.
 	Date format	Formato data
 	Distribute fields	Distribuisci campi
-	Files are combined in this order. Leave Pages empty to take every page.	I file vengono uniti in quest'ordine. Lascia vuoto Pagine per prendere tutte le pagine.
+	Files are combined in this order. Leave Pages empty to take every page.	I file vengono combinati in quest'ordine. Lascia vuoto Pagine per prendere tutte le pagine.
 	Fill & Sign dates	Date di Compila e firma
 	Flatten Fill & Sign when saving	Appiattisci Compila e firma al salvataggio
 	H / Space (hold)	H / Spazio (tieni premuto)
@@ -2091,7 +2113,7 @@
 	Pattern	Schema
 	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	PdfCraft sta disegnando senza un processore grafico, quindi potrebbe essere lento. Aggiornare il driver grafico può aiutare.
 	Place saved {what}	Posiziona l'elemento salvato: {what}
-	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Stampa solo fronte. Tieni i fogli in ordine, taglia sui segni, poi impila le pile da sinistra a destra, dall'alto in basso.
+	Print single-sided. Keep the sheets in order, cut at the marks, then stack the piles left to right, top to bottom.	Stampa solo fronte. Tieni i fogli in ordine, taglia sui segni, poi sovrapponi le pile da sinistra a destra, dall'alto in basso.
 	Printer properties	Proprietà della stampante
 	Redo {action}	Ripeti {action}
 	Remove from Recent	Rimuovi dai recenti
@@ -2113,25 +2135,25 @@
 	Slash	Barra
 	Smaller pages	Pagine più piccole
 	Squiggly	Ondulata
-	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	Le righe di tabella devono stare direttamente in una tabella o nella sua intestazione, corpo o piè. Correggi i tag della tabella.
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	Le righe di tabella devono stare direttamente in una tabella o nelle sue sezioni di intestazione, corpo o piè di pagina. Correggi i tag della tabella.
 	Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.	Il riconoscimento del testo non è installato: mancano i file dei modelli. Reinstalla PdfCraft o imposta PDFCRAFT_MODELS sulla cartella che li contiene.
 	Text, marks and signatures become part of the page. Other comments stay editable.	Testo, segni e firme diventano parte della pagina. Gli altri commenti restano modificabili.
-	That didn't work: an internal error stopped it ({m}).	Non ha funzionato: un errore interno l'ha interrotto ({m}).
+	That didn't work: an internal error stopped it ({m}).	Operazione non riuscita: un errore interno l'ha interrotta ({m}).
 	The Windows store's digital IDs couldn't be listed: {e}	Impossibile elencare gli ID digitali dell'archivio di Windows: {e}
 	The document changed while you were choosing a file, so nothing was changed.	Il documento è cambiato mentre sceglievi un file, quindi non è stato modificato nulla.
 	The document was closed before it could be saved.	Il documento è stato chiuso prima che potesse essere salvato.
 	The pages were extracted but not deleted, because the document changed while you were choosing a folder.	Le pagine sono state estratte ma non eliminate, perché il documento è cambiato mentre sceglievi una cartella.
 	The printer driver's own settings for this print: paper tray, paper type, finishing and more.	Le impostazioni proprie del driver della stampante per questa stampa: vassoio, tipo di carta, finitura e altro.
-	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	I font standard non possono disegnare «{c}» ({code}). Per ora si possono aggiungere come testo solo caratteri dell'Europa occidentale.
+	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	I caratteri standard non possono disegnare “{c}” ({code}). Per ora si possono aggiungere come testo solo caratteri dell'Europa occidentale.
 	This printer offers no settings of its own.	Questa stampante non offre impostazioni proprie.
 	Today: {date}	Oggi: {date}
 	Undo {action}	Annulla {action}
 	Use {what}	Usa {what}
 	the text recognition models are not installed (reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them)	i modelli di riconoscimento del testo non sono installati (reinstalla PdfCraft o imposta PDFCRAFT_MODELS sulla cartella che li contiene)
 	yyyy or yy year · m or mm month · mmm or mmmm month name · d or dd day · ddd or dddd weekday. H, h, M, s and t are time letters and can't be used on their own: put {escape} before a letter to show it as is.	yyyy o yy anno · m o mm mese · mmm o mmmm nome del mese · d o dd giorno · ddd o dddd giorno della settimana. H, h, M, s e t sono lettere dell'ora e non si possono usare da sole: metti {escape} prima di una lettera per mostrarla così com'è.
-	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	{chars} non si può ancora scrivere nel PDF: il testo di Compila e firma è solo dell'Europa occidentale. Scegli un formato numerico come dd.mm.yyyy.
+	{chars} can't be written into the PDF yet: Fill & Sign text is Western European only. Pick a numeric format such as dd.mm.yyyy.	Non è ancora possibile scrivere {chars} nel PDF: il testo di Compila e firma è solo dell'Europa occidentale. Scegli un formato numerico come dd.mm.yyyy.
 	{who} in this document tried to open an address PdfCraft won't open: {e}.	{who} in questo documento ha provato ad aprire un indirizzo che PdfCraft non apre: {e}.
-	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	{who} in questo documento ha provato ad aprire un indirizzo che PdfCraft non apre: {e}. Dai documenti si aprono solo collegamenti web (http, https) ed e-mail (mailto).
+	{who} in this document tried to open an address PdfCraft won't open: {e}. Only web (http, https) and email (mailto) links open from documents.	{who} in questo documento ha provato ad aprire un indirizzo che PdfCraft non apre: {e}. Dai documenti si aprono solo collegamenti web (http, https) ed email (mailto).
 	Certificate authority	Autorità di certificazione
 	End entity	Entità finale
 action wizard	Start	Avvia
@@ -2143,14 +2165,14 @@ signature pad	Type	Digita
 	Shared Field Properties	Proprietà comuni dei campi
 	{n} fields selected	{n} campi selezionati
 	Mixed	Valori diversi
-	Custom font	Font personalizzato
-	Only checked properties will change. Mixed means the selected fields have different values.	Verranno modificate solo le proprietà selezionate. “Valori diversi” indica che i campi selezionati hanno valori differenti.
-	Shift- or Ctrl/Command-click to select several fields.	Fai clic con Maiusc o Ctrl/Command per selezionare più campi.
-	Font size 0 uses automatic sizing.	La dimensione del font 0 usa il ridimensionamento automatico.
+	Custom font	Carattere personalizzato
+	Only checked properties will change. Mixed means the selected fields have different values.	Verranno modificate solo le proprietà spuntate. “Valori diversi” indica che i campi selezionati hanno valori differenti.
+	Shift- or Ctrl/Command-click to select several fields.	Fai clic con Maiusc o Ctrl/Comando per selezionare più campi.
+	Font size 0 uses automatic sizing.	La dimensione del carattere 0 usa il ridimensionamento automatico.
 	Character limit:	Limite di caratteri:
-	Character limit 0 means no limit. A comb of characters needs a limit.	Un limite di caratteri pari a 0 significa nessun limite. I caratteri in caselle separate richiedono un limite.
+	Character limit 0 means no limit. A comb of characters needs a limit.	Un limite di caratteri pari a 0 significa nessun limite. Le caselle per carattere richiedono un limite.
 	To change locked fields, also set Locked to No.	Per modificare i campi bloccati, imposta anche “Bloccato” su “No”.
-	Comb of characters	Pettine di caratteri
+	Comb of characters	Caselle per carattere
 	The document changed while you were editing field properties.	Il documento è cambiato mentre modificavi le proprietà dei campi.
 	The document is no longer open.	Il documento non è più aperto.
 	The field properties dialog is no longer open.	La finestra delle proprietà dei campi non è più aperta.
@@ -2159,11 +2181,13 @@ signature pad	Type	Digita
 	The field {name} no longer exists.	Il campo {name} non esiste più.
 	A selected field has no widget on any page, so the fields can't be edited together.	Un campo selezionato non ha widget in nessuna pagina, quindi i campi non possono essere modificati insieme.
 	 ({n} at {dpi} dpi, the largest size they can be drawn at)	 ({n} a {dpi} dpi, la dimensione massima a cui si possono disegnare)
+	Margins	Margini
+	For page sizes and margins.	Per formati pagina e margini.
 
 # Multi-object selection and movement (#844)
 @plural	{n} object selected|{n} objects selected	{n} oggetto selezionato|{n} oggetti selezionati
 	Drag the selection to move it. Esc clears the selection.	Trascina la selezione per spostarla. Esc annulla la selezione.
-	Shift-click to select several objects. Drag empty space to select an area.	Maiusc-clic per selezionare più oggetti. Trascina in uno spazio vuoto per selezionare un’area.
+	Shift-click to select several objects. Drag empty space to select an area.	Fai clic con Maiusc per selezionare più oggetti. Trascina in uno spazio vuoto per selezionare un'area.
 	Select at most 1000 objects at a time.	Seleziona al massimo 1000 oggetti alla volta.
 	Finish or discard the text being edited before selecting several objects.	Completa o annulla la modifica del testo prima di selezionare più oggetti.
 	Move object	Sposta oggetto
@@ -2203,3 +2227,31 @@ key	Space	Spazio
 	Panels	Pannelli
 	Resize panels	Ridimensiona pannelli
 	Resize panel window	Ridimensiona finestra pannello
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	Pagina PDF: {size}
+	Match page at 100%	Adatta il foglio alla pagina al 100%
+	PDF scale: {scale}%	Scala PDF: {scale}%
+	Printer paper and scaling may differ. Check driver settings.	Carta e scala della stampante possono differire. Controlla le impostazioni del driver.
+	Drawing scale changes. Use Actual size for full-scale plans.	La scala del disegno cambia. Usa Dimensioni effettive per le planimetrie in scala.
+	Reload documents when their files change on disk	Ricarica i documenti quando i loro file cambiano sul disco
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Questo file è cambiato sul disco. Ricaricalo per vedere la nuova versione; le modifiche non salvate andranno perse.
+	Reload	Ricarica
+	Couldn't reload {name}: {e}	Impossibile ricaricare {name}: {e}
+	Select page {label}	Seleziona pagina {label}
+	Rotate page {label} counterclockwise	Ruota pagina {label} in senso antiorario
+	Rotate page {label} clockwise	Ruota pagina {label} in senso orario
+	Delete page {label}	Elimina pagina {label}
+	Mouse wheel scroll speed	Velocità di scorrimento della rotellina del mouse
+scroll speed	Slow	Lenta
+scroll speed	Normal	Normale
+scroll speed	Fast	Veloce
+	Enhance camera image	Migliora foto della fotocamera
+	Drag the corners onto the document's edges, then choose Enhance page.	Trascina gli angoli sui bordi del documento, poi scegli Migliora la pagina.
+	Enhance page	Migliora la pagina
+	Done adding text	Termina l'aggiunta del testo
+	Discard this text (Esc)	Scarta questo testo (Esc)
+	Clean-up	Pulizia
+	Original	Originale
+	Greyscale	Scala di grigi
+	Black and white	Bianco e nero
diff --git a/crates/ui-egui/src/i18n/ja.tsv b/crates/ui-egui/src/i18n/ja.tsv
index 36dbcaa2..94d10925 100644
--- a/crates/ui-egui/src/i18n/ja.tsv
+++ b/crates/ui-egui/src/i18n/ja.tsv
@@ -110,12 +110,18 @@
 	Open a PDF ({key})	PDF を開く（{key}）
 	Dark gray theme	ダークグレーのテーマ
 	Light theme	ライトテーマ
+	Appearance mode	外観モード
+	Light	ライト
+	Dark	ダーク
+	Active	使用中
+	Dark theme	ダークテーマ
+	Appearance settings…	外観の設定…
 	All tools	すべてのツール
 	Read	閲覧
 	Convert	変換
 	E-Sign	電子署名
 	Print ({key})	印刷（{key}）
-	Save (M4)	保存（M4）
+	Save ({key})	保存（{key}）
 	Document properties ({key})	文書のプロパティ（{key}）
 	Find tools and commands	ツールとコマンドを検索
 	Fit to height	高さに合わせる
@@ -770,7 +776,7 @@
 	{verb} Header and Footer	ヘッダーとフッターを{verb}
 	{verb} Watermark	透かしを{verb}
 	{verb} Background	背景を{verb}
-	Margins (in)	余白（インチ）
+	Margins	余白
 	Left Header Text	左ヘッダーのテキスト
 	Center Header Text	中央ヘッダーのテキスト
 	Right Header Text	右ヘッダーのテキスト
@@ -785,6 +791,7 @@
 	Rotation	回転
 	Appear behind page	ページの背面に表示
 	Appear on top of page	ページの前面に表示
+	Offset from centre	中心からのオフセット
 	From colour	色を指定
 	Page Range Options	ページ範囲のオプション
 	Preview: page {p} of {n}	プレビュー: {n} ページ中 {p} ページ
@@ -849,6 +856,10 @@
 	The signature will be invisible.	署名は非表示になります。
 	Distinguished name	識別名
 	Labels	ラベル
+	Graphic	グラフィック
+	Signer's name	署名者名
+	Fill & Sign signature	入力と署名の署名
+	Choose image…	画像を選択…
 	Permitted actions after certifying	証明後に許可する操作
 	No changes allowed	変更を許可しない
 	Annotations, form fill-in, and digital signatures	注釈、フォーム入力、デジタル署名
@@ -1594,16 +1605,16 @@
 	Opened, but its security settings don't allow combining. Enter the permissions password.	開けましたが、セキュリティ設定により結合が許可されていません。権限パスワードを入力してください。
 	Unlocked: the combined file won't be password-protected	ロック解除済み: 結合後のファイルはパスワードで保護されません
 	Unlocked {n} of {m} files	{m} 個中 {n} 個のファイルのロックを解除しました
-	Drop PDFs or folders here, or choose them.	ここに PDF またはフォルダーをドロップするか、選択してください。
+	Drop PDFs, images, text files or folders here, or choose them.	ここに PDF、画像、テキストファイル、またはフォルダーをドロップするか、選択してください。
 	Add folder…	フォルダーを追加…
 	Add folder and subfolders…	フォルダーとサブフォルダーを追加…
 	More ways to add files	ファイルを追加するその他の方法
-	Every PDF in the folder	フォルダー内のすべての PDF
-	Every PDF in the folder and the folders inside it	フォルダーとその中のフォルダーにあるすべての PDF
+	Every PDF, image and text file in the folder	フォルダー内のすべての PDF、画像、テキストファイル
+	Every PDF, image and text file in the folder and the folders inside it	フォルダーとその中のフォルダーにあるすべての PDF、画像、テキストファイル
 	Add folder	フォルダーを追加
 	Add folder and subfolders	フォルダーとサブフォルダーを追加
-	No PDFs found in {folder}	{folder} に PDF が見つかりません
-	Added the first {n} PDFs in {folder}	{folder} の最初の {n} 個の PDF を追加しました
+	No PDFs, images or text files found in {folder}	{folder} に PDF、画像、テキストファイルが見つかりません
+	Added the first {n} files in {folder}	{folder} の最初の {n} 個のファイルを追加しました
 	Click to sort, drag to move the column. Drag its edge to resize it.	クリックで並べ替え、ドラッグで列を移動します。列の端をドラッグすると幅を変更できます。
 	Reset columns	列をリセット
 	Remove {n} files	{n} 個のファイルを削除
@@ -1621,7 +1632,7 @@
 	{n} files need attention	{n} 個のファイルに問題があります
 	{name} can't be combined: {why}	{name} は結合できません: {why}
 	Check the pages of {name}: {why}	{name} のページ指定を確認してください: {why}
-	Add the PDFs to combine	結合する PDF を追加
+	Add the files to combine	結合するファイルを追加
 	File name	ファイル名
 	Warnings	警告
 	Drag to reorder	ドラッグして並べ替え
@@ -1634,6 +1645,10 @@
 	Password-protected	パスワードで保護されています
 	Its security settings don't allow copying pages	セキュリティ設定によりページのコピーが許可されていません
 	Can't be read: {e}	読み込めません: {e}
+	Leave out files that can't be read?	読み込めないファイルを除外しますか？
+	These files can't be read, so they won't be in the combined PDF:	次のファイルは読み込めないため、結合した PDF には含まれません:
+	Combine the rest	残りを結合
+	and {n} more	ほか {n} 件
 	Includes unsaved changes	未保存の変更を含みます
 	Pages of {name} to combine, e.g. 1-3, 6	結合する {name} のページ（例: 1-3, 6）
 	Remove {name}	{name} を削除
@@ -1709,8 +1724,14 @@
 	watermark	透かし
 	background	背景
 	This document isn't password-protected	この文書はパスワード保護されていません
-	Only the document's owner can change its security (open it with the permissions password)	文書の所有者のみセキュリティを変更できます（権限パスワードで開いてください）
+	Enter permissions password…	権限パスワードを入力…
+	Permissions password	権限パスワード
+	“{name}” has security restrictions. Enter its permissions password to lift them.	「{name}」にはセキュリティの制限があります。制限を解除するには権限パスワードを入力してください。
+	Restrictions lifted	制限を解除しました
+	Couldn't unlock {name}: {e}	{name} のロックを解除できませんでした: {e}
+	This document has no restrictions to lift	この文書には解除する制限がありません
 	The document's security settings don't allow this change	文書のセキュリティ設定により、この変更は許可されていません
+	The document's security settings don't allow copying text and images	文書のセキュリティ設定により、テキストと画像のコピーは許可されていません
 	Open a document first	先に文書を開いてください
 	Security will be removed when you save	セキュリティは保存時に解除されます
 	Click text or an image to edit it	テキストまたは画像をクリックして編集
@@ -1996,6 +2017,7 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	PNG または JPEG 画像を選択してください（最大 4 MiB）。透明度は保持されます。
 	Couldn't import the signature image: {e}	署名画像を読み込めませんでした: {e}
 	Go to page…	ページへ移動…
+	For page sizes and margins.	ページサイズと余白に使います。
 	Reopen the files that were open when PdfCraft last closed	前回 PdfCraft を閉じたときに開いていたファイルを再度開く
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	標準フォントでは「{c}」（{code}）を表示できません。現在、テキストとして追加できるのは西ヨーロッパの文字のみです。
 	Open arrow	開いた矢印
@@ -2196,3 +2218,31 @@ key	Space	スペース
 	Resize panel window	パネルウィンドウのサイズを変更
 	Tools	ツール
 	Inspector	インスペクター
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	PDFページ: {size}
+	Match page at 100%	ページに合わせて100%に設定
+	PDF scale: {scale}%	PDFの倍率: {scale}%
+	Printer paper and scaling may differ. Check driver settings.	プリンターの用紙や倍率は異なる場合があります。ドライバーの設定を確認してください。
+	Drawing scale changes. Use Actual size for full-scale plans.	図面の縮尺が変わります。原寸で印刷するには「実際のサイズ」を使用してください。
+	Reload documents when their files change on disk	ディスク上のファイルが変更されたら文書を再読み込みする
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	このファイルはディスク上で変更されました。再読み込みすると新しいバージョンが表示されますが、未保存の変更は失われます。
+	Reload	再読み込み
+	Couldn't reload {name}: {e}	{name} を再読み込みできませんでした: {e}
+	Select page {label}	ページ {label} を選択
+	Rotate page {label} counterclockwise	ページ {label} を反時計回りに回転
+	Rotate page {label} clockwise	ページ {label} を時計回りに回転
+	Delete page {label}	ページ {label} を削除
+	Mouse wheel scroll speed	マウスホイールのスクロール速度
+scroll speed	Slow	遅い
+scroll speed	Normal	標準
+scroll speed	Fast	速い
+	Enhance camera image	カメラ画像を補正
+	Drag the corners onto the document's edges, then choose Enhance page.	四隅を文書の端までドラッグしてから、「ページを補正」を選択します。
+	Enhance page	ページを補正
+	Done adding text	テキストの追加を完了
+	Discard this text (Esc)	このテキストを破棄（Esc）
+	Clean-up	クリーンアップ
+	Original	オリジナル
+	Greyscale	グレースケール
+	Black and white	白黒
diff --git a/crates/ui-egui/src/i18n/mod.rs b/crates/ui-egui/src/i18n/mod.rs
index f8d76839..447416c3 100644
--- a/crates/ui-egui/src/i18n/mod.rs
+++ b/crates/ui-egui/src/i18n/mod.rs
@@ -406,6 +406,17 @@ pub fn tr(lang: Lang, s: &str) -> &str {
     lang.catalog().plain(s).unwrap_or(s)
 }
 
+/// How the layers below say their own sentences in the current language.
+///
+/// The checker, the preflight profiles and the signature panel hand over a whole English wording
+/// — holes and all — and the document's own words apart from it, so this is all they need of us:
+/// `f.said(&i18n::words)` says the sentence here, and `in_english` says it in English. An unknown
+/// wording comes back as it stands, which is the English, so a catalog that is missing one is a
+/// sentence in English rather than a gap.
+pub fn words(wording: &str) -> String {
+    t(wording).to_owned()
+}
+
 /// Like [`tr`], for an English string that needs a disambiguating `context`.
 pub fn tr_ctx<'a>(lang: Lang, context: &str, s: &'a str) -> &'a str {
     lang.catalog().contextual(context, s).unwrap_or_else(|| tr(lang, s))
@@ -461,9 +472,25 @@ pub fn action_label(text: &str) -> String {
     {
         return fmt(t("Change {key}"), &[("key", t(key))]);
     }
+    if let Some(n) = text.strip_prefix("Delete ").and_then(|rest| rest.strip_suffix(" fields")).and_then(|n| n.parse::<u64>().ok()) {
+        return trn(current(), n, "Delete {n} field", "Delete {n} fields");
+    }
     t(text).to_owned()
 }
 
+/// A history label in the current language, out of the engine's own two parts: the wording is
+/// looked up whole and the document's own word goes into its `{}` afterwards, so a file or field
+/// name is never read as part of the wording. This is exact where [`action_label`] has to guess
+/// from the English text, and is what the engine's own labels go through.
+pub fn edit_label(label: &pdfcraft_engine::Label) -> String {
+    // A batch's wording is only the hole: it carries its name as text, which from below L7 is one
+    // of `BATCH_LABELS` and so is looked up too.
+    if let Some(name) = label.value.as_deref().filter(|_| label.wording == "{batch}") {
+        return t(name).to_owned();
+    }
+    label.said(t(label.wording))
+}
+
 /// A command label such as "Undo Insert pages from a.pdf" in the current language. A catalog
 /// whose word order doesn't put the verb first translates "Undo {action}" and "Redo {action}"
 /// as whole phrases; otherwise the translated verb goes before the action.
@@ -736,7 +763,7 @@ mod tests {
         let error = pdfcraft_engine::ocr::OcrError::NoModels.to_string();
         let notice = "Text recognition isn't installed: its model files are missing. Reinstall PdfCraft, or set PDFCRAFT_MODELS to the folder that holds them.";
         assert!(include_str!("../ocr_ui.rs").contains(notice), "keep in step with ocr_ui.rs");
-        for code in ["bg", "de", "es", "fr", "hu", "ja", "ru", "te", "uk", "zh-hans", "zh-hant"] {
+        for code in ["bg", "cs", "de", "es", "fr", "hu", "ja", "ru", "te", "uk", "zh-hans", "zh-hant"] {
             let lang = Lang::from_code(code).expect("registered");
             assert!(has(lang, notice) && has(lang, &error), "{code}");
         }
@@ -799,7 +826,7 @@ mod tests {
             labels.insert(label.to_string());
         }
         assert!(labels.len() > 20 && labels.contains("Comb of characters"), "the scan found the dialog's labels: {labels:?}");
-        for code in ["bg", "de", "es", "fr", "hu", "it", "ja", "pt-br", "ru", "te", "uk", "zh-hans", "zh-hant"] {
+        for code in ["bg", "cs", "de", "es", "fr", "hu", "it", "ja", "pt-br", "ru", "te", "uk", "zh-hans", "zh-hant"] {
             let lang = Lang::from_code(code).expect("registered");
             let missing: Vec<_> = labels.iter().filter(|l| !has(lang, l)).collect();
             assert!(missing.is_empty(), "{code} lacks Shared Field Properties labels: {missing:#?}");
@@ -1095,6 +1122,57 @@ mod tests {
         }
     }
 
+    /// Spanish says everything the layers below word for themselves: what the accessibility
+    /// checker finds and what its saved report calls things, what the PDF/A verifier reports, what
+    /// a signature's details say and the changes they name, what can be wrong with the pages to
+    /// print, and what an edit is called in the history.
+    ///
+    /// These lists are the whole point of the engine handing the wording over apart from the
+    /// document's own words: a catalog that covers them says those sentences in its own language.
+    /// A sentence missing here is a sentence in English on a Spanish screen.
+    #[test]
+    fn spanish_covers_what_the_engine_says() {
+        let es = Lang::from_code("es").expect("es registered");
+        let lists: [(&str, &[&str]); 8] = [
+            ("accessibility finding", pdfcraft_engine::a11y::WORDINGS),
+            ("accessibility report", pdfcraft_engine::a11y::REPORT_WORDS),
+            ("PDF/A problem", pdfcraft_engine::pdfa::WORDINGS),
+            ("signature detail", pdfcraft_engine::sign::pdf::WORDINGS),
+            ("change after signing", pdfcraft_engine::sign::pdf::kind::ALL),
+            ("pages to print", pdfcraft_engine::print::WORDINGS),
+            ("edit label", pdfcraft_engine::EDIT_LABELS),
+            ("batch label", pdfcraft_engine::BATCH_LABELS),
+        ];
+        for (what, list) in lists {
+            assert!(!list.is_empty(), "no {what} wordings to cover");
+            for wording in list {
+                assert!(has(es, wording), "missing {what}: {wording}");
+            }
+        }
+    }
+
+    /// Each of those sentences keeps its holes when it is said in Spanish, so the document's own
+    /// words still have somewhere to go: a translation that drops `{p}` or `{}` would read as a
+    /// sentence about nothing in particular.
+    #[test]
+    fn spanish_keeps_the_holes_in_what_the_engine_says() {
+        let es = Lang::from_code("es").expect("es registered");
+        let lists: [&[&str]; 4] = [
+            pdfcraft_engine::a11y::WORDINGS,
+            pdfcraft_engine::pdfa::WORDINGS,
+            pdfcraft_engine::sign::pdf::WORDINGS,
+            pdfcraft_engine::print::WORDINGS,
+        ];
+        for wording in lists.into_iter().flatten() {
+            let said = tr(es, wording);
+            // `{}` is one hole; `{name}` holes are named, and each name must survive by itself.
+            assert_eq!(wording.matches("{}").count(), said.matches("{}").count(), "the Spanish of {wording:?} loses a hole: {said:?}");
+            for hole in wording.split('{').skip(1).filter_map(|rest| rest.split_once('}')).map(|(name, _)| name).filter(|n| !n.is_empty()) {
+                assert!(said.contains(&format!("{{{hole}}}")), "the Spanish of {wording:?} loses {{{hole}}}: {said:?}");
+            }
+        }
+    }
+
     #[test]
     fn telugu_is_registered() {
         let te = Lang::from_code("te").expect("te registered");
@@ -1200,13 +1278,38 @@ mod tests {
             assert!(has(cs, menu), "Czech lacks the menu title {menu:?}");
             assert!(has(cs, spec.label), "Czech lacks the {menu} menu label {:?} ({})", spec.label, spec.id);
         }
-        const KEEP_AS_IS: &[&str] = &["OK"];
-        let (entries, _) = parse_entries(cs.0.source, cs.0.plural_forms());
+        // Spelled the same in Czech: product and format names, abbreviations, key caps, words
+        // Czech shares with English, and templates with no English words.
+        const KEEP_AS_IS: &[&str] = &[
+            "OK",
+            "PDF/A…",
+            "Microsoft Word (.docx)",
+            "PostScript / EPS",
+            "Home / End",
+            "JavaScript",
+            "ZIP",
+            "Text",
+            "Index",
+            "Metadata",
+            "Model",
+            "{field}: {e}",
+            "{0}: {1}",
+            "{month} {y}",
+            "+LOC",
+            "−LOC",
+            "ΔLOC",
+            "+Bin",
+            "−Bin",
+        ];
+        let (entries, errors) = parse_entries(cs.0.source, cs.0.plural_forms());
+        assert!(errors.is_empty(), "{errors:?}");
+        // The code joins some labels with a space at either end: keep exactly the source's.
+        let edges = |s: &str| (s.len() - s.trim_start().len(), s.len() - s.trim_end().len());
         for e in &entries {
             let key_cap = e.context == "key" && KEY_CAP_NAMES.contains(&e.source.as_str());
             assert!(e.source != e.translation || KEEP_AS_IS.contains(&e.source.as_str()) || key_cap, "{:?} is untranslated", e.source);
             assert!(!e.translation.contains("..."), "use … rather than three dots: {:?}", e.translation);
-            assert_eq!(e.translation.trim(), e.translation, "stray whitespace: {:?}", e.translation);
+            assert_eq!(edges(&e.translation), edges(&e.source), "stray whitespace: {:?}", e.translation);
         }
         let mut app = crate::PdfCraftApp::default();
         app.set_option("language", "cs").unwrap();
@@ -1217,6 +1320,62 @@ mod tests {
         assert_eq!(restored.language, "cs");
     }
 
+    /// Czech translates every registered command, menu and All tools label.
+    #[test]
+    fn czech_covers_commands_and_catalogue() {
+        let cs = Lang::from_code("cs").expect("cs registered");
+        for command in pdfcraft_engine::commands::COMMANDS {
+            assert!(has(cs, command.label), "missing command: {}", command.label);
+            if let Some(menu) = command.menu {
+                assert!(has(cs, menu), "missing menu: {menu}");
+            }
+        }
+        for group in pdfcraft_engine::catalog::TOOL_GROUPS {
+            assert!(has(cs, group.label), "missing group: {}", group.label);
+            for section in group.sections {
+                assert!(has(cs, section.title), "missing section: {}", section.title);
+                for item in section.items {
+                    assert!(has(cs, item.label), "missing item: {}", item.label);
+                }
+            }
+        }
+    }
+
+    /// Czech translates every `tl!("…")` literal in the UI source.
+    #[test]
+    fn czech_covers_ui_literals() {
+        let cs = Lang::from_code("cs").expect("cs registered");
+        let literals = ui_literals();
+        assert!(literals.len() > 900, "source scan found only {} literals", literals.len());
+        let missing: Vec<_> = literals.iter().filter(|label| !has(cs, label)).collect();
+        assert!(missing.is_empty(), "untranslated Czech UI literals: {missing:#?}");
+    }
+
+    /// Czech counts take three forms (1; 2–4; 0 and 5+), dates use the genitive month after the
+    /// day, and history labels keep captured names.
+    #[test]
+    fn czech_plurals_dates_and_history_labels() {
+        let cs = Lang::from_code("cs").expect("cs registered");
+        assert_eq!(trn(cs, 1, "{n} page", "{n} pages"), "1 stránka");
+        assert_eq!(trn(cs, 3, "{n} page", "{n} pages"), "3 stránky");
+        assert_eq!(trn(cs, 5, "{n} page", "{n} pages"), "5 stránek");
+        assert_eq!(trn(cs, 0, "{n} field", "{n} fields"), "0 polí");
+        assert_eq!(trn(cs, 1, "{n} byte", "{n} bytes"), "1 bajt");
+        assert_eq!(trn(cs, 512, "{n} byte", "{n} bytes"), "512 bajtů");
+        assert_eq!(trn(cs, 3, "{n} image optimized", "{n} images optimized"), "3 obrázky optimalizovány");
+        assert_eq!(tr(cs, "October"), "Říjen");
+        let month = tr_ctx(cs, "calendar date", "October");
+        assert_eq!(fmt(tr(cs, "{month} {day}, {y}"), &[("month", month), ("day", "9"), ("y", "2026")]), "9. října 2026");
+        set_current(cs);
+        assert_eq!(command_label("Undo Insert pages from Zpráva {n}.pdf"), "Zpět: Vložit stránky ze souboru Zpráva {n}.pdf");
+        assert_eq!(command_label("Redo Fill in Kontakt {key}"), "Znovu: Vyplnit Kontakt {key}");
+        assert_eq!(action_label("Change Title"), "Změnit: Název");
+        assert_eq!(action_label("Delete 3 fields"), "Odstranit 3 pole");
+        assert_eq!(action_label("Delete 12 fields"), "Odstranit 12 polí");
+        assert_eq!(fmt(t("{n} pages selected"), &[("n", "3")]), "Vybráno stránek: 3");
+        set_current(Lang::EN);
+    }
+
     #[test]
     fn simplified_chinese_is_registered() {
         let zh = Lang::from_code("zh-hans").expect("zh-hans registered");
@@ -1369,6 +1528,32 @@ mod tests {
         }
     }
 
+    /// Report statuses and rule descriptions must retain their meaning in Taiwan Chinese.
+    #[test]
+    fn traditional_chinese_accessibility_meaning() {
+        use pdfcraft_engine::a11y::{Rule, Status};
+        let zh = Lang::from_code("zh-hant").expect("zh-hant registered");
+        assert_eq!(tr(zh, Status::Passed.label()), "通過");
+        assert_eq!(tr(zh, Status::Failed.label()), "未通過");
+        assert_eq!(tr(zh, Rule::Scripts.description()), "沒有妨礙無障礙操作的指令碼");
+        assert_eq!(tr(zh, Rule::TableRows.name()), "列");
+        assert_eq!(tr(zh, Rule::TableRows.explanation()), "表格列應直接位於表格或其表頭、主體、表尾內。請修正表格標記。");
+        assert_eq!(tr(zh, Rule::TableRegularity.description()), "表格每列的欄數必須相同，每欄的列數也必須相同");
+        assert_eq!(tr(zh, Rule::TableCells.explanation()), "表格儲存格應位於列內。請修正表格標記。");
+        assert_eq!(tr(zh, Rule::TableHeaders.explanation()), "表頭儲存格（TH）讓聽者知道每欄或每列的內容。請標記表頭儲存格。");
+    }
+
+    /// A choice in a form is an item, not a project; field notices preserve user-supplied names.
+    #[test]
+    fn traditional_chinese_form_vocabulary() {
+        let zh = Lang::from_code("zh-hant").expect("zh-hant registered");
+        assert_eq!(tr(zh, "Item:"), "項目：");
+        assert_eq!(tr(zh, "Item List"), "項目清單");
+        assert_eq!(tr(zh, "Sort items"), "排序項目");
+        assert_eq!(tr(zh, "Read Only"), "唯讀");
+        assert_eq!(fmt(tr(zh, "{name} is read-only"), &[("name", "Field{n}")]), "Field{n} 為唯讀");
+    }
+
     #[test]
     fn french_is_registered() {
         let fr = Lang::from_code("fr").expect("fr registered");
diff --git a/crates/ui-egui/src/i18n/pl.tsv b/crates/ui-egui/src/i18n/pl.tsv
index 4d621bd0..093f931d 100644
--- a/crates/ui-egui/src/i18n/pl.tsv
+++ b/crates/ui-egui/src/i18n/pl.tsv
@@ -106,12 +106,18 @@
 	Open a PDF (⌘O)	Otwórz PDF (⌘O)
 	Dark gray theme	Ciemnoszary motyw
 	Light theme	Jasny motyw
+	Appearance mode	Tryb wyglądu
+	Light	Jasny
+	Dark	Ciemny
+	Active	Aktywny
+	Dark theme	Ciemny motyw
+	Appearance settings…	Ustawienia wyglądu…
 	All tools	Wszystkie narzędzia
 	Read	Czytaj
 	Convert	Konwertuj
 	E-Sign	Podpis elektroniczny
 	Print (⌘P)	Drukuj (⌘P)
-	Save (M4)	Zapisz (M4)
+	Save ({key})	Zapisz ({key})
 	Document properties (⌘D)	Właściwości dokumentu (⌘D)
 	Find tools and commands	Znajdź narzędzia i polecenia
 	Fit to height	Dopasuj do wysokości
@@ -844,6 +850,10 @@
 	The signature will be invisible.	Podpis będzie niewidoczny.
 	Distinguished name	Nazwa wyróżniająca
 	Labels	Etykiety
+	Graphic	Grafika
+	Signer's name	Nazwa podpisującego
+	Fill & Sign signature	Podpis z „Wypełnij i podpisz”
+	Choose image…	Wybierz obraz…
 	Permitted actions after certifying	Dozwolone działania po certyfikacji
 	No changes allowed	Zmiany niedozwolone
 	Annotations, form fill-in, and digital signatures	Adnotacje, wypełnianie formularzy i podpisy cyfrowe
@@ -1580,16 +1590,16 @@
 	Opened, but its security settings don't allow combining. Enter the permissions password.	Otwarto, ale ustawienia zabezpieczeń nie zezwalają na łączenie. Wpisz hasło uprawnień.
 	Unlocked: the combined file won't be password-protected	Odblokowano: połączony plik nie będzie chroniony hasłem
 	Unlocked {n} of {m} files	Odblokowano {n} z {m} plików
-	Drop PDFs or folders here, or choose them.	Upuść tutaj pliki PDF lub foldery albo wybierz je.
+	Drop PDFs, images, text files or folders here, or choose them.	Upuść tutaj pliki PDF, obrazy, pliki tekstowe lub foldery albo wybierz je.
 	Add folder…	Dodaj folder…
 	Add folder and subfolders…	Dodaj folder i podfoldery…
 	More ways to add files	Więcej sposobów dodawania plików
-	Every PDF in the folder	Każdy PDF w folderze
-	Every PDF in the folder and the folders inside it	Każdy PDF w folderze i jego podfolderach
+	Every PDF, image and text file in the folder	Każdy PDF, obraz i plik tekstowy w folderze
+	Every PDF, image and text file in the folder and the folders inside it	Każdy PDF, obraz i plik tekstowy w folderze i jego podfolderach
 	Add folder	Dodaj folder
 	Add folder and subfolders	Dodaj folder i podfoldery
-	No PDFs found in {folder}	Nie znaleziono plików PDF w {folder}
-	Added the first {n} PDFs in {folder}	Dodano pierwsze {n} plików PDF z {folder}
+	No PDFs, images or text files found in {folder}	Nie znaleziono plików PDF, obrazów ani plików tekstowych w {folder}
+	Added the first {n} files in {folder}	Dodano pierwsze {n} plików z {folder}
 	Click to sort, drag to move the column. Drag its edge to resize it.	Kliknij, aby sortować; przeciągnij, aby przenieść kolumnę. Przeciągnij jej krawędź, aby zmienić szerokość.
 	Reset columns	Zresetuj kolumny
 	Remove {n} files	Usuń pliki w liczbie {n}
@@ -1607,7 +1617,7 @@
 	{n} files need attention	Liczba plików wymagających uwagi: {n}
 	{name} can't be combined: {why}	Nie można połączyć {name}: {why}
 	Check the pages of {name}: {why}	Sprawdź strony {name}: {why}
-	Add the PDFs to combine	Dodaj pliki PDF do połączenia
+	Add the files to combine	Dodaj pliki do połączenia
 	File name	Nazwa pliku
 	Warnings	Ostrzeżenia
 	Drag to reorder	Przeciągnij, aby zmienić kolejność
@@ -1620,6 +1630,10 @@
 	Password-protected	Chroniony hasłem
 	Its security settings don't allow copying pages	Ustawienia zabezpieczeń nie zezwalają na kopiowanie stron
 	Can't be read: {e}	Nie można odczytać: {e}
+	Leave out files that can't be read?	Pominąć pliki, których nie można odczytać?
+	These files can't be read, so they won't be in the combined PDF:	Tych plików nie można odczytać, więc nie znajdą się w połączonym pliku PDF:
+	Combine the rest	Połącz pozostałe
+	and {n} more	i jeszcze {n}
 	Includes unsaved changes	Zawiera niezapisane zmiany
 	Pages of {name} to combine, e.g. 1-3, 6	Strony z {name} do połączenia, np. 1-3, 6
 	Remove {name}	Usuń {name}
@@ -1695,7 +1709,12 @@
 	watermark	znak wodny
 	background	tło
 	This document isn't password-protected	Ten dokument nie jest chroniony hasłem
-	Only the document's owner can change its security (open it with the permissions password)	Tylko właściciel dokumentu może zmienić zabezpieczenia (otwórz go przy użyciu hasła uprawnień)
+	Enter permissions password…	Wpisz hasło uprawnień…
+	Permissions password	Hasło uprawnień
+	“{name}” has security restrictions. Enter its permissions password to lift them.	Plik „{name}” ma ograniczenia zabezpieczeń. Wpisz jego hasło uprawnień, aby je znieść.
+	Restrictions lifted	Ograniczenia zniesione
+	Couldn't unlock {name}: {e}	Nie udało się odblokować pliku {name}: {e}
+	This document has no restrictions to lift	Ten dokument nie ma ograniczeń do zniesienia
 	The document's security settings don't allow this change	Ustawienia zabezpieczeń dokumentu nie zezwalają na tę zmianę
 	Open a document first	Najpierw otwórz dokument
 	Security will be removed when you save	Zabezpieczenia zostaną usunięte przy zapisie
@@ -2191,3 +2210,22 @@ key	Space	Spacja
 	Text used as a clipping path cannot be moved with this selection.	Tekstu używanego jako ścieżka przycinania nie można przenieść razem z tym zaznaczeniem.
 	These objects could not be moved. Select them again and try a smaller move.	Nie udało się przenieść tych obiektów. Zaznacz je ponownie i spróbuj mniejszego przesunięcia.
 	This page contains objects that cannot be selected together.	Ta strona zawiera obiekty, których nie można zaznaczyć razem.
+	Reload documents when their files change on disk	Wczytuj ponownie dokumenty, gdy ich pliki zmienią się na dysku
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Ten plik zmienił się na dysku. Wczytaj go ponownie, aby zobaczyć nową wersję; niezapisane zmiany zostaną utracone.
+	Reload	Wczytaj ponownie
+	Couldn't reload {name}: {e}	Nie można ponownie wczytać {name}: {e}
+	Select page {label}	Wybierz stronę {label}
+	Rotate page {label} counterclockwise	Obróć stronę {label} w lewo
+	Rotate page {label} clockwise	Obróć stronę {label} w prawo
+	Delete page {label}	Usuń stronę {label}
+	Mouse wheel scroll speed	Szybkość przewijania kółkiem myszy
+scroll speed	Slow	Wolna
+scroll speed	Normal	Normalna
+scroll speed	Fast	Szybka
+	Enhance camera image	Popraw zdjęcie z aparatu
+	Drag the corners onto the document's edges, then choose Enhance page.	Przeciągnij narożniki na krawędzie dokumentu, a następnie wybierz Popraw stronę.
+	Enhance page	Popraw stronę
+	Clean-up	Oczyszczanie
+	Original	Oryginał
+	Greyscale	Skala szarości
+	Black and white	Czarno-biały
diff --git a/crates/ui-egui/src/i18n/pt-br.tsv b/crates/ui-egui/src/i18n/pt-br.tsv
index 4004bd9d..88b53958 100644
--- a/crates/ui-egui/src/i18n/pt-br.tsv
+++ b/crates/ui-egui/src/i18n/pt-br.tsv
@@ -77,6 +77,8 @@
 	PdfCraft is drawing without a graphics processor, so it may be slow. Updating the graphics driver may help.	O PdfCraft está desenhando sem processador gráfico, por isso pode ficar lento. Atualizar o driver de vídeo pode ajudar.
 	Go to page…	Ir para a página…
 	Reopen the files that were open when PdfCraft last closed	Reabrir os arquivos que estavam abertos quando o PdfCraft foi fechado pela última vez
+	Margins	Margens
+	For page sizes and margins.	Para tamanhos de página e margens.
 	Open	Abrir
 	Open file	Abrir arquivo
 	Home	Início
@@ -423,6 +425,7 @@
 	Rotation	Rotação
 	Appear behind page	Exibir atrás da página
 	Appear on top of page	Exibir sobre a página
+	Offset from centre	Deslocamento a partir do centro
 	From colour	A partir da cor
 	Page Range Options	Opções de intervalo de páginas
 	Preview: page {p} of {n}	Pré-visualização: página {p} de {n}
@@ -486,6 +489,10 @@
 	The signature will be invisible.	A assinatura será invisível.
 	Distinguished name	Nome distinto
 	Labels	Rótulos
+	Graphic	Gráfico
+	Signer's name	Nome do signatário
+	Fill & Sign signature	Assinatura de Preencher e assinar
+	Choose image…	Escolher imagem…
 	Permitted actions after certifying	Ações permitidas após a certificação
 	No changes allowed	Nenhuma alteração permitida
 	Annotations, form fill-in, and digital signatures	Anotações, preenchimento de formulário e assinaturas digitais
@@ -1031,8 +1038,14 @@
 	Open a PDF ({key})	Abrir um PDF ({key})
 	Dark gray theme	Tema cinza escuro
 	Light theme	Tema claro
+	Appearance mode	Modo de aparência
+	Light	Claro
+	Dark	Escuro
+	Active	Ativo
+	Dark theme	Tema escuro
+	Appearance settings…	Configurações de aparência…
 	Print ({key})	Imprimir ({key})
-	Save (M4)	Salvar (M4)
+	Save ({key})	Salvar ({key})
 	Document properties ({key})	Propriedades do documento ({key})
 	Action Wizard…	Assistente de ações…
 	Add Bates numbering…	Adicionar numeração Bates…
@@ -1535,8 +1548,14 @@
 	watermark	marca-d'água
 	background	plano de fundo
 	This document isn't password-protected	Este documento não está protegido por senha
-	Only the document's owner can change its security (open it with the permissions password)	Somente o proprietário do documento pode alterar sua segurança (abra-o com a senha de permissões)
+	Enter permissions password…	Digitar senha de permissões…
+	Permissions password	Senha de permissões
+	“{name}” has security restrictions. Enter its permissions password to lift them.	“{name}” tem restrições de segurança. Digite a senha de permissões para removê-las.
+	Restrictions lifted	Restrições removidas
+	Couldn't unlock {name}: {e}	Não foi possível desbloquear {name}: {e}
+	This document has no restrictions to lift	Este documento não tem restrições a remover
 	The document's security settings don't allow this change	As configurações de segurança do documento não permitem esta alteração
+	The document's security settings don't allow copying text and images	As configurações de segurança do documento não permitem copiar texto e imagens
 	Open a document first	Abra um documento primeiro
 	Security will be removed when you save	A segurança será removida ao salvar
 	Click text or an image to edit it	Clique no texto ou em uma imagem para editá-lo
@@ -1941,14 +1960,14 @@
 	Add open documents	Adicionar documentos abertos
 	All open documents	Todos os documentos abertos
 	No documents are open	Nenhum documento está aberto
-	Add the PDFs to combine	Adicionar os PDFs para combinar
-	Drop PDFs or folders here, or choose them.	Solte PDFs ou pastas aqui, ou escolha-os.
+	Add the files to combine	Adicionar os arquivos para combinar
+	Drop PDFs, images, text files or folders here, or choose them.	Solte PDFs, imagens, arquivos de texto ou pastas aqui, ou escolha-os.
 	Add folder…	Adicionar pasta…
 	More ways to add files	Mais formas de adicionar arquivos
 	Add folder	Adicionar pasta
-	Every PDF in the folder	Todo PDF da pasta
+	Every PDF, image and text file in the folder	Todo PDF, imagem e arquivo de texto da pasta
 	Add folder and subfolders…	Adicionar pasta e subpastas…
-	Every PDF in the folder and the folders inside it	Todo PDF da pasta e das pastas dentro dela
+	Every PDF, image and text file in the folder and the folders inside it	Todo PDF, imagem e arquivo de texto da pasta e das pastas dentro dela
 	Add folder and subfolders	Adicionar pasta e subpastas
 	PDF, images and text	PDF, imagens e texto
 	Files are combined from top to bottom. Leave Pages empty to take every page.	Os arquivos são combinados de cima para baixo. Deixe Páginas em branco para incluir todas as páginas.
@@ -1967,6 +1986,10 @@
 	Opened, but its security settings don't allow combining. Enter the permissions password.	Aberto, mas as configurações de segurança dele não permitem combinar. Digite a senha de permissões.
 	Its security settings don't allow copying pages	As configurações de segurança dele não permitem copiar páginas
 	Can't be read: {e}	Não é possível ler: {e}
+	Leave out files that can't be read?	Deixar de fora os arquivos que não podem ser lidos?
+	These files can't be read, so they won't be in the combined PDF:	Estes arquivos não podem ser lidos, então não estarão no PDF combinado:
+	Combine the rest	Combinar os demais
+	and {n} more	e mais {n}
 	Unlocked: the combined file won't be password-protected	Desbloqueado: o arquivo combinado não será protegido por senha
 	Protected: the combined file won't keep its security settings	Protegido: o arquivo combinado não manterá as configurações de segurança
 	Unlock {name}	Desbloquear {name}
@@ -2040,7 +2063,7 @@ action wizard	Start	Iniciar
 	A script	Um script
 	About	Sobre
 	Add {what}	Adicionar {what}
-	Added the first {n} PDFs in {folder}	Adicionados os primeiros {n} PDFs de {folder}
+	Added the first {n} files in {folder}	Adicionados os primeiros {n} arquivos de {folder}
 	Align fields	Alinhar campos
 	Another file dialog is still open. Finish with it first.	Outra janela de arquivos ainda está aberta. Conclua-a primeiro.
 	Basic constraints	Restrições básicas
@@ -2081,7 +2104,7 @@ action wizard	Start	Iniciar
 	Model	Modelo
 	Models	Modelos
 	Name (A–Z)	Nome (A–Z)
-	No PDFs found in {folder}	Nenhum PDF encontrado em {folder}
+	No PDFs, images or text files found in {folder}	Nenhum PDF, imagem ou arquivo de texto encontrado em {folder}
 	None of those files can be made into a PDF; use PDFs, images or .txt files	Nenhum desses arquivos pode virar PDF; use PDFs, imagens ou arquivos .txt
 	Opens the printer driver's preferences. They are saved for every print from this computer; the copies, two-sided, grayscale and paper chosen here still apply.	Abre as preferências do driver da impressora. Elas valem para toda impressão deste computador; as cópias, frente e verso, escala de cinza e papel escolhidos aqui continuam valendo.
 	Optimization cancelled	Otimização cancelada
@@ -2197,3 +2220,43 @@ key	Space	Espaço
 	Resize panel window	Redimensionar janela do painel
 	Tools	Ferramentas
 	Inspector	Inspetor
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	Página PDF: {size}
+	Match page at 100%	Ajustar papel à página a 100%
+	PDF scale: {scale}%	Escala do PDF: {scale}%
+	Printer paper and scaling may differ. Check driver settings.	O papel e a escala da impressora podem variar. Confira as configurações do driver.
+	Drawing scale changes. Use Actual size for full-scale plans.	A escala do desenho muda. Use Tamanho real para plantas em escala.
+	Reload documents when their files change on disk	Recarregar documentos quando os arquivos mudarem no disco
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Este arquivo foi alterado no disco. Recarregue-o para ver a nova versão; suas alterações não salvas serão perdidas.
+	Reload	Recarregar
+	Couldn't reload {name}: {e}	Não foi possível recarregar {name}: {e}
+	Select page {label}	Selecionar página {label}
+	Rotate page {label} counterclockwise	Girar página {label} no sentido anti-horário
+	Rotate page {label} clockwise	Girar página {label} no sentido horário
+	Delete page {label}	Excluir página {label}
+calendar date	January	janeiro
+calendar date	February	fevereiro
+calendar date	March	março
+calendar date	April	abril
+calendar date	May	maio
+calendar date	June	junho
+calendar date	July	julho
+calendar date	August	agosto
+calendar date	September	setembro
+calendar date	October	outubro
+calendar date	November	novembro
+calendar date	December	dezembro
+	Mouse wheel scroll speed	Velocidade de rolagem da roda do mouse
+scroll speed	Slow	Lenta
+scroll speed	Normal	Normal
+scroll speed	Fast	Rápida
+	Enhance camera image	Aprimorar foto da câmera
+	Drag the corners onto the document's edges, then choose Enhance page.	Arraste os cantos até as bordas do documento e escolha Aprimorar página.
+	Enhance page	Aprimorar página
+	Done adding text	Concluir a adição de texto
+	Discard this text (Esc)	Descartar este texto (Esc)
+	Clean-up	Limpeza
+	Original	Original
+	Greyscale	Escala de cinza
+	Black and white	Preto e branco
diff --git a/crates/ui-egui/src/i18n/ru.tsv b/crates/ui-egui/src/i18n/ru.tsv
index 431958f3..947b74b0 100644
--- a/crates/ui-egui/src/i18n/ru.tsv
+++ b/crates/ui-egui/src/i18n/ru.tsv
@@ -104,12 +104,18 @@
 	Open a PDF ({key})	Открыть PDF ({key})
 	Dark gray theme	Тёмно-серая тема
 	Light theme	Светлая тема
+	Appearance mode	Режим оформления
+	Light	Светлое
+	Dark	Тёмное
+	Active	Активно
+	Dark theme	Тёмная тема
+	Appearance settings…	Настройки оформления…
 	All tools	Все инструменты
 	Read	Чтение
 	Convert	Конвертация
 	E-Sign	Электронная подпись
 	Print ({key})	Печать ({key})
-	Save (M4)	Сохранить (M4)
+	Save ({key})	Сохранить ({key})
 	Document properties ({key})	Свойства документа ({key})
 	Find tools and commands	Найти инструменты и команды
 	Fit to height	По высоте
@@ -764,7 +770,7 @@
 	{verb} Header and Footer	{verb} колонтитулы
 	{verb} Watermark	{verb} водяной знак
 	{verb} Background	{verb} фон
-	Margins (in)	Поля (дюймы)
+	Margins	Поля
 	Left Header Text	Текст левого колонтитула
 	Center Header Text	Текст центрального колонтитула
 	Right Header Text	Текст правого колонтитула
@@ -779,6 +785,7 @@
 	Rotation	Поворот
 	Appear behind page	Позади страницы
 	Appear on top of page	Поверх страницы
+	Offset from centre	Смещение от центра
 	From colour	Из цвета
 	Page Range Options	Параметры диапазона страниц
 	Preview: page {p} of {n}	Предпросмотр: стр. {p} из {n}
@@ -843,6 +850,10 @@
 	The signature will be invisible.	Подпись будет невидимой.
 	Distinguished name	Уникальное имя
 	Labels	Метки
+	Graphic	Графика
+	Signer's name	Имя подписывающего
+	Fill & Sign signature	Подпись из «Заполнить и подписать»
+	Choose image…	Выбрать изображение…
 	Permitted actions after certifying	Разрешённые действия после сертификации
 	No changes allowed	Изменения не разрешены
 	Annotations, form fill-in, and digital signatures	Аннотации, заполнение форм и цифровые подписи
@@ -1586,16 +1597,16 @@
 	Opened, but its security settings don't allow combining. Enter the permissions password.	Открыто, но настройки безопасности не разрешают объединение. Введите пароль разрешений.
 	Unlocked: the combined file won't be password-protected	Разблокировано: объединённый файл не будет защищён паролем
 	Unlocked {n} of {m} files	Разблокировано {n} из {m} файлов
-	Drop PDFs or folders here, or choose them.	Перетащите PDF или папки сюда или выберите их.
+	Drop PDFs, images, text files or folders here, or choose them.	Перетащите PDF, изображения, текстовые файлы или папки сюда или выберите их.
 	Add folder…	Добавить папку…
 	Add folder and subfolders…	Добавить папку и вложенные папки…
 	More ways to add files	Больше способов добавить файлы
-	Every PDF in the folder	Каждый PDF в папке
-	Every PDF in the folder and the folders inside it	Каждый PDF в папке и вложенных папках
+	Every PDF, image and text file in the folder	Каждый PDF, изображение и текстовый файл в папке
+	Every PDF, image and text file in the folder and the folders inside it	Каждый PDF, изображение и текстовый файл в папке и вложенных папках
 	Add folder	Добавить папку
 	Add folder and subfolders	Добавить папку и вложенные папки
-	No PDFs found in {folder}	В {folder} не найдено PDF
-	Added the first {n} PDFs in {folder}	Добавлены первые {n} PDF из {folder}
+	No PDFs, images or text files found in {folder}	В {folder} не найдено PDF, изображений или текстовых файлов
+	Added the first {n} files in {folder}	Добавлены первые {n} файлов из {folder}
 	Click to sort, drag to move the column. Drag its edge to resize it.	Щёлкните для сортировки, перетащите, чтобы переместить столбец. Перетащите край, чтобы изменить размер.
 	Reset columns	Сбросить столбцы
 	Remove {n} files	Удалить {n} файлов
@@ -1613,7 +1624,7 @@
 	{n} files need attention	{n} файлов требуют внимания
 	{name} can't be combined: {why}	{name} нельзя объединить: {why}
 	Check the pages of {name}: {why}	Проверьте страницы {name}: {why}
-	Add the PDFs to combine	Добавить PDF для объединения
+	Add the files to combine	Добавить файлы для объединения
 	File name	Имя файла
 	Warnings	Предупреждения
 	Drag to reorder	Перетащить для изменения порядка
@@ -1626,6 +1637,10 @@
 	Password-protected	Защищён паролем
 	Its security settings don't allow copying pages	Его настройки безопасности не разрешают копировать страницы
 	Can't be read: {e}	Нельзя прочитать: {e}
+	Leave out files that can't be read?	Пропустить файлы, которые не удаётся прочитать?
+	These files can't be read, so they won't be in the combined PDF:	Эти файлы не удаётся прочитать, поэтому их не будет в объединённом PDF:
+	Combine the rest	Объединить остальные
+	and {n} more	и ещё {n}
 	Includes unsaved changes	Включает несохранённые изменения
 	Pages of {name} to combine, e.g. 1-3, 6	Страницы {name} для объединения, например 1-3, 6
 	Remove {name}	Удалить {name}
@@ -1699,8 +1714,14 @@
 	watermark	водяной знак
 	background	фон
 	This document isn't password-protected	Этот документ не защищён паролем
-	Only the document's owner can change its security (open it with the permissions password)	Только владелец документа может изменить его безопасность (откройте его с паролем разрешений)
+	Enter permissions password…	Ввести пароль разрешений…
+	Permissions password	Пароль разрешений
+	“{name}” has security restrictions. Enter its permissions password to lift them.	У «{name}» есть ограничения безопасности. Введите пароль разрешений, чтобы снять их.
+	Restrictions lifted	Ограничения сняты
+	Couldn't unlock {name}: {e}	Не удалось разблокировать «{name}»: {e}
+	This document has no restrictions to lift	У этого документа нет ограничений, которые можно снять
 	The document's security settings don't allow this change	Настройки безопасности документа не разрешают это изменение
+	The document's security settings don't allow copying text and images	Настройки безопасности документа не разрешают копировать текст и изображения
 	Open a document first	Сначала откройте документ
 	Security will be removed when you save	Безопасность будет удалена при сохранении
 	Click text or an image to edit it	Щёлкните текст или изображение, чтобы редактировать
@@ -2001,6 +2022,10 @@
 	Default zoom	Масштаб по умолчанию
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	Используется, когда PDF не запрашивает макет или масштаб. Непрерывная прокрутка никогда не привязывается между страницами.
 	Reopen the files that were open when PdfCraft last closed	Повторно открывать файлы, которые были открыты при последнем закрытии PdfCraft
+	Reload documents when their files change on disk	Перезагружать документы при изменении их файлов на диске
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Этот файл был изменён на диске. Перезагрузите его, чтобы увидеть новую версию; несохранённые изменения будут потеряны.
+	Reload	Перезагрузить
+	Couldn't reload {name}: {e}	Не удалось перезагрузить {name}: {e}
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	Выберите изображение PNG или JPEG (до 4 МиБ). Прозрачность сохраняется.
 	Couldn't import the signature image: {e}	Не удалось импортировать изображение подписи: {e}
 
@@ -2023,6 +2048,7 @@
 	Created a PDF from {n} files; left out: {names}	PDF создан из файлов: {n}; пропущены: {names}
 	Created a PDF from the first {n} files	PDF создан из первых файлов: {n}
 	Go to page…	Перейти на страницу…
+	For page sizes and margins.	Для размеров страниц и полей.
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	Стандартные шрифты не могут отобразить «{c}» ({code}). Пока в виде текста можно добавлять только западноевропейские символы.
 	Larger pages	Крупнее страницы
 	Smaller pages	Мельче страницы
@@ -2109,3 +2135,27 @@ key	Space	Пробел
 	Resize panel window	Изменить размер окна панели
 	Tools	Инструменты
 	Inspector	Инспектор
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	Страница PDF: {size}
+	Match page at 100%	Подобрать бумагу, масштаб 100%
+	PDF scale: {scale}%	Масштаб PDF: {scale}%
+	Printer paper and scaling may differ. Check driver settings.	Бумага и масштаб принтера могут отличаться. Проверьте настройки драйвера.
+	Drawing scale changes. Use Actual size for full-scale plans.	Масштаб чертежа изменяется. Для печати в исходном масштабе выберите Фактический размер.
+	Select page {label}	Выбрать страницу {label}
+	Rotate page {label} counterclockwise	Повернуть страницу {label} против часовой стрелки
+	Rotate page {label} clockwise	Повернуть страницу {label} по часовой стрелке
+	Delete page {label}	Удалить страницу {label}
+	Mouse wheel scroll speed	Скорость прокрутки колесом мыши
+scroll speed	Slow	Низкая
+scroll speed	Normal	Обычная
+scroll speed	Fast	Высокая
+	Enhance camera image	Улучшить снимок с камеры
+	Drag the corners onto the document's edges, then choose Enhance page.	Перетащите углы к краям документа, затем выберите «Улучшить страницу».
+	Enhance page	Улучшить страницу
+	Done adding text	Завершить добавление текста
+	Discard this text (Esc)	Отклонить этот текст (Esc)
+	Clean-up	Очистка
+	Original	Оригинал
+	Greyscale	Оттенки серого
+	Black and white	Чёрно-белый
diff --git a/crates/ui-egui/src/i18n/te.tsv b/crates/ui-egui/src/i18n/te.tsv
index 933f8727..001fe1b5 100644
--- a/crates/ui-egui/src/i18n/te.tsv
+++ b/crates/ui-egui/src/i18n/te.tsv
@@ -87,12 +87,18 @@ comment menu	Edit	సవరించు
 	Open a PDF ({key})	PDFను తెరువు ({key})
 	Dark gray theme	ముదురు బూడిద రంగు థీమ్
 	Light theme	లేత థీమ్
+	Appearance mode	రూపం మోడ్
+	Light	లైట్
+	Dark	డార్క్
+	Active	సక్రియం
+	Dark theme	డార్క్ థీమ్
+	Appearance settings…	రూపం సెట్టింగ్‌లు…
 	All tools	అన్ని సాధనాలు
 	Read	చదవడం
 	Convert	మార్పిడి
 	E-Sign	ఇ-సంతకం
 	Print ({key})	ముద్రించు ({key})
-	Save (M4)	సేవ్ చేయి (M4)
+	Save ({key})	సేవ్ చేయి ({key})
 	Document properties ({key})	పత్ర లక్షణాలు ({key})
 	Find tools and commands	సాధనాలను, కమాండ్‌లను కనుగొను
 	Fit to height	ఎత్తుకు సరిపోయేలా
@@ -747,7 +753,7 @@ comment menu	Edit	సవరించు
 	{verb} Header and Footer	హెడర్ మరియు ఫుటర్‌ను {verb}
 	{verb} Watermark	వాటర్‌మార్క్‌ను {verb}
 	{verb} Background	నేపథ్యాన్ని {verb}
-	Margins (in)	మార్జిన్‌లు (in)
+	Margins	మార్జిన్‌లు
 	Left Header Text	ఎడమ హెడర్ టెక్స్ట్
 	Center Header Text	మధ్య హెడర్ టెక్స్ట్
 	Right Header Text	కుడి హెడర్ టెక్స్ట్
@@ -825,6 +831,10 @@ comment menu	Edit	సవరించు
 	The signature will be invisible.	సంతకం కనిపించదు.
 	Distinguished name	విశిష్ట పేరు
 	Labels	లేబుల్‌లు
+	Graphic	గ్రాఫిక్
+	Signer's name	సంతకదారు పేరు
+	Fill & Sign signature	నింపడం & సంతకం సంతకం
+	Choose image…	చిత్రాన్ని ఎంచుకోండి…
 	Permitted actions after certifying	సర్టిఫై చేసిన తర్వాత అనుమతించే చర్యలు
 	No changes allowed	మార్పులు ఏవీ అనుమతించబడవు
 	Annotations, form fill-in, and digital signatures	ఉల్లేఖనలు, ఫారం నింపడం మరియు డిజిటల్ సంతకాలు
@@ -1626,8 +1636,14 @@ action wizard	Start	ప్రారంభించు
 	watermark	వాటర్‌మార్క్
 	background	నేపథ్యం
 	This document isn't password-protected	ఈ పత్రం పాస్‌వర్డ్‌తో రక్షించబడలేదు
-	Only the document's owner can change its security (open it with the permissions password)	పత్రం యజమాని మాత్రమే దాని భద్రతను మార్చగలరు (అనుమతుల పాస్‌వర్డ్‌తో దాన్ని తెరవండి)
+	Enter permissions password…	అనుమతుల పాస్‌వర్డ్‌ను నమోదు చేయి…
+	Permissions password	అనుమతుల పాస్‌వర్డ్
+	“{name}” has security restrictions. Enter its permissions password to lift them.	“{name}”కు భద్రతా పరిమితులు ఉన్నాయి. వాటిని తొలగించడానికి దాని అనుమతుల పాస్‌వర్డ్‌ను నమోదు చేయండి.
+	Restrictions lifted	పరిమితులు తొలగించబడ్డాయి
+	Couldn't unlock {name}: {e}	{name}ను అన్‌లాక్ చేయలేకపోయాము: {e}
+	This document has no restrictions to lift	ఈ పత్రంలో తొలగించాల్సిన పరిమితులు లేవు
 	The document's security settings don't allow this change	పత్రం భద్రతా సెట్టింగ్‌లు ఈ మార్పును అనుమతించవు
+	The document's security settings don't allow copying text and images	పత్రం భద్రతా సెట్టింగ్‌లు టెక్స్ట్, చిత్రాలను కాపీ చేయడాన్ని అనుమతించవు
 	Open a document first	ముందుగా ఒక పత్రాన్ని తెరవండి
 	Security will be removed when you save	మీరు సేవ్ చేసినప్పుడు భద్రత తీసివేయబడుతుంది
 	Click text or an image to edit it	సవరించడానికి టెక్స్ట్ లేదా చిత్రంపై క్లిక్ చేయండి
@@ -1928,6 +1944,10 @@ action wizard	Start	ప్రారంభించు
 	Default zoom	డిఫాల్ట్ జూమ్
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	PDF ఏ లేఅవుట్‌ను గానీ జూమ్‌ను గానీ కోరనప్పుడు ఉపయోగించబడుతుంది. నిరంతర స్క్రోలింగ్ పేజీల మధ్య ఎప్పుడూ స్నాప్ అవ్వదు.
 	Reopen the files that were open when PdfCraft last closed	PdfCraftను చివరిసారి మూసివేసినప్పుడు తెరిచి ఉన్న ఫైల్‌లను మళ్లీ తెరువు
+	Reload documents when their files change on disk	డిస్క్‌లో వాటి ఫైల్‌లు మారినప్పుడు పత్రాలను మళ్లీ లోడ్ చేయి
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	ఈ ఫైల్ డిస్క్‌లో మారింది. కొత్త వెర్షన్‌ను చూడటానికి దాన్ని మళ్లీ లోడ్ చేయండి; సేవ్ చేయని మీ మార్పులు పోతాయి.
+	Reload	మళ్లీ లోడ్ చేయి
+	Couldn't reload {name}: {e}	{name}ను మళ్లీ లోడ్ చేయడం సాధ్యం కాలేదు: {e}
 	About	పరిచయం
 	Contributors	సహకారులు
 	Models	మోడల్‌లు
@@ -1987,16 +2007,16 @@ action wizard	Start	ప్రారంభించు
 	Opened, but its security settings don't allow combining. Enter the permissions password.	తెరవబడింది, కానీ దీని భద్రతా సెట్టింగ్‌లు కలపడాన్ని అనుమతించవు. అనుమతుల పాస్‌వర్డ్‌ను నమోదు చేయండి.
 	Unlocked: the combined file won't be password-protected	అన్‌లాక్ చేయబడింది: కలిపిన ఫైల్ పాస్‌వర్డ్‌తో రక్షించబడదు
 	Unlocked {n} of {m} files	{m} ఫైల్‌లలో అన్‌లాక్ చేయబడినవి: {n}
-	Drop PDFs or folders here, or choose them.	PDFలను లేదా ఫోల్డర్‌లను ఇక్కడ లాగి వదలండి, లేదా వాటిని ఎంచుకోండి.
+	Drop PDFs, images, text files or folders here, or choose them.	PDFలను, చిత్రాలను, టెక్స్ట్ ఫైల్‌లను లేదా ఫోల్డర్‌లను ఇక్కడ లాగి వదలండి, లేదా వాటిని ఎంచుకోండి.
 	Add folder…	ఫోల్డర్‌ను జోడించు…
 	Add folder and subfolders…	ఫోల్డర్‌ను, దాని ఉప ఫోల్డర్‌లను జోడించు…
 	More ways to add files	ఫైల్‌లను జోడించడానికి మరిన్ని మార్గాలు
-	Every PDF in the folder	ఫోల్డర్‌లోని ప్రతి PDF
-	Every PDF in the folder and the folders inside it	ఫోల్డర్‌లోని, దాని లోపలి ఫోల్డర్‌లలోని ప్రతి PDF
+	Every PDF, image and text file in the folder	ఫోల్డర్‌లోని ప్రతి PDF, చిత్రం, టెక్స్ట్ ఫైల్
+	Every PDF, image and text file in the folder and the folders inside it	ఫోల్డర్‌లోని, దాని లోపలి ఫోల్డర్‌లలోని ప్రతి PDF, చిత్రం, టెక్స్ట్ ఫైల్
 	Add folder	ఫోల్డర్‌ను జోడించు
 	Add folder and subfolders	ఫోల్డర్‌ను, దాని ఉప ఫోల్డర్‌లను జోడించు
-	No PDFs found in {folder}	{folder}లో PDFలు ఏవీ కనుగొనబడలేదు
-	Added the first {n} PDFs in {folder}	{folder}లోని మొదటి {n} PDFలు జోడించబడ్డాయి
+	No PDFs, images or text files found in {folder}	{folder}లో PDFలు, చిత్రాలు లేదా టెక్స్ట్ ఫైల్‌లు ఏవీ కనుగొనబడలేదు
+	Added the first {n} files in {folder}	{folder}లోని మొదటి {n} ఫైల్‌లు జోడించబడ్డాయి
 	Click to sort, drag to move the column. Drag its edge to resize it.	క్రమపరచడానికి క్లిక్ చేయండి, నిలువు వరుసను తరలించడానికి లాగండి. పరిమాణం మార్చడానికి దాని అంచును లాగండి.
 	Reset columns	నిలువు వరుసలను రీసెట్ చేయి
 	Remove {n} files	{n} ఫైల్‌లను తీసివేయి
@@ -2014,7 +2034,7 @@ action wizard	Start	ప్రారంభించు
 	{n} files need attention	{n} ఫైల్‌లలో సమస్యలు ఉన్నాయి
 	{name} can't be combined: {why}	{name}ను కలపడం సాధ్యం కాదు: {why}
 	Check the pages of {name}: {why}	{name} పేజీలను తనిఖీ చేయండి: {why}
-	Add the PDFs to combine	కలపాల్సిన PDFలను జోడించండి
+	Add the files to combine	కలపాల్సిన ఫైల్‌లను జోడించండి
 	File name	ఫైల్ పేరు
 	Warnings	హెచ్చరికలు
 	Drag to reorder	క్రమం మార్చడానికి లాగండి
@@ -2027,6 +2047,10 @@ action wizard	Start	ప్రారంభించు
 	Password-protected	పాస్‌వర్డ్‌తో రక్షించబడింది
 	Its security settings don't allow copying pages	దీని భద్రతా సెట్టింగ్‌లు పేజీలను కాపీ చేయడాన్ని అనుమతించవు
 	Can't be read: {e}	చదవడం సాధ్యం కాదు: {e}
+	Leave out files that can't be read?	చదవలేని ఫైల్‌లను వదిలేయాలా?
+	These files can't be read, so they won't be in the combined PDF:	ఈ ఫైల్‌లను చదవలేము, కాబట్టి అవి కలిపిన PDFలో ఉండవు:
+	Combine the rest	మిగిలినవి కలుపు
+	and {n} more	మరియు మరో {n}
 	Includes unsaved changes	సేవ్ చేయని మార్పులు ఉన్నాయి
 	This web address mixes letters from different alphabets, a common way to imitate another site's name.	ఈ వెబ్ చిరునామాలో వేర్వేరు లిపుల అక్షరాలు కలిసి ఉన్నాయి. వేరే సైట్ పేరును అనుకరించడానికి ఇది తరచూ వాడే పద్ధతి.
 	This web address uses letters from another alphabet, which can look like familiar ones.	ఈ వెబ్ చిరునామాలో వేరే లిపి అక్షరాలు ఉన్నాయి. అవి మీకు తెలిసిన అక్షరాల్లాగే కనిపించవచ్చు.
@@ -2039,6 +2063,7 @@ action wizard	Start	ప్రారంభించు
 	Pin folder to Home…	ఫోల్డర్‌ను హోమ్‌కు పిన్ చేయి…
 	No recent files	ఇటీవలి ఫైళ్లు లేవు
 	Go to page…	పేజీకి వెళ్లు…
+	For page sizes and margins.	పేజీ పరిమాణాలు మరియు మార్జిన్‌ల కోసం.
 	Open arrow	తెరిచిన బాణం
 	Closed arrow	మూసిన బాణం
 	Butt	మొండి చివర
@@ -2126,3 +2151,18 @@ key	Space	స్పేస్
 	Resize panel window	ప్యానెల్ విండో పరిమాణం మార్చు
 	Tools	సాధనాలు
 	Inspector	పరిశీలకుడు
+	Select page {label}	{label} పేజీని ఎంచుకోండి
+	Rotate page {label} counterclockwise	{label} పేజీని అపసవ్య దిశలో తిప్పండి
+	Rotate page {label} clockwise	{label} పేజీని సవ్య దిశలో తిప్పండి
+	Delete page {label}	{label} పేజీని తొలగించండి
+	Mouse wheel scroll speed	మౌస్ వీల్ స్క్రోల్ వేగం
+scroll speed	Slow	నెమ్మదిగా
+scroll speed	Normal	సాధారణం
+scroll speed	Fast	వేగంగా
+	Enhance camera image	కెమెరా చిత్రాన్ని మెరుగుపరచు
+	Drag the corners onto the document's edges, then choose Enhance page.	మూలలను పత్రం అంచుల వరకు లాగి, ఆపై పేజీని మెరుగుపరచు ఎంచుకోండి.
+	Enhance page	పేజీని మెరుగుపరచు
+	Clean-up	శుభ్రపరచడం
+	Original	అసలు
+	Greyscale	గ్రేస్కేల్
+	Black and white	నలుపు తెలుపు
diff --git a/crates/ui-egui/src/i18n/uk.tsv b/crates/ui-egui/src/i18n/uk.tsv
index 5c2d8f87..03160ba3 100644
--- a/crates/ui-egui/src/i18n/uk.tsv
+++ b/crates/ui-egui/src/i18n/uk.tsv
@@ -109,12 +109,18 @@
 	Open a PDF ({key})	Відкрити PDF ({key})
 	Dark gray theme	Темно-сіра тема
 	Light theme	Світла тема
+	Appearance mode	Режим вигляду
+	Light	Світлий
+	Dark	Темний
+	Active	Активний
+	Dark theme	Темна тема
+	Appearance settings…	Налаштування вигляду…
 	All tools	Усі інструменти
 	Read	Читання
 	Convert	Перетворення
 	E-Sign	Електронний підпис
 	Print ({key})	Друк ({key})
-	Save (M4)	Зберегти (M4)
+	Save ({key})	Зберегти ({key})
 	Document properties ({key})	Властивості документа ({key})
 	Find tools and commands	Знайти інструменти й команди
 	Fit to height	За висотою
@@ -783,6 +789,7 @@
 	Rotation	Поворот
 	Appear behind page	Позаду сторінки
 	Appear on top of page	Поверх сторінки
+	Offset from centre	Зсув від центру
 	From colour	Із кольору
 	Page Range Options	Параметри діапазону сторінок
 	Preview: page {p} of {n}	Попередній перегляд: сторінка {p} із {n}
@@ -847,6 +854,10 @@
 	The signature will be invisible.	Підпис буде невидимим.
 	Distinguished name	Розпізнавальне ім’я
 	Labels	Позначки
+	Graphic	Графіка
+	Signer's name	Ім’я підписувача
+	Fill & Sign signature	Підпис із «Заповнення й підпис»
+	Choose image…	Вибрати зображення…
 	Permitted actions after certifying	Дозволені дії після засвідчення
 	No changes allowed	Зміни заборонено
 	Annotations, form fill-in, and digital signatures	Коментарі, заповнення форми й цифрові підписи
@@ -1583,16 +1594,16 @@
 	Opened, but its security settings don't allow combining. Enter the permissions password.	Відкрито, але налаштування захисту не дозволяють об’єднання. Введіть пароль дозволів.
 	Unlocked: the combined file won't be password-protected	Розблоковано: об’єднаний файл не буде захищено паролем
 	Unlocked {n} of {m} files	Розблоковано {n} із {m} файлів
-	Drop PDFs or folders here, or choose them.	Перетягніть сюди PDF або теки чи виберіть їх.
+	Drop PDFs, images, text files or folders here, or choose them.	Перетягніть сюди PDF, зображення, текстові файли або теки чи виберіть їх.
 	Add folder…	Додати теку…
 	Add folder and subfolders…	Додати теку й підтеки…
 	More ways to add files	Інші способи додати файли
-	Every PDF in the folder	Усі PDF у теці
-	Every PDF in the folder and the folders inside it	Усі PDF у теці та її підтеках
+	Every PDF, image and text file in the folder	Усі PDF, зображення й текстові файли в теці
+	Every PDF, image and text file in the folder and the folders inside it	Усі PDF, зображення й текстові файли в теці та її підтеках
 	Add folder	Додати теку
 	Add folder and subfolders	Додати теку й підтеки
-	No PDFs found in {folder}	У {folder} не знайдено PDF
-	Added the first {n} PDFs in {folder}	Додано перші {n} PDF із {folder}
+	No PDFs, images or text files found in {folder}	У {folder} не знайдено PDF, зображень або текстових файлів
+	Added the first {n} files in {folder}	Додано перші {n} файлів із {folder}
 	Click to sort, drag to move the column. Drag its edge to resize it.	Клацніть для сортування, перетягніть для переміщення стовпця. Тягніть за його край для зміни розміру.
 	Reset columns	Скинути стовпці
 	Remove {n} files	Видалити файли: {n}
@@ -1610,7 +1621,7 @@
 	{n} files need attention	Файли потребують уваги: {n}
 	{name} can't be combined: {why}	{name} неможливо об’єднати: {why}
 	Check the pages of {name}: {why}	Перевірте сторінки {name}: {why}
-	Add the PDFs to combine	Додайте PDF для об’єднання
+	Add the files to combine	Додайте файли для об’єднання
 	File name	Назва файлу
 	Warnings	Попередження
 	Drag to reorder	Перетягніть для зміни порядку
@@ -1623,6 +1634,10 @@
 	Password-protected	Захищено паролем
 	Its security settings don't allow copying pages	Налаштування захисту не дозволяють копіювати сторінки
 	Can't be read: {e}	Не вдалося прочитати: {e}
+	Leave out files that can't be read?	Пропустити файли, які не вдається прочитати?
+	These files can't be read, so they won't be in the combined PDF:	Ці файли не вдається прочитати, тож їх не буде в об’єднаному PDF:
+	Combine the rest	Об’єднати решту
+	and {n} more	і ще {n}
 	Includes unsaved changes	Містить незбережені зміни
 	Pages of {name} to combine, e.g. 1-3, 6	Сторінки з {name} для об’єднання, наприклад 1-3, 6
 	Remove {name}	Видалити {name}
@@ -1696,8 +1711,14 @@
 	watermark	водяний знак
 	background	тло
 	This document isn't password-protected	Цей документ не захищено паролем
-	Only the document's owner can change its security (open it with the permissions password)	Лише власник документа може змінювати захист (відкрийте з паролем дозволів)
+	Enter permissions password…	Ввести пароль дозволів…
+	Permissions password	Пароль дозволів
+	“{name}” has security restrictions. Enter its permissions password to lift them.	«{name}» має обмеження захисту. Введіть пароль дозволів, щоб зняти їх.
+	Restrictions lifted	Обмеження знято
+	Couldn't unlock {name}: {e}	Не вдалося розблокувати {name}: {e}
+	This document has no restrictions to lift	Цей документ не має обмежень, які можна зняти
 	The document's security settings don't allow this change	Налаштування захисту документа не дозволяють цю зміну
+	The document's security settings don't allow copying text and images	Налаштування захисту документа не дозволяють копіювати текст і зображення
 	Open a document first	Спочатку відкрийте документ
 	Security will be removed when you save	Захист буде знято під час збереження
 	Click text or an image to edit it	Клацніть текст або зображення для редагування
@@ -2149,6 +2170,8 @@ calendar date	December	грудня
 	Printer properties	Властивості принтера
 	Reset to printer defaults	Скинути до налаштувань принтера за замовчуванням
 	This printer offers no settings of its own.	Цей принтер не має власних налаштувань.
+	Margins	Поля
+	For page sizes and margins.	Для розмірів сторінок і полів.
 certificate	Subject	Власник сертифіката
 	Scroll tabs left	Прокрутити вкладки ліворуч
 	Scroll tabs right	Прокрутити вкладки праворуч
@@ -2217,3 +2240,31 @@ key	Space	Пробіл
 	Panels	Панелі
 	Resize panels	Змінити розмір панелей
 	Resize panel window	Змінити розмір вікна панелі
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	Сторінка PDF: {size}
+	Match page at 100%	Підібрати папір, масштаб 100%
+	PDF scale: {scale}%	Масштаб PDF: {scale}%
+	Printer paper and scaling may differ. Check driver settings.	Папір і масштаб принтера можуть відрізнятися. Перевірте налаштування драйвера.
+	Drawing scale changes. Use Actual size for full-scale plans.	Масштаб креслення змінюється. Для друку в початковому масштабі виберіть Фактичний розмір.
+	Reload documents when their files change on disk	Перезавантажувати документи, коли їхні файли змінюються на диску
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	Цей файл змінено на диску. Перезавантажте його, щоб побачити нову версію; незбережені зміни буде втрачено.
+	Reload	Перезавантажити
+	Couldn't reload {name}: {e}	Не вдалося перезавантажити {name}: {e}
+	Select page {label}	Вибрати сторінку {label}
+	Rotate page {label} counterclockwise	Повернути сторінку {label} проти годинникової стрілки
+	Rotate page {label} clockwise	Повернути сторінку {label} за годинниковою стрілкою
+	Delete page {label}	Видалити сторінку {label}
+	Mouse wheel scroll speed	Швидкість прокручування коліщатком миші
+scroll speed	Slow	Повільна
+scroll speed	Normal	Звичайна
+scroll speed	Fast	Швидка
+	Enhance camera image	Поліпшити знімок з камери
+	Drag the corners onto the document's edges, then choose Enhance page.	Перетягніть кути до країв документа, потім виберіть «Поліпшити сторінку».
+	Enhance page	Поліпшити сторінку
+	Done adding text	Завершити додавання тексту
+	Discard this text (Esc)	Відкинути цей текст (Esc)
+	Clean-up	Очищення
+	Original	Оригінал
+	Greyscale	Відтінки сірого
+	Black and white	Чорно-білий
diff --git a/crates/ui-egui/src/i18n/zh-hans.tsv b/crates/ui-egui/src/i18n/zh-hans.tsv
index 6645b973..d649c3b5 100644
--- a/crates/ui-egui/src/i18n/zh-hans.tsv
+++ b/crates/ui-egui/src/i18n/zh-hans.tsv
@@ -462,7 +462,7 @@
 	{verb} Header and Footer	{verb}页眉和页脚
 	{verb} Watermark	{verb}水印
 	{verb} Background	{verb}背景
-	Margins (in)	边距（英寸）
+	Margins	边距
 	Left Header Text	左页眉文本
 	Center Header Text	居中页眉文本
 	Right Header Text	右页眉文本
@@ -477,6 +477,7 @@
 	Rotation	旋转
 	Appear behind page	显示在页面后面
 	Appear on top of page	显示在页面上层
+	Offset from centre	与中心的偏移
 	From colour	使用颜色
 	Page Range Options	页面范围选项
 	Preview: page {p} of {n}	预览：第 {p} 页，共 {n} 页
@@ -541,6 +542,10 @@
 	The signature will be invisible.	签名将不可见。
 	Distinguished name	可分辨名称
 	Labels	标签
+	Graphic	图形
+	Signer's name	签名者姓名
+	Fill & Sign signature	填写与签名中的签名
+	Choose image…	选择图像…
 	Permitted actions after certifying	认证后允许的操作
 	No changes allowed	不允许任何更改
 	Annotations, form fill-in, and digital signatures	注释、填写表单和数字签名
@@ -1096,8 +1101,14 @@
 	Open a PDF ({key})	打开 PDF ({key})
 	Dark gray theme	深灰色主题
 	Light theme	浅色主题
+	Appearance mode	外观模式
+	Light	浅色
+	Dark	深色
+	Active	当前
+	Dark theme	深色主题
+	Appearance settings…	外观设置…
 	Print ({key})	打印 ({key})
-	Save (M4)	保存 (M4)
+	Save ({key})	保存 ({key})
 	Document properties ({key})	文档属性 ({key})
 	Action Wizard…	操作向导…
 	Add Bates numbering…	添加贝茨编号…
@@ -1553,16 +1564,16 @@
 	Opened, but its security settings don't allow combining. Enter the permissions password.	已打开，但其安全设置不允许合并。请输入权限密码。
 	Unlocked: the combined file won't be password-protected	已解锁：合并后的文件将不受密码保护
 	Unlocked {n} of {m} files	已解锁 {m} 个文件中的 {n} 个
-	Drop PDFs or folders here, or choose them.	将 PDF 或文件夹拖放到此处，或选择它们。
+	Drop PDFs, images, text files or folders here, or choose them.	将 PDF、图像、文本文件或文件夹拖放到此处，或选择它们。
 	Add folder…	添加文件夹…
 	Add folder and subfolders…	添加文件夹及子文件夹…
 	More ways to add files	更多添加文件的方式
-	Every PDF in the folder	文件夹中的所有 PDF
-	Every PDF in the folder and the folders inside it	文件夹及其子文件夹中的所有 PDF
+	Every PDF, image and text file in the folder	文件夹中的所有 PDF、图像和文本文件
+	Every PDF, image and text file in the folder and the folders inside it	文件夹及其子文件夹中的所有 PDF、图像和文本文件
 	Add folder	添加文件夹
 	Add folder and subfolders	添加文件夹及子文件夹
-	No PDFs found in {folder}	在 {folder} 中未找到 PDF
-	Added the first {n} PDFs in {folder}	已添加 {folder} 中的前 {n} 个 PDF
+	No PDFs, images or text files found in {folder}	在 {folder} 中未找到 PDF、图像或文本文件
+	Added the first {n} files in {folder}	已添加 {folder} 中的前 {n} 个文件
 	Click to sort, drag to move the column. Drag its edge to resize it.	单击以排序，拖动以移动列。拖动列边缘可调整宽度。
 	Reset columns	重置列
 	Remove {n} files	删除 {n} 个文件
@@ -1580,7 +1591,7 @@
 	{n} files need attention	{n} 个文件需要处理
 	{name} can't be combined: {why}	无法合并 {name}：{why}
 	Check the pages of {name}: {why}	请检查 {name} 的页码：{why}
-	Add the PDFs to combine	添加要合并的 PDF
+	Add the files to combine	添加要合并的文件
 	File name	文件名
 	Warnings	警告
 	Drag to reorder	拖动以重新排序
@@ -1593,6 +1604,10 @@
 	Password-protected	受密码保护
 	Its security settings don't allow copying pages	其安全设置不允许复制页面
 	Can't be read: {e}	无法读取：{e}
+	Leave out files that can't be read?	要排除无法读取的文件吗？
+	These files can't be read, so they won't be in the combined PDF:	这些文件无法读取，因此不会包含在合并后的 PDF 中：
+	Combine the rest	合并其余文件
+	and {n} more	以及另外 {n} 个
 	Includes unsaved changes	包含未保存的更改
 	Pages of {name} to combine, e.g. 1-3, 6	要合并的{name}的页面，例如 1-3、6
 	Remove {name}	删除{name}
@@ -1668,8 +1683,14 @@
 	watermark	水印
 	background	背景
 	This document isn't password-protected	本文档未受密码保护
-	Only the document's owner can change its security (open it with the permissions password)	只有文档所有者才能更改安全性（请使用权限密码打开）
+	Enter permissions password…	输入权限密码…
+	Permissions password	权限密码
+	“{name}” has security restrictions. Enter its permissions password to lift them.	“{name}”有安全限制。请输入其权限密码以解除限制。
+	Restrictions lifted	已解除限制
+	Couldn't unlock {name}: {e}	无法解锁 {name}：{e}
+	This document has no restrictions to lift	此文档没有可解除的限制
 	The document's security settings don't allow this change	文档安全设置不允许此更改
+	The document's security settings don't allow copying text and images	文档安全设置不允许复制文本和图像
 	Open a document first	请先打开文档
 	Security will be removed when you save	保存时将删除安全性设置
 	Click text or an image to edit it	单击文本或图像进行编辑
@@ -2035,6 +2056,10 @@
 	Used when opening PDFs. An explicit launch or control mode takes precedence for the session.	用于打开 PDF 时。如果启动参数或控制通道明确指定了模式，则本次会话优先使用该模式。
 	Used when a PDF doesn't ask for a layout or zoom. Continuous scrolling never snaps between pages.	PDF 未指定布局或缩放时使用。连续滚动时页面不会逐页吸附。
 	Reopen the files that were open when PdfCraft last closed	重新打开上次关闭 PdfCraft 时打开的文件
+	Reload documents when their files change on disk	文件在磁盘上更改时重新加载对应的文档
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	此文件已在磁盘上更改。请重新加载以查看新版本；未保存的更改将会丢失。
+	Reload	重新加载
+	Couldn't reload {name}: {e}	无法重新加载{name}：{e}
 	Write this email?	是否撰写此邮件？
 	{who} in this document wants to open this address in your browser:	此文档中的{who}请求在浏览器中打开以下地址：
 	{who} in this document wants to open your email app with this address:	此文档中的{who}请求打开邮件应用并使用以下地址：
@@ -2074,6 +2099,7 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	选择 PNG 或 JPEG 图像（最大 4 MiB）。透明度会保留。
 	Couldn't import the signature image: {e}	无法导入签名图像：{e}
 	Go to page…	转到页面…
+	For page sizes and margins.	用于页面尺寸和边距。
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	标准字体无法显示“{c}”（{code}）。目前只能添加西欧字符作为文本。
 	Larger pages	放大页面
 	Smaller pages	缩小页面
@@ -2160,3 +2186,27 @@ key	Space	空格
 	Resize panel window	调整面板窗口大小
 	Tools	工具
 	Inspector	检查器
+
+# Architectural print controls (follow-up to #599).
+	PDF page: {size}	PDF 页面：{size}
+	Match page at 100%	匹配页面并设为 100%
+	PDF scale: {scale}%	PDF 缩放：{scale}%
+	Printer paper and scaling may differ. Check driver settings.	打印机纸张和缩放可能不同。请检查驱动程序设置。
+	Drawing scale changes. Use Actual size for full-scale plans.	图纸比例发生变化。按原比例打印图纸时请使用实际大小。
+	Select page {label}	选择页面 {label}
+	Rotate page {label} counterclockwise	逆时针旋转页面 {label}
+	Rotate page {label} clockwise	顺时针旋转页面 {label}
+	Delete page {label}	删除页面 {label}
+	Mouse wheel scroll speed	鼠标滚轮滚动速度
+scroll speed	Slow	慢
+scroll speed	Normal	正常
+scroll speed	Fast	快
+	Enhance camera image	增强相机图像
+	Drag the corners onto the document's edges, then choose Enhance page.	将四个角拖到文档边缘，然后选择“增强页面”。
+	Enhance page	增强页面
+	Done adding text	完成添加文本
+	Discard this text (Esc)	放弃此文本 (Esc)
+	Clean-up	清理
+	Original	原始
+	Greyscale	灰度
+	Black and white	黑白
diff --git a/crates/ui-egui/src/i18n/zh-hant.tsv b/crates/ui-egui/src/i18n/zh-hant.tsv
index 6f4139ae..0e1d0bd5 100644
--- a/crates/ui-egui/src/i18n/zh-hant.tsv
+++ b/crates/ui-egui/src/i18n/zh-hant.tsv
@@ -159,7 +159,7 @@
 	Signature panel	簽名面板
 	{month} {day}, {y}	{month}{day}日，{y}年
 	The document's security settings don't allow filling in form fields	文件安全設定不允許填寫表單欄位
-	{name} is read-only	{name}為只讀
+	{name} is read-only	{name} 為唯讀
 	{name} has no action	{name}沒有動作
 	Previous month	上個月
 	Next month	下個月
@@ -244,7 +244,7 @@
 	This field is locked. Unlock it to change its properties.	此欄位已鎖定。解鎖後可更改其屬性。
 	Tooltip:	提示：
 	Common Properties	常規屬性
-	Read Only	只讀
+	Read Only	唯讀
 	Required	必填
 	Font Size:	字號：
 	Auto	自動
@@ -274,14 +274,14 @@
 	Check box is checked by default	預設選中核取方塊
 	Button is checked by default	預設選中按鈕
 	Buttons with the same name and value are selected in unison	同名同值的按鈕一起選中
-	Item:	專案：
-	Item List	專案列表
+	Item:	項目：
+	Item List	項目清單
 	Up	上移
 	Delete {o}	刪除 {o}
 	Add the choices people pick from.	新增供人選擇的選項。
 	Default:	預設值：
 	(none)	（無）
-	Sort items	排序專案
+	Sort items	排序項目
 	Allow user to enter custom text	允許使用者輸入自定義文字
 	Multiple selection	多選
 	Commit selected value immediately	立即提交所選值
@@ -418,7 +418,7 @@
 	{verb} Header and Footer	{verb}頁首和頁尾
 	{verb} Watermark	{verb}水印
 	{verb} Background	{verb}背景
-	Margins (in)	邊距（英寸）
+	Margins	邊距
 	Left Header Text	左頁首文字
 	Center Header Text	居中頁首文字
 	Right Header Text	右頁首文字
@@ -497,6 +497,10 @@
 	The signature will be invisible.	簽名將不可見。
 	Distinguished name	可分辨名稱
 	Labels	標籤
+	Graphic	圖形
+	Signer's name	簽署者姓名
+	Fill & Sign signature	填寫與簽署中的簽名
+	Choose image…	選擇圖片…
 	Permitted actions after certifying	認證後允許的操作
 	No changes allowed	不允許任何更改
 	Annotations, form fill-in, and digital signatures	註解、填寫表單和數位簽章
@@ -627,8 +631,8 @@
 	Collapse	摺疊
 	Expand	展開
 	{rule} - {status}	{rule} - {status}
-	Passed	透過
-	Failed	未透過
+	Passed	通過
+	Failed	未通過
 	Needs manual check	需要人工檢驗
 	Skipped	已跳過
 	Fix	修復
@@ -684,7 +688,7 @@
 	Page will not cause screen flicker	頁面不會導致螢幕閃爍
 	Animation that flashes can cause seizures. Check scripts and media for flicker.	閃爍的動畫可能導致癲癇發作。請檢驗指令碼和媒體是否存在閃爍。
 	Scripts	指令碼
-	No inaccessible scripts	沒有無障礙指令碼
+	No inaccessible scripts	沒有妨礙無障礙操作的指令碼
 	Timed responses	限時回應
 	Page does not require timed responses	頁面不需要限時回應
 	People may need more time to respond. Check that nothing has a time limit.	人們可能需要更多時間來回應。請檢驗確認沒有時間限制。
@@ -712,14 +716,14 @@
 	Other elements alternate text	其他元素替代文字
 	Other elements that require alternate text	需要替代文字的其他元素
 	Formulas and similar non-text elements need alternate text. Add alternate text to them.	公式及類似非文字元素需要替代文字。請為它們新增替代文字。
-	Rows	行
+	Rows	列
 	TR must be a child of Table, THead, TBody, or TFoot	TR 必須是 Table、THead、TBody 或 TFoot 的子級
-	Table cells belong in a row. Fix the table's tags.	表格儲存格應位於行內。請修復表格標記。
+	Table cells belong in a row. Fix the table's tags.	表格儲存格應位於列內。請修正表格標記。
 	Headers	表頭
 	Tables should have headers	表格應有表頭
-	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	表頭儲存格（TH）告訴聽者每列或每行包含的內容。請標記表頭儲存格。
+	Header cells (TH) tell listeners what each column or row holds. Mark the header cells.	表頭儲存格（TH）讓聽者知道每欄或每列的內容。請標記表頭儲存格。
 	Regularity	規則性
-	Tables must contain the same number of columns in each row and rows in each column	表格每行必須包含相同數量的列，每列必須包含相同數量的行
+	Tables must contain the same number of columns in each row and rows in each column	表格每列的欄數必須相同，每欄的列數也必須相同
 	Irregular tables confuse cell navigation. Give every row the same number of cells (counting spans).	不規則的表格會妨礙儲存格導覽。請讓每一列具有相同數量的儲存格，並計入合併儲存格。
 	Summary	摘要
 	Tables must have a summary	表格必須有摘要
@@ -1045,8 +1049,14 @@
 	Open a PDF ({key})	開啟 PDF（{key}）
 	Dark gray theme	深灰色主題
 	Light theme	淺色主題
+	Appearance mode	外觀模式
+	Light	淺色
+	Dark	深色
+	Active	使用中
+	Dark theme	深色主題
+	Appearance settings…	外觀設定…
 	Print ({key})	列印（{key}）
-	Save (M4)	儲存（M4）
+	Save ({key})	儲存（{key}）
 	Document properties ({key})	文件內容（{key}）
 	Action Wizard…	動作精靈…
 	Add Bates numbering…	新增 Bates 編號…
@@ -1502,16 +1512,16 @@
 	Opened, but its security settings don't allow combining. Enter the permissions password.	已開啟，但其安全性設定不允許合併。請輸入權限密碼。
 	Unlocked: the combined file won't be password-protected	已解除鎖定：合併後的檔案將不受密碼保護
 	Unlocked {n} of {m} files	已解除鎖定 {m} 個檔案中的 {n} 個
-	Drop PDFs or folders here, or choose them.	將 PDF 或資料夾拖放到此處，或選取它們。
+	Drop PDFs, images, text files or folders here, or choose them.	將 PDF、圖片、文字檔案或資料夾拖放到此處，或選取它們。
 	Add folder…	新增資料夾…
 	Add folder and subfolders…	新增資料夾及子資料夾…
 	More ways to add files	更多新增檔案的方式
-	Every PDF in the folder	資料夾中的所有 PDF
-	Every PDF in the folder and the folders inside it	資料夾及其子資料夾中的所有 PDF
+	Every PDF, image and text file in the folder	資料夾中的所有 PDF、圖片和文字檔案
+	Every PDF, image and text file in the folder and the folders inside it	資料夾及其子資料夾中的所有 PDF、圖片和文字檔案
 	Add folder	新增資料夾
 	Add folder and subfolders	新增資料夾及子資料夾
-	No PDFs found in {folder}	在 {folder} 中找不到 PDF
-	Added the first {n} PDFs in {folder}	已新增 {folder} 中的前 {n} 個 PDF
+	No PDFs, images or text files found in {folder}	在 {folder} 中找不到 PDF、圖片或文字檔案
+	Added the first {n} files in {folder}	已新增 {folder} 中的前 {n} 個檔案
 	Click to sort, drag to move the column. Drag its edge to resize it.	按一下以排序，拖曳以移動欄。拖曳欄邊緣可調整寬度。
 	Reset columns	重設欄
 	Remove {n} files	刪除 {n} 個檔案
@@ -1529,7 +1539,7 @@
 	{n} files need attention	{n} 個檔案需要處理
 	{name} can't be combined: {why}	無法合併 {name}：{why}
 	Check the pages of {name}: {why}	請檢查 {name} 的頁碼：{why}
-	Add the PDFs to combine	新增要合併的 PDF
+	Add the files to combine	新增要合併的檔案
 	File name	檔案名稱
 	Warnings	警告
 	Drag to reorder	拖曳以重新排序
@@ -1542,6 +1552,10 @@
 	Password-protected	受密碼保護
 	Its security settings don't allow copying pages	其安全性設定不允許複製頁面
 	Can't be read: {e}	無法讀取：{e}
+	Leave out files that can't be read?	要排除無法讀取的檔案嗎？
+	These files can't be read, so they won't be in the combined PDF:	這些檔案無法讀取，因此不會包含在合併後的 PDF 中：
+	Combine the rest	合併其餘檔案
+	and {n} more	以及另外 {n} 個
 	Includes unsaved changes	包含未儲存的變更
 	Pages of {name} to combine, e.g. 1-3, 6	要合併的{name}的頁面，例如 1-3、6
 	Remove {name}	刪除{name}
@@ -1616,8 +1630,14 @@
 	watermark	水印
 	background	背景
 	This document isn't password-protected	本文件未受密碼保護
-	Only the document's owner can change its security (open it with the permissions password)	只有文件所有者才能更改安全性（請使用許可權密碼開啟）
+	Enter permissions password…	輸入許可權密碼…
+	Permissions password	許可權密碼
+	“{name}” has security restrictions. Enter its permissions password to lift them.	“{name}”有安全限制。請輸入其許可權密碼以解除限制。
+	Restrictions lifted	已解除限制
+	Couldn't unlock {name}: {e}	無法解鎖 {name}：{e}
+	This document has no restrictions to lift	此文件沒有可解除的限制
 	The document's security settings don't allow this change	文件安全設定不允許此更改
+	The document's security settings don't allow copying text and images	文件安全設定不允許複製文字和圖片
 	Open a document first	請先開啟文件
 	Security will be removed when you save	儲存時將刪除安全性設定
 	Click text or an image to edit it	按一下文字或圖片進行編輯
@@ -1988,6 +2008,7 @@
 	Choose a PNG or JPEG image (up to 4 MiB). Transparency is preserved.	選擇 PNG 或 JPEG 圖像（最大 4 MiB）。透明度會保留。
 	Couldn't import the signature image: {e}	無法匯入簽名圖像：{e}
 	Go to page…	轉到頁面…
+	For page sizes and margins.	用於頁面尺寸和邊距。
 	Reopen the files that were open when PdfCraft last closed	重新開啟上次關閉 PdfCraft 時開啟的檔案
 	The standard fonts can't draw “{c}” ({code}). Only Western European characters can be added as text for now.	標準字型無法顯示「{c}」（{code}）。目前只能新增西歐字元作為文字。
 	Open arrow	開口箭頭
@@ -2082,3 +2103,23 @@ key	Space	空格
 	Resize panel window	調整面板視窗大小
 	Tools	工具
 	Inspector	檢查器
+	Reload documents when their files change on disk	檔案在磁碟上變更時重新載入對應的文件
+	This file changed on disk. Reload it to see the new version; your unsaved changes will be lost.	此檔案已在磁碟上變更。請重新載入以查看新版本；未儲存的變更將會遺失。
+	Reload	重新載入
+	Couldn't reload {name}: {e}	無法重新載入{name}：{e}
+	Select page {label}	選取頁面 {label}
+	Rotate page {label} counterclockwise	逆時針旋轉頁面 {label}
+	Rotate page {label} clockwise	順時針旋轉頁面 {label}
+	Delete page {label}	刪除頁面 {label}
+	Mouse wheel scroll speed	滑鼠滾輪捲動速度
+scroll speed	Slow	慢
+scroll speed	Normal	正常
+scroll speed	Fast	快
+	Table rows belong directly in a table or its head, body or foot. Fix the table's tags.	表格列應直接位於表格或其表頭、主體、表尾內。請修正表格標記。
+	Enhance camera image	增強相機影像
+	Drag the corners onto the document's edges, then choose Enhance page.	將四個角拖曳到文件邊緣，然後選擇「增強頁面」。
+	Enhance page	增強頁面
+	Clean-up	清理
+	Original	原始
+	Greyscale	灰階
+	Black and white	黑白
diff --git a/crates/ui-egui/src/icon_data.rs b/crates/ui-egui/src/icon_data.rs
index 7341b577..6e3f26f5 100644
--- a/crates/ui-egui/src/icon_data.rs
+++ b/crates/ui-egui/src/icon_data.rs
@@ -118,6 +118,7 @@ pub static ICONS: &[(&str, &[u8])] = &[
     ("minimize", include_bytes!("../../../assets/icons/minimize.svg")),
     ("minimize-2", include_bytes!("../../../assets/icons/minimize-2.svg")),
     ("minus", include_bytes!("../../../assets/icons/minus.svg")),
+    ("monitor", include_bytes!("../../../assets/icons/monitor.svg")),
     ("moon", include_bytes!("../../../assets/icons/moon.svg")),
     ("mouse-pointer-2", include_bytes!("../../../assets/icons/mouse-pointer-2.svg")),
     ("move", include_bytes!("../../../assets/icons/move.svg")),
diff --git a/crates/ui-egui/src/icons.rs b/crates/ui-egui/src/icons.rs
index 9fcafd1c..7cba05c5 100644
--- a/crates/ui-egui/src/icons.rs
+++ b/crates/ui-egui/src/icons.rs
@@ -75,7 +75,7 @@ mod tests {
 
     #[test]
     fn shared_catalog_preserves_existing_icons_and_fallback_uri() {
-        assert_eq!(ICONS.len(), 185);
+        assert_eq!(ICONS.len(), 186);
         assert!(exists("minimize-2"));
         for (name, original) in ICONS {
             let expected =
diff --git a/crates/ui-egui/src/js_ui.rs b/crates/ui-egui/src/js_ui.rs
index 9f5ffdfa..fb7d64a4 100644
--- a/crates/ui-egui/src/js_ui.rs
+++ b/crates/ui-egui/src/js_ui.rs
@@ -163,7 +163,7 @@ pub(crate) fn console_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens)
     });
     ui.add_space(6.0);
     let input = ui.add(
-        egui::TextEdit::multiline(&mut app.js_console.input)
+        crate::widgets::block(&mut app.js_console.input)
             .code_editor()
             .desired_rows(4)
             .desired_width(f32::INFINITY)
@@ -190,7 +190,7 @@ pub(crate) fn document_js_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
     let mut edit: Option<Edit> = None;
     ui.horizontal(|ui| {
         ui.label(tl!("Script Name:"));
-        ui.add(egui::TextEdit::singleline(&mut app.doc_js.name).desired_width(240.0).id_salt("doc-js-name"));
+        ui.add(crate::widgets::line(&mut app.doc_js.name).desired_width(240.0).id_salt("doc-js-name"));
     });
     ui.add_space(4.0);
     egui::Frame::new().fill(t.hover).corner_radius(egui::CornerRadius::same(6)).inner_margin(egui::Margin::same(8)).show(ui, |ui| {
@@ -208,7 +208,7 @@ pub(crate) fn document_js_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
         });
     });
     ui.add_space(6.0);
-    ui.add(egui::TextEdit::multiline(&mut app.doc_js.script).code_editor().desired_rows(8).desired_width(f32::INFINITY).id_salt("doc-js-script"));
+    ui.add(crate::widgets::block(&mut app.doc_js.script).code_editor().desired_rows(8).desired_width(f32::INFINITY).id_salt("doc-js-script"));
     ui.add_space(8.0);
     let name = app.doc_js.name.trim().to_string();
     let close = match buttons(ui, "Save", &["Close", "Delete"]).as_deref() {
@@ -230,7 +230,7 @@ pub(crate) fn document_js_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
     close
 }
 
-/// Preferences: interface language, identity and JavaScript. Returns `true` to close.
+/// Preferences: interface language and size, appearance, identity and JavaScript. Returns `true` to close.
 pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
     ui.label(egui::RichText::new(tl!("Preferences")).font(theme::semibold(18.0)));
     ui.horizontal(|ui| {
@@ -255,8 +255,10 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
     ui.horizontal(|ui| {
         use crate::ui_scale;
         ui.label(tl!("Interface size"));
-        let auto =
-            crate::i18n::fmt(tl!("Auto ({percent}%)"), &[("percent", &ui_scale::percent(ui_scale::factor(None, app.system_text_scale)).to_string())]);
+        // Auto shows the size it draws at: the display's scale times the system's text scale.
+        let native = ui.ctx().native_pixels_per_point().unwrap_or(1.0);
+        let auto_percent = ui_scale::percent(ui_scale::drawn(None, app.system_text_scale, native));
+        let auto = crate::i18n::fmt(tl!("Auto ({percent}%)"), &[("percent", &auto_percent.to_string())]);
         let selected = app.ui_scale.map_or_else(|| auto.clone(), |f| format!("{}%", ui_scale::percent(f)));
         egui::ComboBox::from_id_salt("interface-size").selected_text(selected).show_ui(ui, |ui| {
             if ui.selectable_value(&mut app.ui_scale, None, auto).clicked() {
@@ -277,6 +279,8 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
             .color(t.text_muted),
     );
     ui.add_space(8.0);
+    crate::appearance::preferences_section(ui, app, t);
+    ui.add_space(8.0);
     ui.label(egui::RichText::new(tl!("Documents and view")).font(theme::semibold(13.0)));
     ui.horizontal(|ui| {
         ui.label(tl!("Default workspace mode"));
@@ -301,6 +305,7 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
         for l in crate::canvas::PageLayout::ORDER {
             ui.radio_value(&mut defaults.layout, l, tl!(l.label()));
         }
+        ui.checkbox(&mut defaults.continuous, tl!("Continuous scrolling"));
     });
     ui.horizontal(|ui| {
         use crate::canvas::Fit;
@@ -319,16 +324,31 @@ pub(crate) fn preferences_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tok
             .small()
             .color(t.text_muted),
     );
+    ui.horizontal(|ui| {
+        ui.label(tl!("Units"));
+        for u in crate::units::Unit::ALL {
+            ui.radio_value(&mut app.units, u, u.label());
+        }
+    });
+    ui.label(egui::RichText::new(tl!("For page sizes and margins.")).small().color(t.text_muted));
     // The web build has no file paths to reopen.
     #[cfg(not(target_arch = "wasm32"))]
     ui.checkbox(&mut app.reopen_last_session, tl!("Reopen the files that were open when PdfCraft last closed"));
+    // The web build has no files on disk to watch.
+    #[cfg(not(target_arch = "wasm32"))]
+    ui.checkbox(&mut app.reload_changed_files, tl!("Reload documents when their files change on disk"));
+    ui.horizontal(|ui| {
+        ui.label(tl!("Mouse wheel scroll speed"));
+        for speed in crate::scroll_speed::ScrollSpeed::ALL {
+            ui.radio_value(&mut app.scroll_speed, speed, tl_ctx!("scroll speed", speed.label()));
+        }
+    });
     ui.add_space(8.0);
     // Identity: the author of new comments (Acrobat: Preferences ▸ Identity).
     ui.label(egui::RichText::new(tl!("Identity")).font(theme::semibold(13.0)));
     ui.horizontal(|ui| {
         let label = ui.label(tl!("Name on new comments"));
-        ui.add(egui::TextEdit::singleline(&mut app.comment_prefs.author).desired_width(220.0).char_limit(crate::MAX_AUTHOR_CHARS))
-            .labelled_by(label.id);
+        ui.add(crate::widgets::line(&mut app.comment_prefs.author).desired_width(220.0).char_limit(crate::MAX_AUTHOR_CHARS)).labelled_by(label.id);
     });
     ui.add_space(8.0);
     ui.label(egui::RichText::new(tl!("Fill & Sign")).font(theme::semibold(13.0)));
diff --git a/crates/ui-egui/src/lib.rs b/crates/ui-egui/src/lib.rs
index 372cf8b8..8b320852 100644
--- a/crates/ui-egui/src/lib.rs
+++ b/crates/ui-egui/src/lib.rs
@@ -24,6 +24,7 @@ macro_rules! tl_ctx {
 
 mod a11y_ui;
 mod actions_ui;
+mod appearance;
 pub mod canvas;
 mod chrome;
 mod combine_grid;
@@ -31,6 +32,7 @@ pub use combine_grid::ThumbState as CombineThumb;
 mod combine_ui;
 pub mod docking;
 pub use combine_ui::{Columns as CombineColumns, CombineView, Lock as CombineLock, SortKey};
+mod camera_ui;
 mod commands;
 mod comment_props;
 pub mod comments;
@@ -63,13 +65,15 @@ mod object_ui;
 pub use create_ui::Clip;
 pub use link_ui::LinkDraft;
 pub use optimize_ui::{OptimizeDraft, OptimizeTab};
-pub use sign_ui::{DigitalIdEntry, SignDraft, SignStep};
+pub use sign_ui::{DigitalIdEntry, SignDraft, SignGraphic, SignStep};
 mod autoscroll;
 mod bidi;
 pub mod bulk_fields;
 mod dialogs;
 mod edit_text_ui;
 mod editing;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod file_watch;
 mod files;
 pub mod fill_sign;
 pub mod folders_ui;
@@ -86,6 +90,7 @@ mod pickers;
 pub mod prepare;
 mod print_ui;
 mod signature_drag;
+pub mod units;
 pub use print_ui::{Handling as PrintHandling, PrintDraft, PrinterSource, Which as PrintWhich, system_printers};
 mod redact_ui;
 pub use redact_ui::{HiddenDraft, PagesDraft as RedactPagesDraft, RedactPrefs, SearchDraft as RedactSearchDraft, SearchMode as RedactSearchMode};
@@ -110,6 +115,7 @@ pub(crate) const MAX_AUTHOR_CHARS: usize = 200;
 pub mod portable;
 mod protect;
 mod recovery;
+pub mod scroll_speed;
 #[cfg(not(target_arch = "wasm32"))]
 mod system_fonts;
 pub mod theme;
@@ -186,6 +192,8 @@ pub enum QuickTool {
     Measure(measure_ui::Tool),
     /// Crop pages by dragging a rectangle.
     Crop,
+    /// Scan & OCR ▸ Enhance ▸ Camera image: drag four corners, then Enhance page.
+    EnhanceCamera,
     /// A Fill & Sign tool.
     Fill(fill_sign::FillTool),
     /// A Prepare a form field tool.
@@ -215,10 +223,23 @@ pub enum QuickTool {
     ColumnSelect,
 }
 
+/// A file dropped on a page grid: its name, and its bytes or, for a file on disk, the path they are
+/// read from when the file's turn to be inserted comes (so a long drop holds one file at a time).
+type GridFile = (String, Result<Vec<u8>, std::path::PathBuf>);
+
+/// Read a file dropped on a page grid (see [`GridFile`]).
+fn read_grid_file((name, source): GridFile) -> Result<(String, Vec<u8>), (String, String)> {
+    let bytes = match source {
+        Ok(bytes) => bytes,
+        Err(path) => std::fs::read(&path).map_err(|e| (name.clone(), e.to_string()))?,
+    };
+    Ok((name, bytes))
+}
+
 /// Files dropped on a document's page grid.
 struct GridDrop {
     doc: pdfcraft_engine::DocId,
-    files: Vec<(String, Vec<u8>)>,
+    files: Vec<GridFile>,
     /// When to stop waiting for the pointer (egui time, seconds).
     deadline: f64,
 }
@@ -368,6 +389,26 @@ pub struct PasswordPrompt {
     /// The bytes are a recovery snapshot: once the document is open it takes the snapshot's
     /// path and recovery entry. Cancelling the prompt drops the association with it (#813).
     recovered: Option<RecoveryMeta>,
+    /// The tool that asked for this file (a tool chosen with no document open): it runs once
+    /// the document is unlocked.
+    then: Option<&'static str>,
+}
+
+/// Asks for the permissions password of an open document whose security restricts it, which
+/// lifts the restrictions (#995). Acrobat asks for it when such a document's security is changed.
+pub struct UnlockPrompt {
+    pub doc: DocId,
+    pub name: String,
+    pub input: String,
+    pub error: Option<String>,
+    /// The command to run once unlocked (Protect using password, Remove security), if any.
+    pub then: Option<&'static str>,
+}
+
+impl UnlockPrompt {
+    pub(crate) fn new(doc: &pdfcraft_engine::Document, then: Option<&'static str>) -> Self {
+        Self { doc: doc.id, name: doc.name.clone(), input: String::new(), error: None, then }
+    }
 }
 
 #[derive(serde::Serialize, serde::Deserialize)]
@@ -392,6 +433,8 @@ pub struct PdfCraftApp {
     /// Documents and view). Continuous scrolling at fit width by default, which never snaps
     /// between pages.
     pub view_defaults: canvas::ViewDefaults,
+    /// The unit page sizes and margins are shown in (Preferences ▸ Documents and view).
+    pub units: units::Unit,
     /// The Preferences ▸ Date format box while it's being edited, or while it holds an invalid
     /// pattern (the session keeps the last valid one).
     pub date_format_draft: Option<String>,
@@ -400,6 +443,10 @@ pub struct PdfCraftApp {
     pub left: LeftPanel,
     pub left_open: bool,
     pub right: Option<RightPanel>,
+    /// The right panel that was open when the user switched to Read mode, which starts with the
+    /// panes closed; leaving Read mode brings it back unless the user opened or closed a pane in
+    /// Read mode meanwhile.
+    right_before_read: Option<RightPanel>,
     /// The user closed the Comments panel, so picking a comment tool leaves it closed until they
     /// open it again (#225). Remembered across restarts.
     pub comments_panel_closed: bool,
@@ -411,10 +458,13 @@ pub struct PdfCraftApp {
     /// Resolved colours, including the current OS theme when following the system.
     pub theme: ThemeKind,
     pub theme_preference: ThemePreference,
-    /// The desktop's light/dark choice, watched while the app runs (Linux has no winit answer).
-    desktop_theme: pdfcraft_platform::desktop_theme::DesktopTheme,
-    /// The last answer [`desktop_theme`] gave, so a frame that asks costs nothing.
-    desktop_dark: Option<bool>,
+    /// The Linux portal is enabled only by the native host, and starts on the first System choice.
+    #[cfg(target_os = "linux")]
+    desktop_theme: Option<pdfcraft_platform::desktop_theme::DesktopTheme>,
+    #[cfg(target_os = "linux")]
+    desktop_theme_enabled: bool,
+    /// How far a mouse-wheel notch scrolls.
+    pub scroll_speed: scroll_speed::ScrollSpeed,
     /// Interface language preference: `auto` (follow the system) or a code from [`i18n::LANGUAGES`].
     pub language: String,
     /// Preferences ▸ Interface size as a factor, or `None` to follow [`Self::system_text_scale`].
@@ -447,12 +497,18 @@ pub struct PdfCraftApp {
     pub last_session: last_session::LastSession,
     /// Quitting closes unsaved tabs one by one: what was open when the quit began.
     quit_session: Option<last_session::LastSession>,
+    /// Preferences: reload a document when its file changes on disk (#431).
+    pub reload_changed_files: bool,
+    /// Open documents' files, watched for changes on disk.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) watch: file_watch::FileWatch,
     /// Folders pinned to Home, and what they held when last listed.
     pub pinned: folders_ui::PinnedFolders,
     pub toast: Option<(String, f64)>,
     /// Whether the macOS title bar is drawn by us (traffic lights over our tab strip).
     pub integrated_titlebar: bool,
     pub password_prompt: Option<PasswordPrompt>,
+    pub unlock_prompt: Option<UnlockPrompt>,
     pub full_screen: bool,
     /// Files delivered asynchronously (web drag-and-drop, web file picker).
     pub inbox: Inbox,
@@ -586,8 +642,8 @@ pub struct PdfCraftApp {
     ctx: Option<egui::Context>,
     styled: bool,
     fonts_ready: bool,
-    /// The installed fonts put the Simplified Chinese faces first (see `theme::font_definitions_for`).
-    fonts_hans: bool,
+    /// The CJK fallback order the installed fonts follow (see `theme::installed_font_definitions`).
+    fonts_cjk: theme::CjkPreference,
     /// The window title last sent to the platform.
     pub window_title: String,
     /// The UI control channel, when enabled (`--control`; off by default).
@@ -613,6 +669,9 @@ pub struct PdfCraftApp {
     pub signature_draft: fill_sign::SigDraft,
     pub(crate) signature_preview: Option<(fill_sign::SavedSig, egui::TextureHandle)>,
     pub(crate) saved_signature_previews: [Option<(fill_sign::SavedSig, egui::TextureHandle)>; 2],
+    /// What visible digital signatures show on their left, and its preview in Sign as.
+    pub sign_graphic: sign_ui::SignGraphic,
+    pub(crate) sign_graphic_preview: Option<(fill_sign::SavedSig, egui::TextureHandle)>,
     #[cfg(target_arch = "wasm32")]
     pub(crate) signature_images: fill_sign::ImageInbox,
     /// The Comment Properties dialog's state.
@@ -679,12 +738,6 @@ impl Default for PdfCraftApp {
     }
 }
 
-/// What the operating system says about light and dark, as "draw dark". `None` means nobody
-/// answered, not a preference, so the caller keeps what it chose.
-fn system_theme(ctx: &egui::Context, desktop_dark: Option<bool>) -> Option<bool> {
-    ctx.system_theme().map(|theme| theme == egui::Theme::Dark).or(desktop_dark)
-}
-
 /// A restored colour: an `[r, g, b]` array of finite numbers, each clamped to 0–1 (restored
 /// settings are untrusted). Anything else (a string, a wrong length, a null or a non-finite
 /// number) is refused whole, so the caller keeps its default.
@@ -713,6 +766,7 @@ impl PdfCraftApp {
             mode: Mode::AllTools,
             default_mode: Mode::AllTools,
             view_defaults: Default::default(),
+            units: Default::default(),
             date_format_draft: None,
             mode_override: None,
             left: LeftPanel::AllTools,
@@ -720,14 +774,18 @@ impl PdfCraftApp {
             pending_panel_reveals: Vec::new(),
             left_open: true,
             right: None,
+            right_before_read: None,
             comments_panel_closed: false,
             quick_tool: QuickTool::Select,
             space_hand: None,
             comment_prefs: Default::default(),
             theme: ThemeKind::Light,
             theme_preference: ThemePreference::Light,
-            desktop_theme: pdfcraft_platform::desktop_theme::DesktopTheme::start(),
-            desktop_dark: None,
+            #[cfg(target_os = "linux")]
+            desktop_theme: None,
+            #[cfg(target_os = "linux")]
+            desktop_theme_enabled: false,
+            scroll_speed: scroll_speed::ScrollSpeed::default(),
             language: i18n::AUTO.to_string(),
             ui_scale: None,
             system_text_scale: 1.0,
@@ -745,10 +803,14 @@ impl PdfCraftApp {
             reopen_last_session: false,
             last_session: Default::default(),
             quit_session: None,
+            reload_changed_files: true,
+            #[cfg(not(target_arch = "wasm32"))]
+            watch: Default::default(),
             pinned: Default::default(),
             toast: None,
             integrated_titlebar: false,
             password_prompt: None,
+            unlock_prompt: None,
             full_screen: false,
             inbox: Default::default(),
             startup_inbox: Default::default(),
@@ -826,7 +888,7 @@ impl PdfCraftApp {
             ctx: None,
             styled: false,
             fonts_ready: false,
-            fonts_hans: false,
+            fonts_cjk: theme::CjkPreference::Default,
             control: None,
             bookmark_rename: None,
             last_opened_url: None,
@@ -841,6 +903,8 @@ impl PdfCraftApp {
             signature_draft: Default::default(),
             signature_preview: None,
             saved_signature_previews: [None, None],
+            sign_graphic: sign_ui::SignGraphic::Name,
+            sign_graphic_preview: None,
             #[cfg(target_arch = "wasm32")]
             signature_images: Default::default(),
             comment_props: None,
@@ -882,12 +946,15 @@ impl PdfCraftApp {
         match v.layout {
             // The view opened in Default page display already.
             L::Default => {}
-            L::SinglePage => view.layout = canvas::PageLayout::Single,
-            L::SinglePageContinuous => view.layout = canvas::PageLayout::Continuous,
-            L::TwoUp | L::TwoUpContinuous => view.layout = canvas::PageLayout::TwoUp,
-            L::TwoUpCoverPage | L::TwoUpContinuousCoverPage => {
-                view.layout = canvas::PageLayout::TwoUp;
-                view.cover = true;
+            L::SinglePage => (view.layout, view.continuous) = (canvas::PageLayout::Single, false),
+            L::SinglePageContinuous => (view.layout, view.continuous) = (canvas::PageLayout::Single, true),
+            L::TwoUp => (view.layout, view.continuous) = (canvas::PageLayout::TwoUp, false),
+            L::TwoUpContinuous => (view.layout, view.continuous) = (canvas::PageLayout::TwoUp, true),
+            L::TwoUpCoverPage => {
+                (view.layout, view.continuous, view.cover) = (canvas::PageLayout::TwoUp, false, true);
+            }
+            L::TwoUpContinuousCoverPage => {
+                (view.layout, view.continuous, view.cover) = (canvas::PageLayout::TwoUp, true, true);
             }
         }
         match v.magnification {
@@ -937,7 +1004,7 @@ impl PdfCraftApp {
             Err(e @ (OpenError::NeedsPassword | OpenError::WrongPassword)) => {
                 let error = matches!(e, OpenError::WrongPassword).then(|| "Incorrect password. Try again.".to_string());
                 self.password_prompt =
-                    Some(PasswordPrompt { name: name.to_string(), path, bytes, input: String::new(), error, activate, recovered: None });
+                    Some(PasswordPrompt { name: name.to_string(), path, bytes, input: String::new(), error, activate, recovered: None, then: None });
                 return Ok(());
             }
             Err(e) => return Err(e.to_string()),
@@ -946,7 +1013,9 @@ impl PdfCraftApp {
         let doc = self.session.get(id).ok_or("the document could not be opened")?;
         let pages = doc.info.pages.len();
         // Acrobat opens straight to the Comments panel when a document has comments.
-        if activate && self.right.is_none() {
+        // Read mode opens with the panes closed; the rail still opens them (#932).
+        let opening_mode = self.mode_override.unwrap_or(self.default_mode);
+        if activate && self.right.is_none() && opening_mode != Mode::Read {
             self.right = if !doc.info.annotations.is_empty() {
                 Some(RightPanel::Comments)
             } else if !doc.info.outline.is_empty() {
@@ -961,6 +1030,13 @@ impl PdfCraftApp {
             self.active = Some(self.views.len() - 1);
         }
         self.apply_initial_view(self.views.len() - 1, &initial);
+        if activate
+            && self.left_open
+            && self.left == LeftPanel::Tool("organize")
+            && let Some(view) = self.views.last_mut()
+        {
+            view.organize = true;
+        }
         if activate && let Some(mode) = self.mode_override {
             // Explicit mode options do not reset independent --tool / --left choices.
             self.mode = mode;
@@ -1017,11 +1093,14 @@ impl PdfCraftApp {
     fn drop_on_grid(&mut self, dropped: Vec<egui::DroppedFileHandle>, ctx: &egui::Context) -> Vec<egui::DroppedFileHandle> {
         let Some(id) = self.grid_target().filter(|_| !dropped.is_empty()) else { return dropped };
         let mut files = Vec::new();
-        for f in dropped.iter().take(pdfcraft_engine::MAX_CREATE_FILES) {
+        for f in &dropped {
             let name = f.path().file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| "dropped.pdf".into());
-            let bytes = if f.path().is_absolute() { std::fs::read(f.path()).map_err(|e| e.to_string()) } else { f.bytes() };
-            match bytes {
-                Ok(b) => files.push((name, b)),
+            if f.path().is_absolute() {
+                files.push((name, Err(f.path().to_path_buf())));
+                continue;
+            }
+            match f.bytes() {
+                Ok(b) => files.push((name, Ok(b))),
                 Err(e) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e)]),
             }
         }
@@ -1051,7 +1130,7 @@ impl PdfCraftApp {
         };
         view.insert_at = Some(gap);
         if let Some(drop) = self.grid_drop.take() {
-            self.insert_files(drop.files);
+            self.insert_each(drop.files.into_iter().map(read_grid_file));
         }
     }
 
@@ -1133,16 +1212,48 @@ impl PdfCraftApp {
                 if let Some(meta) = &p.recovered {
                     self.finish_recovery(meta);
                 }
+                if let Some(command) = p.then {
+                    self.execute(command);
+                }
             }
-            // Wrong password: the new prompt is for the same bytes, so it keeps the snapshot.
+            // Wrong password: the new prompt is for the same bytes, so it keeps the snapshot
+            // and the tool waiting for it.
             Ok(()) => {
                 if let Some(prompt) = self.password_prompt.as_mut() {
                     prompt.recovered = p.recovered;
+                    prompt.then = p.then;
                 }
             }
         }
     }
 
+    /// Ask for the active document's permissions password, then run `then` (if any).
+    pub(crate) fn request_unlock(&mut self, then: Option<&'static str>) {
+        let Some(doc) = self.active_ids().and_then(|(_, id)| self.session.get(id)) else { return };
+        self.unlock_prompt = Some(UnlockPrompt::new(doc, then));
+    }
+
+    /// Answer the permissions password prompt (`None` cancels).
+    pub fn submit_unlock(&mut self, password: Option<String>) {
+        let Some(mut p) = self.unlock_prompt.take() else { return };
+        let Some(pw) = password else { return };
+        match self.session.unlock(p.doc, &pw) {
+            // Carry on with what asked for the password, if its document is still the one shown.
+            Ok(()) => match p.then {
+                Some(command) if self.active_ids().is_some_and(|(_, id)| id == p.doc) => {
+                    self.execute(command);
+                }
+                _ => self.notify_tr("Restrictions lifted"),
+            },
+            Err(pdfcraft_engine::EditError::WrongPassword) => {
+                p.input.clear();
+                p.error = Some("Incorrect password. Try again.".to_string());
+                self.unlock_prompt = Some(p);
+            }
+            Err(e) => self.notify_fmt("Couldn't unlock {name}: {e}", &[("name", &p.name), ("e", &e.to_string())]),
+        }
+    }
+
     /// Open a file from a recent list: focus the tab already showing it, else open it (File ▸
     /// Open Recent and the Home view's list share this).
     pub fn open_recent(&mut self, path: &str) {
@@ -1157,23 +1268,36 @@ impl PdfCraftApp {
     #[cfg(not(target_arch = "wasm32"))]
     pub fn open_path(&mut self, path: &str) {
         let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().into_owned()).unwrap_or_else(|| path.to_string());
+        // Taken before reading: a build that rewrites the file meanwhile still counts as a change.
+        let stamp = file_watch::Stamp::at(path);
+        let tabs = self.views.len();
         match std::fs::read(path) {
             Ok(bytes) => {
                 if let Err(e) = self.open_bytes(&name, Some(path.to_string()), bytes) {
                     self.notify_fmt("Couldn't open {name}: {e}", &[("name", &name), ("e", &e.to_string())]);
+                } else if self.views.len() > tabs
+                    && let Some(doc) = self.views.last().map(|v| v.id)
+                {
+                    self.watch.known_as(doc, stamp);
                 }
             }
             Err(e) => self.notify_fmt("Couldn't read {name}: {e}", &[("name", &name), ("e", &e.to_string())]),
         }
     }
 
+    /// The File ▸ Open picker: PDFs, and images and text that become PDFs.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn open_picker() -> rfd::AsyncFileDialog {
+        rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).add_filter(tl!("Images and text (converted to PDF)"), &create_ui::CONVERTIBLE)
+    }
+
     pub fn open_dialog(&mut self) {
         self.startup_superseded = true;
         #[cfg(not(target_arch = "wasm32"))]
         self.pick(
             pickers::PickFor::Open,
             rfd::AsyncFileDialog::new().add_filter("PDF", &["pdf"]).add_filter(tl!("Images and text (converted to PDF)"), &create_ui::CONVERTIBLE),
-            false,
+            true,
         );
         // Browsers pick files asynchronously; the bytes arrive through `inbox`.
         #[cfg(target_arch = "wasm32")]
@@ -1222,7 +1346,12 @@ impl PdfCraftApp {
     /// A dialog or prompt is open over the window: the keyboard is its own, and nothing may act
     /// on the document underneath it.
     pub(crate) fn modal_open(&self) -> bool {
-        self.dialog.is_some() || self.close_request.is_some() || self.password_prompt.is_some() || self.pending_link.is_some() || self.updates.open
+        self.dialog.is_some()
+            || self.close_request.is_some()
+            || self.password_prompt.is_some()
+            || self.unlock_prompt.is_some()
+            || self.pending_link.is_some()
+            || self.updates.open
     }
 
     /// Enable the UI control channel on `ctx` (opt-in; see [`control`]). Returns a client that
@@ -1296,14 +1425,21 @@ impl PdfCraftApp {
 
     pub fn set_theme_preference(&mut self, preference: ThemePreference) {
         self.theme_preference = preference;
-        // Before the first frame there is no context to ask, so the last choice stands.
-        let system = self.ctx.as_ref().and_then(|ctx| system_theme(ctx, self.desktop_dark));
-        self.theme = preference.resolve(system, self.theme);
-        if let Some(ctx) = &self.ctx {
-            theme::apply(ctx, self.theme);
+        if let Some(ctx) = self.ctx.clone() {
+            self.sync_theme(&ctx);
+            theme::apply(&ctx, self.theme);
+        } else {
+            self.theme = preference.resolve(None, ThemeKind::Light);
         }
     }
 
+    /// Enable the Linux desktop portal in a native window. Headless contexts keep
+    /// their supplied input and never connect to the user's session bus.
+    #[cfg(target_os = "linux")]
+    pub fn enable_desktop_theme(&mut self) {
+        self.desktop_theme_enabled = true;
+    }
+
     /// Draw the running job's progress card and pass a Cancel click on to the job.
     fn show_progress(&mut self, ctx: &egui::Context) {
         if widgets::progress_notice(self, ctx) {
@@ -1312,10 +1448,23 @@ impl PdfCraftApp {
     }
 
     fn sync_theme(&mut self, ctx: &egui::Context) {
-        if let Some(dark) = self.desktop_theme.take_change() {
-            self.desktop_dark = Some(dark);
+        #[cfg_attr(not(target_os = "linux"), expect(unused_mut))]
+        let mut system = ctx.system_theme().map(|theme| theme == egui::Theme::Dark);
+        #[cfg(target_os = "linux")]
+        {
+            let active = self.theme_preference == ThemePreference::System;
+            if self.desktop_theme_enabled && active && self.desktop_theme.is_none() {
+                let ctx = ctx.clone();
+                self.desktop_theme = Some(pdfcraft_platform::desktop_theme::DesktopTheme::start(move || ctx.request_repaint()));
+            }
+            if let Some(desktop) = &self.desktop_theme {
+                desktop.set_active(active);
+                // The standard portal supplies Linux desktop appearance. No preference
+                // must clear an earlier answer rather than retaining stale dark chrome.
+                system = desktop.get().map(|appearance| appearance == pdfcraft_platform::desktop_theme::DesktopAppearance::Dark);
+            }
         }
-        let kind = self.theme_preference.resolve(system_theme(ctx, self.desktop_dark), self.theme);
+        let kind = self.theme_preference.resolve(system, ThemeKind::Light);
         if kind != self.theme {
             self.theme = kind;
             theme::apply(ctx, kind);
@@ -1324,7 +1473,19 @@ impl PdfCraftApp {
 
     /// Run a catalogue command. Commands that aren't implemented yet say which milestone ships them.
     pub fn run_command(&mut self, command: &str) {
-        if pdfcraft_engine::commands::command(command).is_some() {
+        if let Some(spec) = pdfcraft_engine::commands::command(command) {
+            use pdfcraft_engine::commands::Needs;
+            // A tool that needs a document, chosen with none open, asks for the file and then
+            // runs on it, instead of only saying to open one first.
+            let needs_document = !matches!(spec.needs, Needs::Nothing | Needs::Undo | Needs::Redo);
+            let is_tool = pdfcraft_engine::catalog::TOOL_GROUPS
+                .iter()
+                .flat_map(|g| g.sections.iter().flat_map(|s| s.items.iter()))
+                .any(|i| i.command == spec.id);
+            if self.active.is_none() && needs_document && is_tool && !self.command_enabled(spec) {
+                self.open_then_run(spec);
+                return;
+            }
             self.execute(command);
             return;
         }
@@ -1342,6 +1503,32 @@ impl PdfCraftApp {
         self.notify_fmt("`{command}` {when}", &[("command", command), ("when", &when)]);
     }
 
+    /// Ask for a file to open, then run `spec` on it once it is open (or unlocked). Nothing runs
+    /// when the picker is cancelled or the file doesn't open.
+    #[cfg(not(target_arch = "wasm32"))]
+    fn open_then_run(&mut self, spec: &'static pdfcraft_engine::commands::CommandSpec) {
+        self.startup_superseded = true;
+        let dialog = Self::open_picker().set_title(tl!(spec.label).trim_end_matches('…'));
+        let command = spec.id;
+        self.ask_one(pickers::Ask::File(dialog), None, move |app, path| {
+            let path = path.to_string_lossy().into_owned();
+            let before = app.views.len();
+            app.open_path(&path);
+            if let Some(prompt) = app.password_prompt.as_mut().filter(|p| p.path.as_deref() == Some(path.as_str())) {
+                // Encrypted: the tool runs once the password is in.
+                prompt.then = Some(command);
+            } else if app.views.len() > before && app.active.is_some() {
+                app.execute(command);
+            }
+        });
+    }
+
+    /// Browsers read the picked file asynchronously; it opens, and the tool can be chosen again.
+    #[cfg(target_arch = "wasm32")]
+    fn open_then_run(&mut self, _spec: &'static pdfcraft_engine::commands::CommandSpec) {
+        self.open_dialog();
+    }
+
     /// Today in `fmt` (or Preferences ▸ Date format), with month and weekday names in the date
     /// language, or the interface language when it follows that.
     pub fn date_text(&self, fmt: Option<&str>) -> Result<String, String> {
@@ -1353,10 +1540,23 @@ impl PdfCraftApp {
         self.pending_panel_reveals.push(docking::Panel::Tools);
     }
 
+    /// Enter a tool from the catalogue, Home, palette or control channel. Organize is a
+    /// workspace, so opening its panel also opens the page grid (without toggling it off).
+    pub(crate) fn select_tool(&mut self, id: &'static str) {
+        self.left = LeftPanel::Tool(id);
+        self.reveal_tools();
+        if let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) {
+            view.organize = id == "organize";
+        }
+    }
+
     /// Select the workspace and its matching tool panel, just like the mode bar.
     pub(crate) fn select_mode(&mut self, mode: Mode) {
         self.mode = mode;
         self.reveal_tools();
+        if let Some(view) = self.active.and_then(|i| self.views.get_mut(i)) {
+            view.organize = false;
+        }
         self.left = match mode {
             Mode::Edit => LeftPanel::Tool("edit"),
             Mode::Convert => LeftPanel::Tool("export"),
@@ -1365,9 +1565,36 @@ impl PdfCraftApp {
         };
     }
 
+    /// Switches workspace because the user chose to (mode bar, Read mode command). Entering Read
+    /// mode closes the right panel, as Acrobat's Read mode hides its panes, and leaving it reopens
+    /// that panel. The rail stays in Read mode, and its buttons open panels there too (#932).
+    pub(crate) fn switch_mode(&mut self, mode: Mode, select_tools: bool) {
+        let was_read = self.mode == Mode::Read;
+        if select_tools {
+            self.select_mode(mode);
+        } else {
+            self.mode = mode;
+        }
+        if mode == Mode::Read && !was_read {
+            self.right_before_read = self.right.take();
+        } else if mode != Mode::Read && was_read {
+            let before = self.right_before_read.take();
+            if self.right.is_none() {
+                self.right = before;
+            }
+            if self.right.is_some() {
+                self.pending_panel_reveals.push(docking::Panel::Inspector);
+            }
+        }
+    }
+
     /// Opens a right panel, or closes it with `None`, because the user chose to. Closing Comments
-    /// keeps comment tools from reopening it; opening it again lets them (#225).
+    /// keeps comment tools from reopening it; opening it again lets them (#225). A choice made in
+    /// Read mode replaces the pane saved on the way in, so leaving Read mode doesn't undo it.
     pub fn choose_right_panel(&mut self, panel: Option<RightPanel>) {
+        if self.mode == Mode::Read {
+            self.right_before_read = None;
+        }
         if panel == Some(RightPanel::Comments) {
             self.comments_panel_closed = false;
         } else if panel.is_none() && self.right == Some(RightPanel::Comments) {
@@ -1390,12 +1617,15 @@ impl PdfCraftApp {
             "reopen_last_session": self.reopen_last_session,
             // Kept only while the preference is on.
             "last_session": self.reopen_last_session.then(|| self.session_to_save()),
+            "reload_changed_files": self.reload_changed_files,
             "pinned_folders": self.pinned.folders,
             "theme": self.theme_preference,
+            "scroll_speed": self.scroll_speed,
             "default_mode": self.default_mode,
-            "default_layout": self.view_defaults.layout.as_str(),
+            "default_layout": canvas::display_token(self.view_defaults.layout, self.view_defaults.continuous),
             "default_zoom": self.view_defaults.zoom_name(),
             "highlight_fields": self.view_defaults.highlight_fields,
+            "units": self.units,
             "language": self.language,
             // Null follows the system's text scaling.
             "ui_scale": self.ui_scale,
@@ -1422,6 +1652,7 @@ impl PdfCraftApp {
             "signature_text": match &self.signature { Some(fill_sign::SavedSig::Typed(t)) => Some(t), _ => None },
             "signature_image": match &self.signature { Some(s @ fill_sign::SavedSig::Image(_)) => Some(s), _ => None },
             "initials": self.initials,
+            "sign_graphic": self.sign_graphic,
             // macOS Keychain and Windows store identities are read from their OS key stores each time.
             "digital_ids": self.digital_ids.iter().filter(|e| !e.path.starts_with("keychain:") && !e.path.starts_with("windows:")).collect::<Vec<_>>(),
             "trusted": trusted,
@@ -1465,15 +1696,24 @@ impl PdfCraftApp {
             self.reopen_last_session = on;
         }
         self.last_session = last_session::LastSession::from_json(&v["last_session"]);
+        if let Some(on) = v["reload_changed_files"].as_bool() {
+            self.reload_changed_files = on;
+        }
         self.pinned.restore(&v["pinned_folders"]);
         if let Ok(preference) = serde_json::from_value::<ThemePreference>(v["theme"].clone()) {
             self.set_theme_preference(preference);
         }
+        if let Ok(speed) = serde_json::from_value::<scroll_speed::ScrollSpeed>(v["scroll_speed"].clone()) {
+            self.scroll_speed = speed;
+        }
         if let Ok(mode) = serde_json::from_value::<Mode>(v["default_mode"].clone()) {
             self.default_mode = mode;
         }
-        if let Some(layout) = v["default_layout"].as_str().and_then(canvas::PageLayout::try_parse) {
-            self.view_defaults.layout = layout;
+        if let Some((layout, continuous)) = v["default_layout"].as_str().and_then(canvas::parse_display_token) {
+            (self.view_defaults.layout, self.view_defaults.continuous) = (layout, continuous);
+        }
+        if let Ok(units) = serde_json::from_value::<units::Unit>(v["units"].clone()) {
+            self.units = units;
         }
         if let Some(on) = v["highlight_fields"].as_bool() {
             self.view_defaults.highlight_fields = on;
@@ -1546,6 +1786,8 @@ impl PdfCraftApp {
         if let Ok(i) = serde_json::from_value::<fill_sign::SavedSig>(v["initials"].clone()) {
             self.initials = Some(i);
         }
+        // An unreadable choice (a damaged image) falls back to the name.
+        self.sign_graphic = serde_json::from_value(v["sign_graphic"].clone()).unwrap_or_default();
         if let Ok(ids) = serde_json::from_value::<Vec<DigitalIdEntry>>(v["digital_ids"].clone()) {
             self.digital_ids = ids;
         }
@@ -1587,6 +1829,9 @@ impl PdfCraftApp {
                 };
                 self.set_theme_preference(preference);
             }
+            ("scroll_speed", _) => {
+                self.scroll_speed = scroll_speed::ScrollSpeed::parse(value).ok_or("scroll_speed must be slow, normal, or fast")?;
+            }
             ("panel", _) => {
                 self.right = match value {
                     "comments" => Some(RightPanel::Comments),
@@ -1615,8 +1860,7 @@ impl PdfCraftApp {
             ("date-language", _) => self.session.set_date_language(Some(value).filter(|v| *v != "auto"))?,
             ("tool", _) => {
                 let g = pdfcraft_engine::catalog::group(value).ok_or_else(|| format!("unknown tool {value}"))?;
-                self.left = LeftPanel::Tool(g.id);
-                self.reveal_tools();
+                self.select_tool(g.id);
             }
             ("left", _) => self.left_open = value != "closed",
             ("home", _) => self.active = None,
@@ -1668,7 +1912,15 @@ impl PdfCraftApp {
             }
             ("page", Some(v)) => v.go_to_page(value.parse::<usize>().map_err(|e| e.to_string())?.saturating_sub(1)),
             ("zoom", Some(v)) => v.set_zoom(value.trim_end_matches('%').parse::<f32>().map_err(|e| e.to_string())? / 100.0),
-            ("layout", Some(v)) => v.set_layout(canvas::PageLayout::try_parse(value).ok_or("layout must be continuous, single or two-up")?),
+            ("layout", Some(v)) => {
+                let (layout, continuous) = canvas::parse_display_token(value).ok_or("layout must be single, continuous, two-up or two-page")?;
+                v.set_display(layout, continuous);
+            }
+            ("continuous", Some(v)) => match value {
+                "on" => v.set_continuous(true),
+                "off" => v.set_continuous(false),
+                _ => return Err("continuous must be on or off".into()),
+            },
             ("cover", Some(v)) => {
                 let on = match value {
                     "on" => true,
@@ -1681,7 +1933,16 @@ impl PdfCraftApp {
                 v.set_cover(on);
             }
             ("default-layout", _) => {
-                self.view_defaults.layout = canvas::PageLayout::try_parse(value).ok_or("default-layout must be continuous, single or two-up")?;
+                let (layout, continuous) =
+                    canvas::parse_display_token(value).ok_or("default-layout must be single, continuous, two-up or two-page")?;
+                (self.view_defaults.layout, self.view_defaults.continuous) = (layout, continuous);
+            }
+            ("default-continuous", _) => {
+                self.view_defaults.continuous = match value {
+                    "on" => true,
+                    "off" => false,
+                    _ => return Err("default-continuous must be on or off".into()),
+                };
             }
             ("default-zoom", _) => {
                 self.view_defaults =
@@ -1739,6 +2000,7 @@ impl PdfCraftApp {
                     ),
                     "hand" => QuickTool::Hand,
                     "crop" => QuickTool::Crop,
+                    "enhance-camera" => QuickTool::EnhanceCamera,
                     "redact" => QuickTool::Redact,
                     "add-text" => QuickTool::AddText,
                     "edit-text" => QuickTool::EditText,
@@ -1804,8 +2066,22 @@ impl PdfCraftApp {
                 self.set_combine_zoom(percent / 100.0);
             }
             (k, None)
-                if ["page", "zoom", "layout", "cover", "organize", "grid-zoom", "fields", "find", "rotate", "select", "notice", "comment"]
-                    .contains(&k) =>
+                if [
+                    "page",
+                    "zoom",
+                    "layout",
+                    "continuous",
+                    "cover",
+                    "organize",
+                    "grid-zoom",
+                    "fields",
+                    "find",
+                    "rotate",
+                    "select",
+                    "notice",
+                    "comment",
+                ]
+                .contains(&k) =>
             {
                 return Err(format!("`{k}` needs an open document"));
             }
@@ -1864,11 +2140,42 @@ impl PdfCraftApp {
             }
             self.tool_keys(i, ctx);
             canvas::shortcuts(&mut self.views[i], ctx);
+            self.copy_key(i, ctx);
         }
     }
 }
 
+/// Why nothing can be copied out of the document: its security doesn't allow it (Table 22,
+/// bit 5; #568).
+pub(crate) fn copy_refused() -> &'static str {
+    tl!("The document's security settings don't allow copying text and images")
+}
+
 impl PdfCraftApp {
+    /// Whether text and images may be copied out of document `id`; says why not when they may
+    /// not. Reading aloud and accessibility tools don't ask (assistive technology may read
+    /// anything, §7.6.4.2).
+    pub(crate) fn may_copy(&mut self, id: DocId) -> bool {
+        if self.session.get(id).is_none_or(pdfcraft_engine::Document::allows_copying) {
+            return true;
+        }
+        self.notify(copy_refused().to_string());
+        false
+    }
+
+    /// ⌘C copies the selected text, unless a text field has the keyboard (it copies its own).
+    fn copy_key(&mut self, i: usize, ctx: &egui::Context) {
+        // ⌘C arrives as a Copy event on most platforms.
+        let copy = ctx.input(|input| input.events.iter().any(|e| matches!(e, egui::Event::Copy)));
+        if !copy || ctx.egui_wants_keyboard_input() {
+            return;
+        }
+        let Some((id, text)) = self.views.get(i).and_then(|v| Some((v.id, v.selected_text()?))) else { return };
+        if self.may_copy(id) {
+            ctx.copy_text(text);
+        }
+    }
+
     /// The quick tools' keys, as in Acrobat: V selects, H pans, and holding Space pans until it
     /// is released. Plain letters, so not while a text field, a form field, a dialog or the
     /// palette has the keyboard.
@@ -1907,6 +2214,8 @@ impl eframe::App for PdfCraftApp {
     /// would keep the place the pointer entered at: tell it where the pointer really is, so the
     /// page grid can show (and use) the gap under it.
     fn raw_input_hook(&mut self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        // Before egui reads this frame's wheel input.
+        self.scroll_speed.apply(ctx, raw);
         if raw.hovered_files.is_empty() && raw.dropped_files.is_empty() {
             return;
         }
@@ -1926,26 +2235,29 @@ impl eframe::App for PdfCraftApp {
         // Notices raised outside `ui` (opened files, OS events, the control channel) translate too.
         let lang = i18n::Lang::from_pref(&self.language);
         i18n::set_current(lang);
-        // Simplified Chinese wants its own faces before the Japanese ones (one baseline per line).
-        let hans = lang.code() == "zh-hans";
+        // Chinese wants its own faces before the Japanese ones (one baseline per line).
+        let cjk = theme::CjkPreference::for_language(lang.code());
         if !self.styled {
             egui_extras::install_image_loaders(ctx);
-            theme::install_fonts_for(ctx, hans);
-            self.fonts_hans = hans;
+            theme::install_fonts_for(ctx, cjk);
+            self.fonts_cjk = cjk;
             theme::apply(ctx, self.theme);
             self.styled = true;
         } else {
             self.fonts_ready = true;
-            if hans != self.fonts_hans {
+            if cjk != self.fonts_cjk {
                 // Same family names as before, so named fonts stay valid while the new set loads.
-                theme::install_fonts_for(ctx, hans);
-                self.fonts_hans = hans;
+                theme::install_fonts_for(ctx, cjk);
+                self.fonts_cjk = cjk;
             }
         }
         self.sync_theme(ctx);
-        ui_scale::sync(ctx, ui_scale::factor(self.ui_scale, self.system_text_scale), &mut self.ui_scale_applied);
+        let native = ctx.native_pixels_per_point().unwrap_or(1.0);
+        ui_scale::sync(ctx, ui_scale::zoom(self.ui_scale, self.system_text_scale, native), &mut self.ui_scale_applied);
         // Remember user work even if its tab is subsequently closed or Home is selected.
         self.startup_superseded |= !self.views.is_empty() || self.combine_showing() || self.dialog.is_some() || self.password_prompt.is_some();
+        // Also done in `raw_input_hook`, before input; here for hosts that don't call the hook.
+        self.scroll_speed.set_line_speed(ctx);
         // Before taking this frame's drop: the grid must be drawn once with the pointer where
         // the files were let go before the gap is read.
         self.finish_grid_drop(ctx);
@@ -2014,6 +2326,9 @@ impl eframe::App for PdfCraftApp {
         self.guard_quit(ctx);
         let now = ctx.input(|i| i.time);
         self.autosave_tick(now);
+        // Reload documents whose files a build rewrote (#431).
+        #[cfg(not(target_arch = "wasm32"))]
+        self.watch_files();
         if self.host_dirty.is_some() {
             let dirty = self.first_dirty().is_some();
             if let Some(report) = self.host_dirty.as_mut() {
@@ -2097,6 +2412,17 @@ impl eframe::App for PdfCraftApp {
         chrome::mode_bar(self, ui);
         if self.active.is_some() {
             chrome::right_rail(self, ui);
+            // Read mode hides the tools, not the navigation panes: the rail stays visible
+            // there, so its buttons (Bookmarks, Page thumbnails, ...) must open their panels.
+            // Outside Read mode the docking workspace draws the inspector.
+            if self.mode == Mode::Read && self.right.is_some() {
+                egui::Panel::right("read_right_panel")
+                    .resizable(true)
+                    .default_size(330.0)
+                    .size_range(260.0..=520.0)
+                    .frame(egui::Frame::NONE)
+                    .show(ui, |ui| panels::right_panel(self, ui));
+            }
         }
         let t = theme::Tokens::get(&ctx);
         egui::CentralPanel::default().frame(egui::Frame::NONE.fill(t.pasteboard)).show(ui, |ui| {
diff --git a/crates/ui-egui/src/link_ui.rs b/crates/ui-egui/src/link_ui.rs
index 4b0f2857..1079a468 100644
--- a/crates/ui-egui/src/link_ui.rs
+++ b/crates/ui-egui/src/link_ui.rs
@@ -253,7 +253,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut LinkDraft, pages: usize, t: &Token
     ui.add_enabled_ui(d.web, |ui| {
         ui.horizontal(|ui| {
             ui.add_space(24.0);
-            ui.add(egui::TextEdit::singleline(&mut d.url).desired_width(360.0).hint_text("https://example.org"));
+            ui.add(crate::widgets::line(&mut d.url).desired_width(360.0).hint_text("https://example.org"));
         });
     });
     ui.radio_value(&mut d.web, false, tl!("Go to a page view"));
diff --git a/crates/ui-egui/src/marks_ui.rs b/crates/ui-egui/src/marks_ui.rs
index c92ae1f6..2bf7d6f7 100644
--- a/crates/ui-egui/src/marks_ui.rs
+++ b/crates/ui-egui/src/marks_ui.rs
@@ -8,6 +8,9 @@ use pdfcraft_engine::{Background, Edit, HeaderFooter, MarkKind, Watermark};
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, widgets};
 
+/// How far a watermark may be moved from the page centre, in points.
+const MAX_OFFSET: f64 = 20_000.0;
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Subset {
     All,
@@ -144,6 +147,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
     let Some(doc) = app.session.get(id) else { return (false, true) };
     let count = doc.info.pages.len();
     let page = doc.info.pages.get(current).map(|p| (p.width as f64, p.height as f64)).unwrap_or((612.0, 792.0));
+    let units = app.units;
     let d = &mut app.marks_draft;
     let mut browse = false;
     let verb = if d.replace { tl!("Update") } else { tl!("Add") };
@@ -163,12 +167,15 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
                 ui.checkbox(&mut d.hf.underline, tl!("Underline"));
                 color_button(ui, &mut d.hf.color);
                 ui.add_space(16.0);
-                ui.label(tl!("Margins (in)"));
+                ui.label(format!("{} ({})", tl!("Margins"), units.label()));
+                let per = units.per_point();
                 for (label, k) in [(tl!("Top"), 0), (tl!("Bottom"), 1), (tl!("Left"), 2), (tl!("Right"), 3)] {
                     ui.label(label);
-                    let mut v = d.hf.margins[k] / 72.0;
-                    if ui.add(egui::DragValue::new(&mut v).range(0.0..=10.0).speed(0.05).max_decimals(2)).changed() {
-                        d.hf.margins[k] = v * 72.0;
+                    let mut v = d.hf.margins[k] * per;
+                    // Up to 10 inches, whatever the unit.
+                    let max = 720.0 * per;
+                    if ui.add(egui::DragValue::new(&mut v).range(0.0..=max).speed(units.speed()).max_decimals(units.decimals())).changed() {
+                        d.hf.margins[k] = v / per;
                     }
                 }
             });
@@ -181,7 +188,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
                     ui.end_row();
                     for col in 0..3 {
                         let k = row * 3 + col;
-                        let r = ui.add_sized([220.0, 40.0], egui::TextEdit::multiline(&mut d.hf.text[k]).desired_rows(2).id_salt(("hf-box", k)));
+                        let r = ui.add_sized([220.0, 40.0], crate::widgets::block(&mut d.hf.text[k]).desired_rows(2).id_salt(("hf-box", k)));
                         if r.gained_focus() || r.has_focus() {
                             d.focused_box = k;
                         }
@@ -232,11 +239,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
                     ui.add_enabled_ui(!d.use_file, |ui| {
                         ui.label(tl!("Text"));
                         ui.add(
-                            egui::TextEdit::multiline(&mut d.wm.text)
-                                .desired_rows(2)
-                                .desired_width(320.0)
-                                .hint_text("CONFIDENTIAL")
-                                .id_salt("wm-text"),
+                            crate::widgets::block(&mut d.wm.text).desired_rows(2).desired_width(320.0).hint_text("CONFIDENTIAL").id_salt("wm-text"),
                         );
                     });
                     ui.horizontal(|ui| {
@@ -269,6 +272,13 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
                         ui.radio_value(&mut d.wm.behind, true, tl!("Appear behind page"));
                         ui.radio_value(&mut d.wm.behind, false, tl!("Appear on top of page"));
                     });
+                    ui.horizontal(|ui| {
+                        ui.label(tl!("Offset from centre"));
+                        ui.label(tl!("Horizontal"));
+                        ui.add(egui::DragValue::new(&mut d.wm.offset[0]).range(-MAX_OFFSET..=MAX_OFFSET).suffix(" pt"));
+                        ui.label(tl!("Vertical"));
+                        ui.add(egui::DragValue::new(&mut d.wm.offset[1]).range(-MAX_OFFSET..=MAX_OFFSET).suffix(" pt"));
+                    });
                 });
             });
         }
@@ -318,19 +328,14 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
             }
             MarkKind::Watermark if file_name.is_some() => {
                 let side = r.width().min(r.height()) * wm.scale as f32;
+                let centre = r.center() + vec2(wm.offset[0] as f32 * s, -wm.offset[1] as f32 * s);
                 p.rect_stroke(
-                    Rect::from_center_size(r.center(), vec2(side, side)),
+                    Rect::from_center_size(centre, vec2(side, side)),
                     CornerRadius::ZERO,
                     egui::Stroke::new(1.0, Color32::GRAY),
                     egui::StrokeKind::Inside,
                 );
-                p.text(
-                    r.center(),
-                    egui::Align2::CENTER_CENTER,
-                    file_name.clone().unwrap_or_default(),
-                    egui::FontId::proportional(10.0),
-                    Color32::GRAY,
-                );
+                p.text(centre, egui::Align2::CENTER_CENTER, file_name.clone().unwrap_or_default(), egui::FontId::proportional(10.0), Color32::GRAY);
             }
             MarkKind::Watermark => {
                 let text = if wm.text.trim().is_empty() { "CONFIDENTIAL" } else { wm.text.trim() };
@@ -344,7 +349,8 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens, kind: M
                 let half = galley.size() / 2.0;
                 let (sn, cs) = angle.sin_cos();
                 let offset = vec2(half.x * cs - half.y * sn, half.x * sn + half.y * cs);
-                p.add(egui::epaint::TextShape::new(r.center() - offset, galley, Color32::BLACK).with_angle(angle));
+                let centre = r.center() + vec2(wm.offset[0] as f32 * s, -wm.offset[1] as f32 * s);
+                p.add(egui::epaint::TextShape::new(centre - offset, galley, Color32::BLACK).with_angle(angle));
             }
             MarkKind::Background if file_name.is_some() => {
                 p.rect_stroke(r.shrink(6.0), CornerRadius::ZERO, egui::Stroke::new(1.0, Color32::GRAY), egui::StrokeKind::Inside);
@@ -481,4 +487,15 @@ mod tests {
         let r = PageRange { all: true, subset: Subset::Odd, ..PageRange::default() };
         assert_eq!(r.pages(5), [0, 2, 4]);
     }
+
+    #[test]
+    fn the_watermark_edit_carries_the_offset() {
+        let mut d = MarksDraft::default();
+        d.wm.text = "DRAFT".into();
+        d.wm.offset = [-72.0, 36.0];
+        match edit(&d, MarkKind::Watermark, 3) {
+            Edit::AddWatermark { settings, .. } => assert_eq!(settings.offset, [-72.0, 36.0]),
+            other => panic!("expected AddWatermark, got {other:?}"),
+        }
+    }
 }
diff --git a/crates/ui-egui/src/measure_ui.rs b/crates/ui-egui/src/measure_ui.rs
index f6f8fb14..1a1f83c3 100644
--- a/crates/ui-egui/src/measure_ui.rs
+++ b/crates/ui-egui/src/measure_ui.rs
@@ -98,7 +98,15 @@ impl MeasureView {
         self.scale = None;
     }
 }
-pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, doc: &Document, view: &mut DocView, cx: &crate::comments::PageCx<'_>, tool: Tool) {
+pub(crate) fn page_input(
+    ui: &egui::Ui,
+    resp: &egui::Response,
+    doc: &Document,
+    view: &mut DocView,
+    cx: &crate::comments::PageCx<'_>,
+    tool: Tool,
+    units: crate::units::Unit,
+) {
     let page = cx.page;
     let xf = cx.xf;
     let author = &cx.prefs.author;
@@ -167,7 +175,7 @@ pub(crate) fn page_input(ui: &egui::Ui, resp: &egui::Response, doc: &Document, v
                 state.page = Some(page);
             }
             if state.points.is_empty() {
-                match doc.measurement_scale(page, point) {
+                match doc.measurement_scale_or(page, point, units.per_point(), units.label()) {
                     Ok(scale) => {
                         state.scale = Some(scale);
                         state.error = None;
@@ -278,6 +286,7 @@ pub(crate) fn panel(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
     egui::ScrollArea::vertical().id_salt("measure-panel").show(ui, |ui| panel_body(app, ui, t));
 }
 fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
+    crate::widgets::begin_dialog(ui);
     let Some((index, id)) = app.active_ids() else {
         ui.label(tl!("Open a PDF to measure it."));
         return;
@@ -291,6 +300,7 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
         }
     });
     let Some(doc) = app.session.get(id) else { return };
+    let units = app.units;
     let page = app.views[index].current;
     let info = doc.info.pages.get(page).cloned();
     let state = &mut app.views[index].measure;
@@ -300,7 +310,7 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
     if state.seeded_page != Some(page) {
         state.seeded_page = Some(page);
         if let (Ok(a), Ok(b)) = (doc.measurement_to_user(page, [0.0, 0.0]), doc.measurement_to_user(page, [72.0, 0.0]))
-            && let Ok(scale) = doc.measurement_scale(page, a)
+            && let Ok(scale) = doc.measurement_scale_or(page, a, units.per_point(), units.label())
             && let Ok(reading) = measure::reading(Kind::Distance, &[a, b], &scale)
         {
             state.drawing_points = 72.0;
@@ -325,7 +335,7 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
     }
     ui.horizontal(|ui| {
         ui.label(tl!("Label"));
-        ui.add(egui::TextEdit::singleline(&mut state.label).desired_width(130.0).char_limit(128));
+        ui.add(crate::widgets::line(&mut state.label).desired_width(130.0).char_limit(128));
     });
     ui.separator();
     ui.checkbox(&mut state.snap_enabled, tl!("Snap to drawing"));
@@ -349,7 +359,7 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
     });
     ui.horizontal(|ui| {
         ui.label(tl!("Unit"));
-        ui.add(egui::TextEdit::singleline(&mut state.unit).desired_width(64.0).char_limit(12));
+        ui.add(crate::widgets::line(&mut state.unit).desired_width(64.0).char_limit(12));
         ui.add(egui::DragValue::new(&mut state.precision).range(0..=6).prefix(format!("{} ", tl!("Decimals"))));
     });
     if ui.button(tl!("Calibrate from two points")).clicked() {
@@ -366,7 +376,7 @@ fn panel_body(app: &mut PdfCraftApp, ui: &mut egui::Ui, _t: &Tokens) {
     }
     ui.horizontal(|ui| {
         ui.label(tl!("Viewport"));
-        ui.add(egui::TextEdit::singleline(&mut state.name).desired_width(130.0).char_limit(128));
+        ui.add(crate::widgets::line(&mut state.name).desired_width(130.0).char_limit(128));
     });
     let apply = ui.add_enabled(doc.allows_annotation(), egui::Button::new(tl!("Apply scale"))).clicked();
     if let Some(error) = &state.error {
diff --git a/crates/ui-egui/src/ocr_ui.rs b/crates/ui-egui/src/ocr_ui.rs
index f980d7cc..f6d38e1e 100644
--- a/crates/ui-egui/src/ocr_ui.rs
+++ b/crates/ui-egui/src/ocr_ui.rs
@@ -89,9 +89,9 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
         egui::Grid::new("ocr-settings").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
             ui.label(tl!("Document language"));
             let name = LANGUAGES.iter().find(|l| l.0 == d.language).map_or("English", |l| l.1);
-            egui::ComboBox::from_id_salt("ocr-language").selected_text(name).width(220.0).show_ui(ui, |ui| {
+            egui::ComboBox::from_id_salt("ocr-language").selected_text(tl!(name)).width(220.0).show_ui(ui, |ui| {
                 for (code, name) in LANGUAGES {
-                    ui.selectable_value(&mut d.language, (*code).to_string(), *name);
+                    ui.selectable_value(&mut d.language, (*code).to_string(), tl!(*name));
                 }
             });
             ui.end_row();
diff --git a/crates/ui-egui/src/optimize_ui.rs b/crates/ui-egui/src/optimize_ui.rs
index 3452eeb5..4d6c843e 100644
--- a/crates/ui-egui/src/optimize_ui.rs
+++ b/crates/ui-egui/src/optimize_ui.rs
@@ -91,17 +91,15 @@ fn stage_label(stage: OptimizeStage) -> String {
 /// What the saved notice adds after the size: images optimized and items discarded.
 fn summary(r: &OptimizeReport) -> String {
     let o = &r.optimize;
+    let lang = crate::i18n::current();
     let mut parts = Vec::new();
-    if o.images_resampled + o.images_recompressed > 0 {
-        parts.push(format!(
-            "{} image{} optimized",
-            o.images_resampled + o.images_recompressed,
-            if o.images_resampled + o.images_recompressed == 1 { "" } else { "s" }
-        ));
+    let images = o.images_resampled + o.images_recompressed;
+    if images > 0 {
+        parts.push(crate::i18n::trn(lang, images as u64, "{n} image optimized", "{n} images optimized"));
     }
     let discarded: usize = r.discarded.iter().map(|(_, n)| n).sum();
     if discarded > 0 {
-        parts.push(format!("{discarded} item{} discarded", if discarded == 1 { "" } else { "s" }));
+        parts.push(crate::i18n::trn(lang, discarded as u64, "{n} item discarded", "{n} items discarded"));
     }
     if parts.is_empty() { String::new() } else { format!("; {}", parts.join(", ")) }
 }
@@ -159,7 +157,7 @@ fn discard_box(ui: &mut egui::Ui, list: &mut Vec<Hidden>, h: Hidden, label: &str
 pub(crate) fn body(ui: &mut egui::Ui, d: &mut OptimizeDraft, t: &Tokens) -> (bool, bool) {
     ui.label(egui::RichText::new(tl!("PDF Optimizer")).font(theme::semibold(18.0)));
     ui.add_space(6.0);
-    ui.horizontal(|ui| {
+    ui.horizontal_wrapped(|ui| {
         for (tab, label) in [
             (OptimizeTab::Images, tl!("Images")),
             (OptimizeTab::DiscardObjects, tl!("Discard Objects")),
diff --git a/crates/ui-egui/src/pageboxes.rs b/crates/ui-egui/src/pageboxes.rs
index 44f9e2d1..fb998805 100644
--- a/crates/ui-egui/src/pageboxes.rs
+++ b/crates/ui-egui/src/pageboxes.rs
@@ -1,7 +1,7 @@
 //! Set Page Boxes (Acrobat: Organize pages ▸ Set page boxes / Crop pages ▸ double-click), M4.4.
 //!
-//! Choose a box (crop, trim, bleed, art, media), margins from the media box in points, inches or
-//! millimetres, and the pages. A preview shows the current page's media box and the new box.
+//! Choose a box (crop, trim, bleed, art, media), margins from the media box in points, inches,
+//! millimetres or centimetres, and the pages. A preview shows the current page's media box and the new box.
 
 use egui::{Align, Color32, CornerRadius, Layout, Rect, Stroke, pos2, vec2};
 use pdfcraft_engine::{BoxSpec, Edit, PageBox};
@@ -9,30 +9,7 @@ use pdfcraft_engine::{BoxSpec, Edit, PageBox};
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, widgets};
 
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum Unit {
-    Points,
-    Inches,
-    Millimetres,
-}
-
-impl Unit {
-    fn per_point(self) -> f64 {
-        match self {
-            Unit::Points => 1.0,
-            Unit::Inches => 1.0 / 72.0,
-            Unit::Millimetres => 25.4 / 72.0,
-        }
-    }
-
-    fn label(self) -> &'static str {
-        match self {
-            Unit::Points => "pt",
-            Unit::Inches => "in",
-            Unit::Millimetres => "mm",
-        }
-    }
-}
+pub use crate::units::Unit;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Range {
@@ -93,7 +70,12 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
     let Some(doc) = app.session.get(id) else { return (false, true) };
     let boxes = doc.page_boxes();
     let count = boxes.len().max(1);
+    let units = app.units;
     let d = &mut app.boxes_draft;
+    // Opening the dialog starts in the unit chosen in Preferences.
+    if d.seeded.is_none() {
+        d.unit = units;
+    }
     // Seed the margins from the current page's box when the dialog opens or the box changes.
     if d.seeded != Some((current, d.which))
         && let Some(b) = boxes.get(current)
@@ -128,7 +110,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                 ui.end_row();
                 ui.label(tl!("Units"));
                 egui::ComboBox::from_id_salt("boxes-unit").selected_text(d.unit.label()).show_ui(ui, |ui| {
-                    for u in [Unit::Inches, Unit::Millimetres, Unit::Points] {
+                    for u in Unit::ALL {
                         ui.selectable_value(&mut d.unit, u, u.label());
                     }
                 });
@@ -137,7 +119,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
                 for (label, idx) in [(tl!("Top"), 3), (tl!("Bottom"), 1), (tl!("Left"), 0), (tl!("Right"), 2)] {
                     let l = ui.label(label);
                     let mut v = d.margins[idx] * k;
-                    let speed = if d.unit == Unit::Inches { 0.01 } else { 0.5 };
+                    let speed = d.unit.speed();
                     let r = ui
                         .add(egui::DragValue::new(&mut v).speed(speed).range(0.0..=10_000.0).max_decimals(3).suffix(format!(" {}", d.unit.label())))
                         .labelled_by(l.id);
@@ -193,7 +175,7 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
             ui.painter().text(
                 page.center_bottom() + vec2(0.0, 6.0),
                 egui::Align2::CENTER_TOP,
-                format!("Page {}", current + 1),
+                crate::i18n::fmt(tl!("Page {label}"), &[("label", &(current + 1).to_string())]),
                 theme::regular(11.0),
                 t.text_faint,
             );
diff --git a/crates/ui-egui/src/palette.rs b/crates/ui-egui/src/palette.rs
index f11e1c15..9edb2be2 100644
--- a/crates/ui-egui/src/palette.rs
+++ b/crates/ui-egui/src/palette.rs
@@ -5,7 +5,7 @@ use egui::{Align2, CornerRadius, Rect, Sense, Stroke, vec2};
 use pdfcraft_engine::catalog::{Availability, TOOL_GROUPS};
 
 use crate::theme::{self, Tokens};
-use crate::{LeftPanel, PdfCraftApp, icons};
+use crate::{PdfCraftApp, icons};
 
 struct Hit {
     /// The tool panel to open (tools and catalogue items); `None` for plain commands.
@@ -17,11 +17,12 @@ struct Hit {
     ready: bool,
 }
 
+/// Where `needle` (folded with [`pdfcraft_render::text::fold_case`]) matches `hay`, for ranking.
 fn score(hay: &str, needle: &str) -> Option<usize> {
     if needle.is_empty() {
         return Some(0);
     }
-    let h = hay.to_lowercase();
+    let h = pdfcraft_render::text::fold_case(hay);
     if let Some(p) = h.find(needle) {
         return Some(p);
     }
@@ -48,7 +49,7 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
         app.palette_open = false;
         return;
     }
-    let q = app.palette_query.trim().to_lowercase();
+    let q = pdfcraft_render::text::fold_case(app.palette_query.trim());
     let mut hits: Vec<(usize, Hit)> = Vec::new();
     let active = app.active_ids().map(|(_, id)| id);
     for spec in pdfcraft_engine::commands::COMMANDS {
@@ -162,8 +163,19 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
                     let shown_detail = tl!(&h.detail).to_string();
                     resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, h.ready, &shown));
                     let fg = if h.ready { t.text } else { t.text_faint };
-                    ui.painter().text(rect.left_center() + vec2(36.0, 0.0), Align2::LEFT_CENTER, shown, theme::regular(13.5), fg);
-                    ui.painter().text(rect.right_center() - vec2(10.0, 0.0), Align2::RIGHT_CENTER, shown_detail, theme::regular(12.0), t.text_faint);
+                    let detail_font = theme::regular(12.0);
+                    let detail_max = (rect.width() * 0.42).clamp(0.0, 220.0);
+                    let detail = crate::widgets::fit_line(&shown_detail, detail_max, |s| crate::widgets::text_width(ui, s, &detail_font));
+                    let detail_w = crate::widgets::text_width(ui, &detail, &detail_font);
+                    ui.painter().text(rect.right_center() - vec2(10.0, 0.0), Align2::RIGHT_CENTER, detail, detail_font, t.text_faint);
+                    crate::widgets::paint_left(
+                        ui,
+                        rect.left_center() + vec2(36.0, 0.0),
+                        &shown,
+                        theme::regular(13.5),
+                        fg,
+                        (rect.width() - 36.0 - detail_w - 24.0).max(0.0),
+                    );
                     if resp.clicked() {
                         chosen = Some((h.command, h.group));
                     }
@@ -184,11 +196,25 @@ pub fn show(app: &mut PdfCraftApp, ctx: &egui::Context) {
         app.palette_open = false;
         app.palette_query.clear();
         if let Some(g) = group {
-            app.left_open = true;
-            app.left = LeftPanel::Tool(g);
+            app.select_tool(g);
         }
         if let Some(c) = command {
             app.run_command(c);
         }
     }
 }
+
+#[cfg(test)]
+mod search {
+    use super::score;
+    use pdfcraft_render::text::fold_case;
+
+    #[test]
+    fn commands_match_in_any_case_with_turkish_i() {
+        assert_eq!(score("İçe aktar", &fold_case("içe")), Some(0));
+        assert_eq!(score("Yazdır", &fold_case("YAZDIR")), Some(0));
+        assert_eq!(score("Insert Pages", &fold_case("ınsert")), Some(0));
+        assert_eq!(score("Print", &fold_case("print")), Some(0));
+        assert_eq!(score("Print", &fold_case("zz")), None);
+    }
+}
diff --git a/crates/ui-egui/src/panels.rs b/crates/ui-egui/src/panels.rs
index abdd38ee..aebf5ec6 100644
--- a/crates/ui-egui/src/panels.rs
+++ b/crates/ui-egui/src/panels.rs
@@ -35,12 +35,14 @@ fn panel_header(ui: &mut egui::Ui, t: &Tokens, title: &str, back: bool) -> (bool
         if back && icons::button(ui, "chevron-left", 26.0, false, tl!("Back to all tools")).clicked() {
             go_back = true;
         }
-        ui.label(egui::RichText::new(tl!(title)).font(theme::semibold(15.5)).color(t.text));
-        ui.with_layout(Layout::right_to_left(Align::Center), |ui| {
-            if icons::button(ui, "x", 26.0, false, tl!("Close panel")).clicked() {
-                close = true;
-            }
-        });
+        // Reserve space for Close before laying out the translated title. Long tool names
+        // must never expand the fixed-width sidebar or push the Close control off-screen.
+        let title_width = (ui.available_width() - 26.0 - ui.spacing().item_spacing.x).max(1.0);
+        ui.add_sized([title_width, 26.0], egui::Label::new(egui::RichText::new(tl!(title)).font(theme::semibold(15.5)).color(t.text)).truncate())
+            .on_hover_text(tl!(title));
+        if icons::button(ui, "x", 26.0, false, tl!("Close panel")).clicked() {
+            close = true;
+        }
     });
     ui.add_space(6.0);
     (go_back, close)
@@ -55,17 +57,35 @@ fn all_tools(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
         let shown = if app.all_tools_expanded { TOOL_GROUPS.len() } else { COLLAPSED_TOOLS.min(TOOL_GROUPS.len()) };
         for g in &TOOL_GROUPS[..shown] {
             if tool_row(ui, t, g).clicked() {
-                app.left = LeftPanel::Tool(g.id);
+                app.select_tool(g.id);
             }
         }
         ui.add_space(4.0);
         let more = if app.all_tools_expanded { "View less" } else { "View more" };
-        if ui.add(egui::Label::new(egui::RichText::new(tl!(more)).color(t.accent_text).font(theme::medium(13.0))).sense(Sense::click())).clicked() {
+        if ui
+            .add(
+                egui::Label::new(egui::RichText::new(tl!(more)).color(t.accent_text).font(theme::medium(13.0)))
+                    .selectable(false)
+                    .sense(Sense::click()),
+            )
+            .clicked()
+        {
             app.all_tools_expanded = !app.all_tools_expanded;
         }
     });
 }
 
+/// Draw a one-line row label without painting into the status chip or beyond the sidebar.
+/// Accessibility retains the complete name through the row's WidgetInfo.
+fn row_label(ui: &mut egui::Ui, text: &str, font: egui::FontId, color: Color32, left_center: egui::Pos2, max_width: f32) -> bool {
+    let mut job = egui::text::LayoutJob::simple_singleline(text.to_owned(), font, color);
+    job.wrap = egui::text::TextWrapping { max_width: max_width.max(1.0), max_rows: 1, break_anywhere: true, ..Default::default() };
+    let galley = ui.fonts_mut(|f| f.layout_job(job));
+    let elided = galley.elided;
+    ui.painter().galley(left_center - vec2(0.0, galley.size().y / 2.0), galley, color);
+    elided
+}
+
 fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
     let (rect, resp) = ui.allocate_exact_size(vec2(ui.available_width(), 34.0), Sense::click());
     resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, tl!(g.label)));
@@ -73,7 +93,16 @@ fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
         ui.painter().rect_filled(rect, CornerRadius::same(6), t.hover);
     }
     icons::paint(ui, Rect::from_min_size(rect.min + vec2(6.0, 7.0), vec2(20.0, 20.0)), g.icon, 19.0, hue(g));
-    ui.painter().text(rect.left_center() + vec2(36.0, 0.0), Align2::LEFT_CENTER, tl!(g.label), theme::regular(13.5), t.text);
+    let right_reserved = match (g.badge, g.availability) {
+        (Some(b), _) => ui.fonts_mut(|f| f.layout_no_wrap(tl!(b).to_owned(), theme::semibold(9.5), Color32::WHITE).size().x) + 26.0,
+        (None, Availability::Planned(m)) if resp.hovered() => {
+            let hint = format!("{} · {m}", tl!("Planned"));
+            ui.fonts_mut(|f| f.layout_no_wrap(hint, theme::medium(10.5), t.text_faint).size().x) + 18.0
+        }
+        _ => 8.0,
+    };
+    let clipped =
+        row_label(ui, tl!(g.label), theme::regular(13.5), t.text, rect.left_center() + vec2(36.0, 0.0), rect.width() - 36.0 - right_reserved);
     match (g.badge, g.availability) {
         (Some(b), _) => {
             let font = theme::semibold(9.5);
@@ -100,6 +129,7 @@ fn tool_row(ui: &mut egui::Ui, t: &Tokens, g: &ToolGroup) -> egui::Response {
         Availability::Planned(m) => format!("{} {m} — {}", tl!("Planned for milestone"), tl!("open to see what it will include")),
         Availability::Provider => tl!("Optional: needs an AI provider you configure").into(),
     };
+    let tip = if clipped { format!("{} — {tip}", tl!(g.label)) } else { tip };
     resp.on_hover_text(tip)
 }
 
@@ -185,18 +215,19 @@ fn tool_detail(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens, g: &'static
                     17.0,
                     if ready { hue(g) } else { t.text_faint },
                 );
-                ui.painter().text(rect.left_center() + vec2(34.0, 0.0), Align2::LEFT_CENTER, tl!(item.label), theme::regular(13.0), fg);
                 let (chip, fill, cfg) = match item.availability {
                     Availability::Ready => (tl!("Ready"), Color32::from_rgb(0xDD, 0xF3, 0xE4), Color32::from_rgb(0x1E, 0x7B, 0x43)),
                     Availability::Planned(m) => (m, t.pressed, t.text_muted),
                     Availability::Provider => ("AI", t.pressed, t.text_muted),
                 };
                 let font = theme::semibold(9.5);
-                let w = ui.fonts_mut(|f| f.layout_no_wrap(tl!(chip).to_string(), font.clone(), cfg).size().x);
+                let chip_label = tl!(chip).to_string();
+                let w = crate::widgets::text_width(ui, &chip_label, &font);
                 let r = Rect::from_center_size(rect.right_center() - vec2(w / 2.0 + 10.0, 0.0), vec2(w + 10.0, 16.0));
+                row_label(ui, tl!(item.label), theme::regular(13.0), fg, rect.left_center() + vec2(34.0, 0.0), r.left() - rect.left() - 42.0);
                 ui.painter().rect_filled(r, CornerRadius::same(4), fill);
-                ui.painter().text(r.center(), Align2::CENTER_CENTER, tl!(chip), font, cfg);
-                if resp.on_hover_text(item.command).clicked() {
+                ui.painter().text(r.center(), Align2::CENTER_CENTER, chip_label, font, cfg);
+                if resp.on_hover_text(format!("{} — {}", tl!(item.label), item.command)).clicked() {
                     run = Some(item.command);
                 }
             }
@@ -270,23 +301,31 @@ fn stamp_palette(app: &mut PdfCraftApp, ui: &mut egui::Ui, t: &Tokens) {
                         chip.left_bottom() + vec2(tip, 0.0),
                     ];
                     ui.painter().add(egui::Shape::convex_polygon(pts, col, Stroke::NONE));
-                    ui.painter().text(
+                    let label = kind.label();
+                    let font = theme::semibold(11.0);
+                    let shown = crate::widgets::fit_line(label, (chip.width() - 10.0).max(0.0), |s| crate::widgets::text_width(ui, s, &font));
+                    ui.painter().with_clip_rect(chip.shrink(3.0)).text(
                         chip.center() + vec2(tip / 2.0, 0.0),
                         Align2::CENTER_CENTER,
-                        kind.label(),
-                        theme::semibold(11.0),
+                        shown,
+                        font,
                         Color32::WHITE,
                     );
                 } else {
                     ui.painter().rect(chip, CornerRadius::same(5), col.gamma_multiply(0.1), Stroke::new(1.5, col), egui::StrokeKind::Inside);
                     let y = if group == StampGroup::Dynamic { chip.center().y - 4.0 } else { chip.center().y };
-                    ui.painter().text(egui::pos2(chip.center().x, y), Align2::CENTER_CENTER, kind.label(), theme::semibold(11.0), col);
+                    let font = theme::semibold(11.0);
+                    let shown = crate::widgets::fit_line(kind.label(), (chip.width() - 10.0).max(0.0), |s| crate::widgets::text_width(ui, s, &font));
+                    ui.painter().with_clip_rect(chip.shrink(3.0)).text(egui::pos2(chip.center().x, y), Align2::CENTER_CENTER, shown, font, col);
                     if group == StampGroup::Dynamic {
-                        ui.painter().text(
+                        let by = "By name at time, date";
+                        let by_font = theme::regular(7.5);
+                        let by_shown = crate::widgets::fit_line(by, (chip.width() - 8.0).max(0.0), |s| crate::widgets::text_width(ui, s, &by_font));
+                        ui.painter().with_clip_rect(chip.shrink(2.0)).text(
                             egui::pos2(chip.center().x, chip.bottom() - 6.0),
                             Align2::CENTER_CENTER,
-                            "By name at time, date",
-                            theme::regular(7.5),
+                            by_shown,
+                            by_font,
                             col,
                         );
                     }
@@ -514,7 +553,7 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                     ui.data_mut(|d| d.insert_temp(search_id, bookmark_query.clone()));
                     ui.add_space(6.0);
                 }
-                let bookmark_query = bookmark_query.trim().to_lowercase();
+                let bookmark_query = pdfcraft_render::text::fold_case(bookmark_query.trim());
                 let mut bookmark_matches =
                     if panel == RightPanel::Bookmarks { outline_matches(&info.outline, &bookmark_query) } else { std::collections::HashSet::new() };
                 // A new bookmark must stay nameable even when its initial title doesn't match.
@@ -575,7 +614,14 @@ pub fn right_panel(app: &mut PdfCraftApp, ui: &mut egui::Ui) {
                                 t.icon,
                             );
                             let fg = if l.visible { t.text } else { t.text_faint };
-                            ui.painter().text(rect.left_center() + vec2(32.0, 0.0), Align2::LEFT_CENTER, &l.name, theme::regular(13.0), fg);
+                            crate::widgets::paint_left(
+                                ui,
+                                rect.left_center() + vec2(32.0, 0.0),
+                                &l.name,
+                                theme::regular(13.0),
+                                fg,
+                                (rect.width() - 40.0).max(0.0),
+                            );
                             if resp.on_hover_text(if l.visible { tl!("Hide layer") } else { tl!("Show layer") }).clicked() {
                                 toggle_layer = Some((li, !l.visible));
                             }
@@ -730,6 +776,7 @@ pub enum BmAction {
 }
 
 /// Matching titles plus their ancestors, keeping document paths rather than filtered indexes.
+/// `query` is folded with [`pdfcraft_render::text::fold_case`], as titles are here.
 fn outline_matches(items: &[OutlineItem], query: &str) -> std::collections::HashSet<Vec<usize>> {
     let mut matches = std::collections::HashSet::new();
     if query.is_empty() {
@@ -737,7 +784,7 @@ fn outline_matches(items: &[OutlineItem], query: &str) -> std::collections::Hash
     }
     let mut pending: Vec<_> = items.iter().enumerate().map(|(i, item)| (vec![i], item)).collect();
     while let Some((path, item)) = pending.pop() {
-        if item.title.to_lowercase().contains(query) {
+        if pdfcraft_render::text::fold_case(&item.title).contains(query) {
             let mut ancestor = path.clone();
             while !ancestor.is_empty() {
                 matches.insert(ancestor.clone());
@@ -810,7 +857,8 @@ fn outline_item(ui: &mut egui::Ui, t: &Tokens, info: &DocInfo, item: &OutlineIte
         let mut cancel = false;
         ui.horizontal(|ui| {
             ui.add_space(x_text);
-            let edit = egui::TextEdit::singleline(text).desired_width(ui.available_width() - 8.0).id(id.with("rename"));
+            crate::widgets::begin_dialog(ui);
+            let edit = crate::widgets::line(text).desired_width(ui.available_width() - 8.0).id(id.with("rename"));
             let resp = ui.add(edit);
             if !resp.has_focus() && !resp.lost_focus() {
                 resp.request_focus();
@@ -1171,10 +1219,16 @@ fn fields(
                 ui.painter().rect_filled(rect, CornerRadius::same(6), if selected { t.pressed } else { t.hover });
             }
             icons::paint(ui, Rect::from_min_size(rect.min + vec2(8.0, 7.0), vec2(16.0, 16.0)), icon, 15.0, Color32::from_rgb(0x8E, 0x4E, 0xE6));
-            ui.painter().text(rect.left_center() + vec2(32.0, 0.0), Align2::LEFT_CENTER, &f.name, theme::regular(13.0), t.text);
-            if let Some(v) = &f.value {
-                let v: String = if v.chars().count() > 18 { format!("{}…", v.chars().take(17).collect::<String>()) } else { v.clone() };
-                ui.painter().text(rect.right_center() - vec2(8.0, 0.0), Align2::RIGHT_CENTER, v, theme::regular(11.5), t.text_faint);
+            let value =
+                f.value.as_ref().map(|v| if v.chars().count() > 18 { format!("{}…", v.chars().take(17).collect::<String>()) } else { v.clone() });
+            let value_font = theme::regular(11.5);
+            let value_w = value.as_ref().map(|v| crate::widgets::text_width(ui, v, &value_font)).unwrap_or(0.0);
+            let arrows = if preparing && f.page.is_some() { 56.0 } else { 0.0 };
+            let max_w = (rect.width() - 32.0 - value_w - arrows - 16.0).max(0.0);
+            crate::widgets::paint_left(ui, rect.left_center() + vec2(32.0, 0.0), &f.name, theme::regular(13.0), t.text, max_w);
+            if let Some(v) = value {
+                let x = if arrows > 0.0 { 64.0 } else { 8.0 };
+                ui.painter().text(rect.right_center() - vec2(x, 0.0), Align2::RIGHT_CENTER, v, value_font, t.text_faint);
             }
             let kind = format!("{:?}", f.kind);
             let mut tip = crate::i18n::fmt(tl!("{kind} field"), &[("kind", tl!(&kind))]);
@@ -1228,10 +1282,15 @@ pub fn human_size(n: usize) -> String {
     match n {
         n if n >= 1 << 20 => format!("{:.1} MB", n as f64 / (1u64 << 20) as f64),
         n if n >= 1 << 10 => format!("{:.1} KB", n as f64 / (1u64 << 10) as f64),
-        n => format!("{n} bytes"),
+        n => byte_count(n),
     }
 }
 
+/// An exact size in bytes, with the count's own plural form.
+pub fn byte_count(n: usize) -> String {
+    crate::i18n::trn(crate::i18n::current(), n as u64, "{n} byte", "{n} bytes")
+}
+
 #[cfg(test)]
 mod page_moves {
     use super::{moved_index, panel_gap};
@@ -1313,3 +1372,25 @@ mod label_column {
         assert!(shown.ends_with('\u{2026}') && label.starts_with(shown.trim_end_matches('\u{2026}')), "{shown:?}");
     }
 }
+
+#[cfg(test)]
+mod bookmark_filter {
+    use super::outline_matches;
+    use pdfcraft_render::OutlineItem;
+
+    fn item(title: &str, children: Vec<OutlineItem>) -> OutlineItem {
+        OutlineItem { title: title.into(), page: Some(0), view: pdfcraft_render::DestView::Top, children, open: true }
+    }
+
+    /// Turkish dotted and dotless i match in any case, as in Find (#892).
+    #[test]
+    fn titles_match_in_any_case_with_turkish_i() {
+        let outline = [item("İSTANBUL ŞUBESİ", vec![item("Kış dönemi", vec![])]), item("Ankara", vec![])];
+        let fold = pdfcraft_render::text::fold_case;
+        assert_eq!(outline_matches(&outline, &fold("istanbul")).len(), 1);
+        assert_eq!(outline_matches(&outline, &fold("şubesi")).len(), 1);
+        // A child match keeps its parent: [0] and [0, 0].
+        assert_eq!(outline_matches(&outline, &fold("KIŞ")).len(), 2);
+        assert!(outline_matches(&outline, &fold("izmir")).is_empty());
+    }
+}
diff --git a/crates/ui-egui/src/prepare.rs b/crates/ui-egui/src/prepare.rs
index 07597c87..a0ebc211 100644
--- a/crates/ui-egui/src/prepare.rs
+++ b/crates/ui-egui/src/prepare.rs
@@ -933,7 +933,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Toke
     ui.set_width(600.0);
     ui.label(egui::RichText::new(tl!(d.title())).font(theme::semibold(18.0)));
     ui.add_space(6.0);
-    ui.horizontal(|ui| {
+    ui.horizontal_wrapped(|ui| {
         for (tab, label) in d.tabs() {
             if widgets::mode_tab(ui, tl!(label), d.tab == tab).clicked() {
                 d.tab = tab;
@@ -956,11 +956,11 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Toke
             FieldTab::General => {
                 egui::Grid::new("field-general").num_columns(2).spacing([12.0, 10.0]).show(ui, |ui| {
                     let l = ui.label(tl!("Name:"));
-                    let r = ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(340.0)).labelled_by(l.id);
+                    let r = ui.add(crate::widgets::line(&mut d.name).desired_width(340.0)).labelled_by(l.id);
                     enter |= r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
                     ui.end_row();
                     let l = ui.label(tl!("Tooltip:"));
-                    ui.add(egui::TextEdit::singleline(&mut d.tooltip).desired_width(340.0)).labelled_by(l.id);
+                    ui.add(crate::widgets::line(&mut d.tooltip).desired_width(340.0)).labelled_by(l.id);
                     ui.end_row();
                 });
                 ui.add_space(12.0);
@@ -997,16 +997,20 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Toke
                 if let Some(l) = d.look.as_mut() {
                     widgets::section_title(ui, tl!("Borders and Colors"));
                     egui::Grid::new("field-borders").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
-                        for (label, slot) in [(tl!("Border Color:"), &mut l.border), (tl!("Fill Color:"), &mut l.fill)] {
+                        for (index, (label, slot)) in
+                            [(tl!("Border Color:"), &mut l.border), (tl!("Fill Color:"), &mut l.fill)].into_iter().enumerate()
+                        {
                             ui.label(label);
-                            ui.horizontal(|ui| {
-                                let mut none = slot.is_none();
-                                if ui.checkbox(&mut none, tl!("No color")).changed() {
-                                    *slot = if none { None } else { Some([0.0; 3]) };
-                                }
-                                if let Some(c) = crate::comments::swatch_grid(ui, *slot) {
-                                    *slot = Some(c);
-                                }
+                            ui.push_id(("field-color", index), |ui| {
+                                ui.horizontal(|ui| {
+                                    let mut none = slot.is_none();
+                                    if ui.checkbox(&mut none, tl!("No color")).changed() {
+                                        *slot = if none { None } else { Some([0.0; 3]) };
+                                    }
+                                    if let Some(c) = crate::comments::swatch_grid(ui, *slot) {
+                                        *slot = Some(c);
+                                    }
+                                });
                             });
                             ui.end_row();
                         }
@@ -1086,7 +1090,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Toke
                             });
                         ui.end_row();
                         let l = ui.label(tl!("Default Value:"));
-                        ui.add(egui::TextEdit::singleline(&mut d.default).desired_width(260.0)).labelled_by(l.id);
+                        ui.add(crate::widgets::line(&mut d.default).desired_width(260.0)).labelled_by(l.id);
                         ui.end_row();
                     });
                     ui.add_space(6.0);
@@ -1146,7 +1150,7 @@ pub(crate) fn body(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Toke
                 _ => {
                     ui.horizontal(|ui| {
                         let l = ui.label(tl!("Item:"));
-                        let r = ui.add(egui::TextEdit::singleline(&mut d.new_option).desired_width(240.0)).labelled_by(l.id);
+                        let r = ui.add(crate::widgets::line(&mut d.new_option).desired_width(240.0)).labelled_by(l.id);
                         let typed = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
                         if (widgets::pill_button(ui, tl!("Add"), false).clicked() || typed) && !d.new_option.trim().is_empty() {
                             d.options.push(d.new_option.trim().to_string());
@@ -1359,7 +1363,7 @@ fn format_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) {
                     }
                 });
                 ui.label(tl!("Custom:"));
-                ui.add(egui::TextEdit::singleline(p).desired_width(120.0));
+                ui.add(crate::widgets::line(p).desired_width(120.0));
             });
         }
         Format::Special(n) => {
@@ -1384,7 +1388,7 @@ fn format_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens) {
             });
             ui.horizontal(|ui| {
                 ui.label(tl!("Mask:"));
-                ui.add(egui::TextEdit::singleline(m).desired_width(160.0));
+                ui.add(crate::widgets::line(m).desired_width(160.0));
             });
             ui.label(egui::RichText::new(tl!("9 digit, A letter, O letter or digit, X any character")).small().color(t.text_faint));
             if idx < 4 {
@@ -1457,9 +1461,9 @@ fn actions_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens)
         };
         ui.label(if a.kind == 0 { tl!("Script:") } else { tl!("Value:") });
         if a.kind == 0 {
-            ui.add(egui::TextEdit::multiline(&mut a.text).code_editor().desired_rows(3).desired_width(340.0).hint_text(hint).id_salt("action-text"));
+            ui.add(crate::widgets::block(&mut a.text).code_editor().desired_rows(3).desired_width(340.0).hint_text(hint).id_salt("action-text"));
         } else {
-            ui.add(egui::TextEdit::singleline(&mut a.text).desired_width(340.0).hint_text(hint).id_salt("action-text"));
+            ui.add(crate::widgets::line(&mut a.text).desired_width(340.0).hint_text(hint).id_salt("action-text"));
         }
         ui.end_row();
     });
@@ -1477,7 +1481,7 @@ fn actions_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens)
         }
     }
     if let Some(e) = error {
-        ui.label(egui::RichText::new(e).small().color(t.text_muted));
+        ui.label(egui::RichText::new(tl!(&e)).small().color(t.text_muted));
     }
     ui.add_space(8.0);
     ui.label(egui::RichText::new(tl!("Actions")).font(theme::semibold(13.0)));
@@ -1557,7 +1561,7 @@ fn calculate_tab(ui: &mut egui::Ui, d: &mut FieldDraft, t: &crate::theme::Tokens
         d.calculate = Calculate::Notation(String::new());
     }
     if let Calculate::Notation(expr) = &mut d.calculate {
-        ui.add(egui::TextEdit::multiline(expr).hint_text("Price * Quantity").desired_rows(2).desired_width(420.0));
+        ui.add(crate::widgets::block(expr).hint_text("Price * Quantity").desired_rows(2).desired_width(420.0));
         ui.label(egui::RichText::new(tl!("Field names with + - * / and parentheses; put \\ before spaces in names.")).small().color(t.text_faint));
     }
 }
diff --git a/crates/ui-egui/src/print_ui.rs b/crates/ui-egui/src/print_ui.rs
index a153eba6..33bd07da 100644
--- a/crates/ui-egui/src/print_ui.rs
+++ b/crates/ui-egui/src/print_ui.rs
@@ -35,6 +35,8 @@ pub enum Handling {
 #[derive(Clone, Debug, PartialEq)]
 pub struct PrintDraft {
     pub printers: Vec<spool::Printer>,
+    /// The unit the sheet size is shown in (Preferences).
+    pub units: crate::units::Unit,
     /// The printers are still being listed in the background (see [`PrinterSource`]).
     pub printers_loading: bool,
     /// The user chose the printer, so a list arriving late doesn't move it to the default.
@@ -82,6 +84,7 @@ impl Default for PrintDraft {
     fn default() -> Self {
         PrintDraft {
             printers: Vec::new(),
+            units: Default::default(),
             printers_loading: false,
             printer_picked: false,
             printer: None,
@@ -136,7 +139,9 @@ impl PrintDraft {
         } else {
             print::select_pages(count, range.as_deref(), labels, self.subset, self.reverse)
         }
-        .map_err(|e| e.to_string())?;
+        // What the person got wrong about what to print is said in their language: the engine hands
+        // the wording over whole and the page numbers apart from it.
+        .map_err(|e| e.said(&crate::i18n::words))?;
         let layout = match self.handling {
             Handling::Size => Layout::Size(match self.size {
                 SizeMode::Custom(_) => SizeMode::Custom(self.custom_scale),
@@ -224,6 +229,7 @@ impl PdfCraftApp {
             printers,
             printers_loading,
             printer_picked: false,
+            units: self.units,
             printer: default,
             current_page: current,
             sheet: 0,
@@ -313,7 +319,7 @@ impl PdfCraftApp {
         let settings = match self.print_draft.settings(doc.info.pages.len(), &labels) {
             Ok(s) => s,
             Err(e) => {
-                self.notify_error(e);
+                self.notify_tr(&e);
                 return false;
             }
         };
@@ -604,7 +610,8 @@ pub(crate) fn body(
                 );
                 ui.end_row();
                 ui.label(tl!("Paper:"));
-                egui::ComboBox::from_id_salt("paper").selected_text(PAPERS[d.paper].0).width(160.0).show_ui(ui, |ui| {
+                let paper_name = PAPERS.get(d.paper).map_or("US Letter", |p| p.0);
+                egui::ComboBox::from_id_salt("paper").selected_text(paper_name).width(260.0).show_ui(ui, |ui| {
                     for (i, (name, _)) in PAPERS.iter().enumerate() {
                         ui.selectable_value(&mut d.paper, i, *name);
                     }
@@ -617,6 +624,21 @@ pub(crate) fn body(
             if d.show_driver_options {
                 driver_options_panel(ui, d, t);
             }
+            if let Some(&source) = sizes.get(d.current_page) {
+                ui.horizontal_wrapped(|ui| {
+                    ui.label(crate::i18n::fmt(tl!("PDF page: {size}"), &[("size", &d.units.size(source.0, source.1))]));
+                    let matched = print::matching_paper(source);
+                    if ui.add_enabled(matched.is_some(), egui::Button::new(tl!("Match page at 100%"))).clicked()
+                        && let Some(paper) = matched
+                    {
+                        d.paper = paper;
+                        d.handling = Handling::Size;
+                        d.size = SizeMode::Actual;
+                        d.orientation = Orientation::Auto;
+                        d.sheet = 0;
+                    }
+                });
+            }
             ui.add_space(6.0);
             widgets::section_title(ui, tl!("Pages to Print"));
             ui.horizontal(|ui| {
@@ -625,7 +647,7 @@ pub(crate) fn body(
                 ui.radio_value(&mut d.which, Which::Range, tl!("Pages"));
                 let r = ui.add_enabled(
                     d.which == Which::Range,
-                    egui::TextEdit::singleline(&mut d.range).hint_text(format!("1-{}", sizes.len())).desired_width(110.0),
+                    crate::widgets::line(&mut d.range).hint_text(format!("1-{}", sizes.len())).desired_width(110.0),
                 );
                 if r.gained_focus() {
                     d.which = Which::Range;
@@ -649,7 +671,7 @@ pub(crate) fn body(
             });
             ui.add_space(6.0);
             widgets::section_title(ui, tl!("Page Sizing & Handling"));
-            ui.horizontal(|ui| {
+            ui.horizontal_wrapped(|ui| {
                 for (h, label) in [
                     (Handling::Size, tl!("Size")),
                     (Handling::Poster, tl!("Poster")),
@@ -765,7 +787,7 @@ pub(crate) fn body(
             ui.painter().rect_filled(area, 6.0, t.hover);
             match (&settings, sheets.get(d.sheet)) {
                 (Err(e), _) => {
-                    ui.put(area.shrink(16.0), egui::Label::new(egui::RichText::new(e).color(t.text_muted)).wrap());
+                    ui.put(area.shrink(16.0), egui::Label::new(egui::RichText::new(tl!(e)).color(t.text_muted)).wrap());
                 }
                 (Ok(_), Some(sheet)) => {
                     let k = (PREVIEW_BOX.0 / sheet.size.0 as f32).min(PREVIEW_BOX.1 / sheet.size.1 as f32);
@@ -842,9 +864,18 @@ pub(crate) fn body(
                     d.sheet += 1;
                 }
             });
-            if let Some(s) = sheets.first() {
-                let (w, h) = (s.size.0 / 72.0, s.size.1 / 72.0);
-                ui.label(egui::RichText::new(format!("{w:.2} × {h:.2} in")).small().color(t.text_muted));
+            if let Some(s) = sheets.get(d.sheet) {
+                ui.label(egui::RichText::new(d.units.size(s.size.0, s.size.1)).small().color(t.text_muted));
+                if d.handling == Handling::Size
+                    && let Some(p) = s.placed.first()
+                {
+                    let scale = p.matrix.0[0].hypot(p.matrix.0[1]) * 100.0;
+                    ui.label(crate::i18n::fmt(tl!("PDF scale: {scale}%"), &[("scale", &format!("{scale:.2}"))]));
+                    ui.label(egui::RichText::new(tl!("Printer paper and scaling may differ. Check driver settings.")).small().color(t.text_muted));
+                    if (scale - 100.0).abs() > 0.01 {
+                        ui.label(egui::RichText::new(tl!("Drawing scale changes. Use Actual size for full-scale plans.")).small().color(t.text_muted));
+                    }
+                }
             }
         });
     });
diff --git a/crates/ui-egui/src/protect.rs b/crates/ui-egui/src/protect.rs
index b27f4486..9406b0dc 100644
--- a/crates/ui-egui/src/protect.rs
+++ b/crates/ui-egui/src/protect.rs
@@ -107,17 +107,9 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> (boo
         d.viewing = false;
     }
     ui.add_space(10.0);
-    // Bordered fields (Acrobat: 1 pt #B1B1B1, radius 4).
     let field = |ui: &mut egui::Ui, label: &str, text: &mut String, id: &str| {
         let l = ui.label(tl!(label));
-        egui::Frame::new()
-            .stroke(egui::Stroke::new(1.0, t.border))
-            .corner_radius(egui::CornerRadius::same(4))
-            .inner_margin(egui::Margin::symmetric(8, 6))
-            .show(ui, |ui| {
-                ui.add(egui::TextEdit::singleline(text).password(true).desired_width(290.0).frame(egui::Frame::NONE).id_salt(id)).labelled_by(l.id)
-            })
-            .inner
+        ui.add(crate::widgets::line(text).password(true).desired_width(290.0).id_salt(id)).labelled_by(l.id)
     };
     let r = field(ui, "Type Password", &mut d.password, "protect-pw");
     if r.changed() || !d.password.is_empty() {
diff --git a/crates/ui-egui/src/redact_ui.rs b/crates/ui-egui/src/redact_ui.rs
index 013b8bcd..c1ae53b7 100644
--- a/crates/ui-egui/src/redact_ui.rs
+++ b/crates/ui-egui/src/redact_ui.rs
@@ -269,7 +269,7 @@ pub(crate) fn search_body(ui: &mut egui::Ui, d: &mut SearchDraft, t: &Tokens) ->
     ui.radio_value(&mut d.mode, SearchMode::Phrase, tl!("Single word or phrase"));
     let mut enter = false;
     ui.add_enabled_ui(d.mode == SearchMode::Phrase, |ui| {
-        let r = ui.add(egui::TextEdit::singleline(&mut d.text).hint_text(tl!("Text to find")).desired_width(380.0));
+        let r = ui.add(crate::widgets::line(&mut d.text).hint_text(tl!("Text to find")).desired_width(380.0));
         enter = r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter));
     });
     ui.add_space(6.0);
@@ -338,7 +338,7 @@ pub(crate) fn props_body(ui: &mut egui::Ui, d: &mut RedactPrefs, _t: &Tokens) ->
         if l.clicked() {
             d.use_code = false;
         }
-        ui.add_enabled(on && !d.use_code, egui::TextEdit::singleline(&mut d.overlay).desired_width(220.0)).labelled_by(l.id);
+        ui.add_enabled(on && !d.use_code, crate::widgets::line(&mut d.overlay).desired_width(220.0)).labelled_by(l.id);
         ui.end_row();
         if ui.add_enabled(on, egui::RadioButton::new(d.use_code, tl!("Redaction code:"))).clicked() {
             d.use_code = true;
diff --git a/crates/ui-egui/src/scroll_speed.rs b/crates/ui-egui/src/scroll_speed.rs
new file mode 100644
index 00000000..af8d0fe3
--- /dev/null
+++ b/crates/ui-egui/src/scroll_speed.rs
@@ -0,0 +1,119 @@
+//! How far a mouse-wheel notch scrolls (#444, #186).
+//!
+//! egui scrolls `line_scroll_speed` points per wheel line: 40 on the desktop, 8 on the web.
+//! macOS already accelerates line deltas, and browsers there scroll about that far per line,
+//! but on Windows and Linux winit reports one line per notch, where browsers scroll about
+//! 100 pixels, so 40 felt slow. Wheel input reported in points (most trackpads) keeps its own
+//! speed, ⌘/Ctrl-wheel zoom keeps egui's rate, and wheel paging in Single page view still turns
+//! one page per notch.
+
+/// The user's choice, relative to the platform's normal speed.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum ScrollSpeed {
+    Slow,
+    #[default]
+    Normal,
+    Fast,
+}
+
+/// egui's own `line_scroll_speed`, which its wheel zoom rate is tuned against.
+const EGUI_LINE_POINTS: f32 = if cfg!(target_arch = "wasm32") { 8.0 } else { 40.0 };
+
+/// Points one wheel line scrolls at Normal speed.
+const NORMAL_LINE_POINTS: f32 = if cfg!(target_arch = "wasm32") {
+    // The browser's line deltas, which egui already scales for the web.
+    8.0
+} else if cfg!(target_os = "macos") {
+    40.0
+} else {
+    100.0
+};
+
+impl ScrollSpeed {
+    pub const ALL: [Self; 3] = [Self::Slow, Self::Normal, Self::Fast];
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Slow => "Slow",
+            Self::Normal => "Normal",
+            Self::Fast => "Fast",
+        }
+    }
+
+    /// Points one wheel line scrolls.
+    pub fn line_points(self) -> f32 {
+        NORMAL_LINE_POINTS
+            * match self {
+                Self::Slow => 0.5,
+                Self::Normal => 1.0,
+                Self::Fast => 2.0,
+            }
+    }
+
+    /// Makes egui scroll this far per wheel line, from this frame's input on (call it before egui
+    /// reads `raw`). egui scales line deltas before turning ⌘/Ctrl-wheel motion into zoom, so
+    /// those events are scaled back to keep zooming at egui's own rate.
+    pub(crate) fn apply(self, ctx: &egui::Context, raw: &mut egui::RawInput) {
+        self.set_line_speed(ctx);
+        let points = self.line_points();
+        let zoom_scale = EGUI_LINE_POINTS / points;
+        for event in &mut raw.events {
+            if let egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Line, delta, modifiers, .. } = event
+                && modifiers.command
+            {
+                *delta *= zoom_scale;
+            }
+        }
+    }
+
+    /// Makes egui scroll this far per wheel line (from the next frame when called during one).
+    pub(crate) fn set_line_speed(self, ctx: &egui::Context) {
+        let points = self.line_points();
+        if ctx.options(|o| o.input_options.line_scroll_speed) != points {
+            ctx.options_mut(|o| o.input_options.line_scroll_speed = points);
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        Self::ALL.into_iter().find(|s| s.label().eq_ignore_ascii_case(value))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn wheel(unit: egui::MouseWheelUnit, dy: f32, command: bool) -> egui::Event {
+        let modifiers = egui::Modifiers { command, ..egui::Modifiers::NONE };
+        egui::Event::MouseWheel { unit, delta: egui::vec2(0.0, dy), phase: egui::TouchPhase::Move, modifiers }
+    }
+
+    #[test]
+    fn zoom_keeps_egui_rate_and_scrolling_follows_the_choice() {
+        let ctx = egui::Context::default();
+        for speed in ScrollSpeed::ALL {
+            let mut raw = egui::RawInput {
+                events: vec![
+                    wheel(egui::MouseWheelUnit::Line, 1.0, true),
+                    wheel(egui::MouseWheelUnit::Line, 1.0, false),
+                    wheel(egui::MouseWheelUnit::Point, 30.0, true),
+                ],
+                ..Default::default()
+            };
+            speed.apply(&ctx, &mut raw);
+            assert_eq!(ctx.options(|o| o.input_options.line_scroll_speed), speed.line_points());
+            let dy: Vec<f32> =
+                raw.events.iter().filter_map(|e| if let egui::Event::MouseWheel { delta, .. } = e { Some(delta.y) } else { None }).collect();
+            // ⌘/Ctrl lines scaled back so egui's zoom sees EGUI_LINE_POINTS per line; plain lines
+            // and point deltas untouched.
+            assert!((dy[0] * speed.line_points() - EGUI_LINE_POINTS).abs() < 1e-3, "{speed:?}: {dy:?}");
+            assert_eq!((dy[1], dy[2]), (1.0, 30.0));
+        }
+        assert_eq!(ScrollSpeed::parse("FAST"), Some(ScrollSpeed::Fast));
+        assert_eq!(ScrollSpeed::parse("warp"), None);
+        // The labels are translated in their own context: they qualify "speed".
+        let ru = crate::i18n::Lang::from_code("ru").expect("Russian ships");
+        assert_eq!(crate::i18n::tr_ctx(ru, "scroll speed", ScrollSpeed::Slow.label()), "Низкая");
+    }
+}
diff --git a/crates/ui-egui/src/search_ui.rs b/crates/ui-egui/src/search_ui.rs
index edf99b72..c23968ba 100644
--- a/crates/ui-egui/src/search_ui.rs
+++ b/crates/ui-egui/src/search_ui.rs
@@ -11,14 +11,13 @@ use crate::theme::{self, Tokens};
 const CONTEXT: usize = 36;
 
 pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, view: &mut DocView, pages: usize) {
+    crate::widgets::begin_dialog(ui);
     let searched = view.texts.len() + view.text_failed.len();
     let Some(find) = view.find.as_mut() else { return };
     find.in_panel = true;
     let l = ui.label(egui::RichText::new(tl!("What word or phrase would you like to search for?")).color(t.text_muted));
     let r = ui
-        .add(
-            egui::TextEdit::singleline(&mut find.query).id(egui::Id::new("search-panel-input")).hint_text(tl!("Search")).desired_width(f32::INFINITY),
-        )
+        .add(crate::widgets::line(&mut find.query).id(egui::Id::new("search-panel-input")).hint_text(tl!("Search")).desired_width(f32::INFINITY))
         .labelled_by(l.id);
     if find.focus {
         r.request_focus();
diff --git a/crates/ui-egui/src/sign_ui.rs b/crates/ui-egui/src/sign_ui.rs
index 6dda6348..14f90956 100644
--- a/crates/ui-egui/src/sign_ui.rs
+++ b/crates/ui-egui/src/sign_ui.rs
@@ -6,9 +6,10 @@ use std::path::PathBuf;
 
 use egui::{Align, Color32, CornerRadius, Layout, Pos2, Rect, Stroke, vec2};
 use pdfcraft_engine::sign::{self, Appearance, Certificate, DigitalId, Modification, Name, PrivateKey};
-use pdfcraft_engine::{SignOptions, SignatureInfo, SignatureStatus};
+use pdfcraft_engine::{SignOptions, SignatureImage, SignatureInfo, SignatureStatus};
 
 use crate::canvas::{DocView, PageXform};
+use crate::fill_sign::SavedSig;
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, icons, widgets};
 
@@ -76,6 +77,19 @@ impl Default for NewIdDraft {
     }
 }
 
+/// What a visible signature shows on its left (Acrobat: Configure Signature Appearance ▸ Text,
+/// Draw or Image). The one last signed with is remembered.
+#[derive(Clone, Debug, Default, PartialEq, serde::Serialize, serde::Deserialize)]
+pub enum SignGraphic {
+    /// The signer's name in large type (when Name is on).
+    #[default]
+    Name,
+    /// The saved Fill & Sign signature, as it is when signing.
+    FillSign,
+    /// An imported PNG or JPEG.
+    Image(#[serde(with = "crate::fill_sign::image_data")] SignatureImage),
+}
+
 /// The signing dialogs' state.
 #[derive(Clone, Debug, PartialEq)]
 pub struct SignDraft {
@@ -92,6 +106,9 @@ pub struct SignDraft {
     pub reason: String,
     pub location: String,
     pub appearance: Appearance,
+    pub graphic: SignGraphic,
+    /// The image the dialog holds (remembered or chosen), so Image can be chosen again.
+    pub image: Option<SignatureImage>,
     pub new_id: NewIdDraft,
     pub error: Option<String>,
 }
@@ -111,6 +128,8 @@ impl SignDraft {
             reason: String::new(),
             location: String::new(),
             appearance: Appearance::default(),
+            graphic: SignGraphic::Name,
+            image: None,
             new_id: NewIdDraft::default(),
             error: None,
         }
@@ -247,7 +266,15 @@ impl PdfCraftApp {
     /// Start signing: the rectangle (or field) is known; show Sign with a Digital ID.
     pub fn start_signing(&mut self, page: usize, rect: Option<[f64; 4]>, field: Option<String>, certify: Option<u8>) {
         self.refresh_os_key_store_ids();
-        self.sign_draft = Some(SignDraft::new(page, rect, field, certify, &self.digital_ids));
+        let mut draft = SignDraft::new(page, rect, field, certify, &self.digital_ids);
+        draft.graphic = match &self.sign_graphic {
+            SignGraphic::FillSign if self.signature.is_none() => SignGraphic::Name,
+            g => g.clone(),
+        };
+        if let SignGraphic::Image(image) = &self.sign_graphic {
+            draft.image = Some(image.clone());
+        }
+        self.sign_draft = Some(draft);
         self.dialog = Some(crate::Dialog::Sign);
     }
 
@@ -259,7 +286,12 @@ impl PdfCraftApp {
             match sign::keychain::identities(None) {
                 Ok(ids) => {
                     for id in ids {
-                        self.digital_ids.push(entry_for(&sign::keychain::reference(&id.certificate), &id.certificate));
+                        let mut entry = entry_for(&sign::keychain::reference(&id.certificate), &id.certificate);
+                        // Smart card identities say so ("… (smart card)").
+                        if let Some(name) = id.friendly_name {
+                            entry.name = name;
+                        }
+                        self.digital_ids.push(entry);
                     }
                 }
                 Err(e) => self.notify_fmt("The Keychain's digital IDs couldn't be listed: {e}", &[("e", &e.to_string())]),
@@ -363,6 +395,12 @@ impl PdfCraftApp {
             })?
         };
         let some = |s: &str| (!s.trim().is_empty()).then(|| s.trim().to_string());
+        // Only a visible signature shows its graphic.
+        let graphic = match self.graphic_sig(&d.graphic) {
+            Some(saved) if d.rect.is_some() || d.field.is_some() => Some(saved.graphic().ok_or("The saved signature has nothing to draw.")?),
+            _ => None,
+        };
+        let choice = d.graphic.clone();
         let opts = SignOptions {
             field: d.field.clone(),
             page: d.page,
@@ -371,6 +409,7 @@ impl PdfCraftApp {
             location: some(&d.location),
             certify: d.certify,
             appearance: d.appearance.clone(),
+            graphic,
             ..SignOptions::default()
         };
         // Signing saves, as in Acrobat: choose where (a cancelled save cancels signing). The
@@ -385,7 +424,11 @@ impl PdfCraftApp {
             }
             let signed = app.session.sign(doc_id, &id, opts).map_err(|e| e.to_string())?;
             crate::editing::write_atomically(&path.to_string_lossy(), signed.as_slice()).map_err(|e| format!("Could not save: {e}"))?;
+            // Our own write is not a change on disk to reload (#431).
+            #[cfg(not(target_arch = "wasm32"))]
+            app.watch.known_now(doc_id, &path.to_string_lossy());
             app.session.mark_signed(doc_id, signed, Some(path.to_string_lossy().into_owned())).map_err(|e| e.to_string())?;
+            app.sign_graphic = choice;
             if let Some(view) = app.views.iter_mut().find(|v| v.id == doc_id) {
                 view.invalidate_content();
             }
@@ -419,6 +462,37 @@ impl PdfCraftApp {
         }
     }
 
+    /// The saved signature or image `g` stands for (`None`: the name).
+    fn graphic_sig(&self, g: &SignGraphic) -> Option<SavedSig> {
+        graphic_of(self.signature.as_ref(), g)
+    }
+
+    /// Sign as ▸ Choose image…: answered only into the signing dialog that asked.
+    #[cfg(not(target_arch = "wasm32"))]
+    pub(crate) fn pick_sign_graphic_image(&mut self) {
+        let epoch = self.dialog_epoch();
+        let dialog = rfd::AsyncFileDialog::new().add_filter(tl!("Image"), &["png", "jpg", "jpeg"]);
+        self.ask_one(crate::pickers::Ask::File(dialog), None, move |app, path| {
+            if app.dialog_epoch() != epoch || app.dialog != Some(crate::Dialog::Sign) {
+                return;
+            }
+            // Scanned paper becomes transparent, as for Fill & Sign image signatures.
+            let image = std::fs::File::open(path)
+                .map_err(pdfcraft_engine::signature_image::SignatureImageError::from)
+                .and_then(SignatureImage::read)
+                .and_then(|image| image.remove_white_background(245, 35));
+            match (image, app.sign_draft.as_mut()) {
+                (Ok(image), Some(d)) => {
+                    d.graphic = SignGraphic::Image(image.clone());
+                    d.image = Some(image);
+                    d.error = None;
+                }
+                (Ok(_), None) => {}
+                (Err(e), _) => app.notify_fmt("Couldn't import the signature image: {e}", &[("e", &e.to_string())]),
+            }
+        });
+    }
+
     /// Trust a certificate (Signatures panel ▸ Add to trusted certificates), revalidating.
     pub fn trust_certificate(&mut self, cert: Certificate) {
         let mut certs = self.session.trusted_certificates().to_vec();
@@ -477,7 +551,7 @@ fn title(ui: &mut egui::Ui, text: &str) {
 
 fn error(ui: &mut egui::Ui, err: &Option<String>) {
     if let Some(e) = err.as_ref().filter(|e| !e.is_empty()) {
-        ui.colored_label(Color32::from_rgb(0xD7, 0x37, 0x3F), e);
+        ui.colored_label(Color32::from_rgb(0xD7, 0x37, 0x3F), tl!(e));
         ui.add_space(4.0);
     }
 }
@@ -591,11 +665,11 @@ fn configure(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
                 (tl!("Email Address"), &mut n.email),
             ] {
                 let l = ui.label(label);
-                ui.add(egui::TextEdit::singleline(value).desired_width(260.0)).labelled_by(l.id);
+                ui.add(crate::widgets::line(value).desired_width(260.0)).labelled_by(l.id);
                 ui.end_row();
             }
             let l = ui.label(tl!("Country/Region"));
-            ui.add(egui::TextEdit::singleline(&mut n.country).hint_text("US").char_limit(2).desired_width(60.0)).labelled_by(l.id);
+            ui.add(crate::widgets::line(&mut n.country).hint_text("US").char_limit(2).desired_width(60.0)).labelled_by(l.id);
             ui.end_row();
             ui.label(tl!("Key Algorithm"));
             egui::ComboBox::from_id_salt("key-alg").selected_text(KEY_ALGORITHMS[n.key].0).show_ui(ui, |ui| {
@@ -605,10 +679,10 @@ fn configure(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
             });
             ui.end_row();
             let l = ui.label(tl!("Password"));
-            ui.add(egui::TextEdit::singleline(&mut n.password).password(true).desired_width(200.0)).labelled_by(l.id);
+            ui.add(crate::widgets::line(&mut n.password).password(true).desired_width(200.0)).labelled_by(l.id);
             ui.end_row();
             let l = ui.label(tl!("Confirm Password"));
-            ui.add(egui::TextEdit::singleline(&mut n.confirm).password(true).desired_width(200.0)).labelled_by(l.id);
+            ui.add(crate::widgets::line(&mut n.confirm).password(true).desired_width(200.0)).labelled_by(l.id);
             ui.end_row();
         });
         ui.label(
@@ -620,7 +694,7 @@ fn configure(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
         egui::Grid::new("id-file").num_columns(2).spacing([12.0, 8.0]).show(ui, |ui| {
             let l = ui.label(tl!("File (.p12, .pfx)"));
             ui.horizontal(|ui| {
-                ui.add(egui::TextEdit::singleline(&mut n.file).desired_width(220.0)).labelled_by(l.id);
+                ui.add(crate::widgets::line(&mut n.file).desired_width(220.0)).labelled_by(l.id);
                 #[cfg(not(target_arch = "wasm32"))]
                 if ui.button(tl!("Browse…")).clicked() {
                     browse = true;
@@ -628,7 +702,7 @@ fn configure(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
             });
             ui.end_row();
             let l = ui.label(tl!("Password"));
-            ui.add(egui::TextEdit::singleline(&mut n.file_password).password(true).desired_width(200.0)).labelled_by(l.id);
+            ui.add(crate::widgets::line(&mut n.file_password).password(true).desired_width(200.0)).labelled_by(l.id);
             ui.end_row();
         });
     }
@@ -682,17 +756,29 @@ fn configure(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
 }
 
 /// The appearance preview: Acrobat's standard layout (name left, details right).
-fn preview(ui: &mut egui::Ui, t: &Tokens, name: &str, d: &SignDraft) {
+/// The saved signature or image `g` stands for, given the saved Fill & Sign `signature`.
+fn graphic_of(signature: Option<&SavedSig>, g: &SignGraphic) -> Option<SavedSig> {
+    match g {
+        SignGraphic::Name => None,
+        SignGraphic::FillSign => signature.cloned(),
+        SignGraphic::Image(image) => Some(SavedSig::Image(image.clone())),
+    }
+}
+
+/// The signature as it will look: the graphic (or the name) on the left, the details beside it.
+fn preview(
+    ui: &mut egui::Ui,
+    t: &Tokens,
+    name: &str,
+    d: &SignDraft,
+    graphic: Option<&SavedSig>,
+    cache: &mut Option<(SavedSig, egui::TextureHandle)>,
+) {
     let (rect, _) = ui.allocate_exact_size(vec2(ui.available_width(), 96.0), egui::Sense::hover());
     let bg = if t.dark() { Color32::from_gray(0xF4) } else { Color32::WHITE };
     ui.painter().rect(rect, CornerRadius::same(4), bg, Stroke::new(1.0, t.border), egui::StrokeKind::Inside);
     let inner = rect.shrink(10.0);
     let a = &d.appearance;
-    if a.name {
-        let half = Rect::from_min_size(inner.min, vec2(inner.width() * 0.5 - 6.0, inner.height()));
-        let galley = ui.painter().layout(name.to_string(), theme::regular(22.0), Color32::BLACK, half.width());
-        ui.painter().galley(half.left_center() - vec2(0.0, galley.size().y / 2.0), galley, Color32::BLACK);
-    }
     let mut lines = Vec::new();
     if a.name {
         lines.push(if a.labels { format!("Digitally signed by {name}") } else { name.to_string() });
@@ -706,7 +792,16 @@ fn preview(ui: &mut egui::Ui, t: &Tokens, name: &str, d: &SignDraft) {
     if a.date {
         lines.push(format!("{}{}", if a.labels { "Date: " } else { "" }, "(the signing time)"));
     }
-    let x = if a.name { inner.center().x + 6.0 } else { inner.left() };
+    // As in the signature itself: a graphic with no details beside it fills the box.
+    let alone = graphic.is_some() && lines.is_empty();
+    let half = Rect::from_min_size(inner.min, vec2(inner.width() * 0.5 - 6.0, inner.height()));
+    if let Some(g) = graphic {
+        crate::fill_sign::paint_saved(ui, if alone { inner } else { half }, g, cache, "sign-graphic");
+    } else if a.name {
+        let galley = ui.painter().layout(name.to_string(), theme::regular(22.0), Color32::BLACK, half.width());
+        ui.painter().galley(half.left_center() - vec2(0.0, galley.size().y / 2.0), galley, Color32::BLACK);
+    }
+    let x = if (a.name || graphic.is_some()) && !alone { inner.center().x + 6.0 } else { inner.left() };
     let galley = ui.painter().layout(lines.join("\n"), theme::regular(11.0), Color32::from_gray(0x20), inner.right() - x);
     ui.painter().galley(egui::pos2(x, inner.center().y - galley.size().y / 2.0), galley, Color32::BLACK);
 }
@@ -728,9 +823,12 @@ fn sign_as(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
     let in_os_key_store = entry.path.starts_with("keychain:") || entry.path.starts_with("windows:");
     let mut close = false;
     let mut go = false;
+    #[cfg(not(target_arch = "wasm32"))]
+    let mut pick = false;
     if d.rect.is_some() || d.field.is_some() {
         ui.label(egui::RichText::new(tl!("Appearance")).font(theme::semibold(12.5)));
-        preview(ui, t, &entry.name, d);
+        let graphic = graphic_of(app.signature.as_ref(), &d.graphic);
+        preview(ui, t, &entry.name, d, graphic.as_ref(), &mut app.sign_graphic_preview);
         ui.horizontal_wrapped(|ui| {
             let a = &mut d.appearance;
             ui.checkbox(&mut a.name, tl!("Name"));
@@ -740,6 +838,27 @@ fn sign_as(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
             ui.checkbox(&mut a.distinguished_name, tl!("Distinguished name"));
             ui.checkbox(&mut a.labels, tl!("Labels"));
         });
+        // Acrobat: Configure Signature Appearance, Text, Draw or Image.
+        ui.horizontal_wrapped(|ui| {
+            ui.label(tl!("Graphic"));
+            ui.radio_value(&mut d.graphic, SignGraphic::Name, tl!("Signer's name"));
+            ui.add_enabled_ui(app.signature.is_some(), |ui| {
+                if ui.radio(d.graphic == SignGraphic::FillSign, tl!("Fill & Sign signature")).clicked() {
+                    d.graphic = SignGraphic::FillSign;
+                }
+            });
+            ui.add_enabled_ui(d.image.is_some(), |ui| {
+                if ui.radio(matches!(d.graphic, SignGraphic::Image(_)), tl!("Image")).clicked()
+                    && let Some(image) = &d.image
+                {
+                    d.graphic = SignGraphic::Image(image.clone());
+                }
+            });
+            #[cfg(not(target_arch = "wasm32"))]
+            if widgets::pill_button(ui, tl!("Choose image…"), false).clicked() {
+                pick = true;
+            }
+        });
         ui.add_space(6.0);
     } else {
         ui.label(egui::RichText::new(tl!("The signature will be invisible.")).color(t.text_muted));
@@ -762,10 +881,10 @@ fn sign_as(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
             ui.end_row();
         }
         let l = ui.label(tl!("Reason"));
-        ui.add(egui::TextEdit::singleline(&mut d.reason).hint_text(tl!("Optional")).desired_width(260.0)).labelled_by(l.id);
+        ui.add(crate::widgets::line(&mut d.reason).hint_text(tl!("Optional")).desired_width(260.0)).labelled_by(l.id);
         ui.end_row();
         let l = ui.label(tl!("Location"));
-        ui.add(egui::TextEdit::singleline(&mut d.location).hint_text(tl!("Optional")).desired_width(260.0)).labelled_by(l.id);
+        ui.add(crate::widgets::line(&mut d.location).hint_text(tl!("Optional")).desired_width(260.0)).labelled_by(l.id);
         ui.end_row();
         if in_os_key_store {
             ui.label("");
@@ -780,7 +899,7 @@ fn sign_as(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
             );
         } else {
             let l = ui.label(tl!("Digital ID password"));
-            let r = ui.add(egui::TextEdit::singleline(&mut d.password).password(true).desired_width(200.0)).labelled_by(l.id);
+            let r = ui.add(crate::widgets::line(&mut d.password).password(true).desired_width(200.0)).labelled_by(l.id);
             if r.lost_focus() && ui.input(|i| i.key_pressed(egui::Key::Enter)) {
                 go = true;
             }
@@ -803,6 +922,10 @@ fn sign_as(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool {
             }
         });
     });
+    #[cfg(not(target_arch = "wasm32"))]
+    if pick {
+        app.pick_sign_graphic_image();
+    }
     if go {
         match app.finish_signing() {
             Ok(()) => {
@@ -832,7 +955,12 @@ pub(crate) fn banner(sigs: &[SignatureInfo]) -> Option<(&'static str, Color32, &
     {
         let by = c.certificate.as_ref().map(|x| {
             let org = x.subject.organization().map(|o| format!(", {o}")).unwrap_or_default();
-            format!("{}{org}, certificate issued by {}.", x.display_name(), x.issuer.common_name().unwrap_or("an unknown issuer"))
+            let who = format!("{}{org}", x.display_name());
+            let (template, issuer) = match x.issuer.common_name() {
+                Some(issuer) => ("{who}, certificate issued by {issuer}.", issuer),
+                None => ("{who}, certificate issued by an unknown issuer.", ""),
+            };
+            crate::i18n::fmt(tl!(template), &[("who", &who), ("issuer", issuer)])
         });
         return Some(("badge-check", Color32::from_rgb(0x14, 0x73, 0xE6), "Certified by {by}", by.unwrap_or_default()));
     }
@@ -893,16 +1021,14 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, sigs: &[SignatureInfo], expan
     for s in ordered {
         let open = expanded.contains(&s.field);
         let (icon, color) = status_icon(s);
-        let head = if s.signed {
-            format!(
-                "Rev. {}: {} by {}",
-                s.revision,
-                if s.certify.is_some() { "Certified" } else { "Signed" },
-                s.signer.as_deref().unwrap_or("an unknown signer")
-            )
-        } else {
-            format!("Unsigned signature field: {}", s.field)
+        let (template, name) = match (s.signed, s.certify.is_some(), s.signer.as_deref()) {
+            (false, ..) => ("Unsigned signature field: {name}", s.field.as_str()),
+            (true, true, Some(signer)) => ("Rev. {rev}: Certified by {name}", signer),
+            (true, true, None) => ("Rev. {rev}: Certified by an unknown signer", ""),
+            (true, false, Some(signer)) => ("Rev. {rev}: Signed by {name}", signer),
+            (true, false, None) => ("Rev. {rev}: Signed by an unknown signer", ""),
         };
+        let head = crate::i18n::fmt(tl!(template), &[("rev", &s.revision.to_string()), ("name", name)]);
         let resp = ui
             .horizontal(|ui| {
                 let chevron = if open { "chevron-down" } else { "chevron-right" };
@@ -938,7 +1064,10 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, sigs: &[SignatureInfo], expan
                 })
                 .font(theme::semibold(12.0)),
             );
-            for line in &s.details {
+            for detail in &s.details {
+                // Each detail is a whole sentence of ours plus what the signature itself says; said
+                // here in the panel's language, with the signature's own words left as they are.
+                let line = detail.said(&crate::i18n::words);
                 ui.add(egui::Label::new(egui::RichText::new(format!("• {line}")).font(theme::regular(11.5)).color(t.text_muted)).wrap());
             }
             ui.add_space(4.0);
@@ -985,7 +1114,10 @@ pub(crate) fn panel(ui: &mut egui::Ui, t: &Tokens, sigs: &[SignatureInfo], expan
             }
             ui.add_space(4.0);
             ui.horizontal_wrapped(|ui| {
-                if let Some(c) = s.chain.last().or(s.certificate.as_ref())
+                // Trust exactly the signer shown above (s.certificate), not the chain top the
+                // document embedded: trusting an issuer or root is a separate, explicit step in
+                // the Certificate Viewer's Trust tab, which names that certificate.
+                if let Some(c) = s.certificate.as_ref()
                     && s.status == SignatureStatus::Unknown
                     && ui.button(tl!("Add to trusted certificates")).clicked()
                 {
@@ -1043,8 +1175,8 @@ fn key_usage(bits: u16) -> String {
         "Encipher Only",
         "Decipher Only",
     ];
-    let used: Vec<&str> = NAMES.iter().enumerate().filter(|(i, _)| bits & (1 << i) != 0).map(|(_, n)| *n).collect();
-    if used.is_empty() { "None".into() } else { used.join(", ") }
+    let used: Vec<&str> = NAMES.iter().enumerate().filter(|(i, _)| bits & (1 << i) != 0).map(|(_, n)| tl!(*n)).collect();
+    if used.is_empty() { tl!("None").into() } else { used.join(", ") }
 }
 
 /// What the viewer asks for.
diff --git a/crates/ui-egui/src/stamps_ui.rs b/crates/ui-egui/src/stamps_ui.rs
index 4288c889..1da56c28 100644
--- a/crates/ui-egui/src/stamps_ui.rs
+++ b/crates/ui-egui/src/stamps_ui.rs
@@ -65,7 +65,7 @@ pub(crate) fn create_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens)
     egui::Grid::new("stamp-create").num_columns(2).spacing([10.0, 8.0]).show(ui, |ui| {
         let l = ui.label(tl!("Category:"));
         ui.horizontal(|ui| {
-            ui.add(egui::TextEdit::singleline(&mut d.category).desired_width(200.0).hint_text(tl!("e.g. My stamps"))).labelled_by(l.id);
+            ui.add(crate::widgets::line(&mut d.category).desired_width(200.0).hint_text(tl!("e.g. My stamps"))).labelled_by(l.id);
             if !categories.is_empty() {
                 egui::ComboBox::from_id_salt("stamp-categories").selected_text("").width(24.0).show_ui(ui, |ui| {
                     for c in &categories {
@@ -78,7 +78,7 @@ pub(crate) fn create_body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens)
         });
         ui.end_row();
         let l = ui.label(tl!("Name:"));
-        ui.add(egui::TextEdit::singleline(&mut d.name).desired_width(200.0)).labelled_by(l.id);
+        ui.add(crate::widgets::line(&mut d.name).desired_width(200.0)).labelled_by(l.id);
         ui.end_row();
     });
     ui.add_space(12.0);
diff --git a/crates/ui-egui/src/standards_ui.rs b/crates/ui-egui/src/standards_ui.rs
index 4f0816f7..55f64349 100644
--- a/crates/ui-egui/src/standards_ui.rs
+++ b/crates/ui-egui/src/standards_ui.rs
@@ -86,7 +86,9 @@ pub(crate) fn body(ui: &mut egui::Ui, app: &mut PdfCraftApp, t: &Tokens) -> bool
                     for i in v {
                         let page = i.page.map(|p| crate::i18n::fmt(tl!(" (page {p})"), &[("p", &(p + 1).to_string())])).unwrap_or_default();
                         let fix = if i.fixable { String::new() } else { tl!("  · not fixable here").to_string() };
-                        ui.label(format!("{}{page}", i.message));
+                        // The verifier hands the wording over whole, with the document's own name
+                        // apart from it, so the problem reads in this language and the name as it is.
+                        ui.label(format!("{}{page}", i.said(&crate::i18n::words)));
                         ui.label(egui::RichText::new(format!("ISO 19005 {}{fix}", i.clause)).small().color(t.text_muted));
                     }
                 }
diff --git a/crates/ui-egui/src/system_fonts.rs b/crates/ui-egui/src/system_fonts.rs
index a7a77d70..3c6e2a83 100644
--- a/crates/ui-egui/src/system_fonts.rs
+++ b/crates/ui-egui/src/system_fonts.rs
@@ -2,8 +2,9 @@
 //!
 //! The embedded faces (Inter, egui's defaults, craft-fonts) come first in every family; this one
 //! only draws characters none of them has, such as an Arabic file name in a build without
-//! craft-fonts. It is read at runtime and never embedded or shipped (AGENTS.md §1.4), and
-//! `PDFCRAFT_SYSTEM_FONTS=0` turns it off (published screenshots do).
+//! craft-fonts, or the Simplified Chinese interface in a build without a `Hans` face (#826). It is
+//! read at runtime and never embedded or shipped (AGENTS.md §1.4), and `PDFCRAFT_SYSTEM_FONTS=0`
+//! turns it off (published screenshots do).
 
 use std::path::{Path, PathBuf};
 use std::sync::{Arc, OnceLock};
@@ -12,36 +13,73 @@ use egui::FontData;
 
 /// Larger files are not read: a font path is still untrusted input.
 const MAX_BYTES: u64 = 32 << 20;
+/// Chinese system faces are big collections (PingFang, STHeiti), so they get a higher cap.
+const MAX_HAN_BYTES: u64 = 96 << 20;
 /// Faces tried in a collection (`.ttc`).
 const MAX_FACES: u32 = 16;
 /// Arabic letter alef: the face must have it to be worth loading.
 const PROBE: char = '\u{0627}';
+/// 欢 (U+6B22): Simplified only, absent from the Japanese craft-fonts faces.
+const HANS_PROBE: char = '\u{6B22}';
+/// 說 (U+8AAA): Traditional only, absent from the Japanese craft-fonts faces.
+const HANT_PROBE: char = '\u{8AAA}';
 
-/// The installed fallback face, read once. `None` when it is turned off or no candidate fits.
-pub fn fallback() -> Option<Arc<FontData>> {
-    static CACHE: OnceLock<Option<Arc<FontData>>> = OnceLock::new();
-    CACHE.get_or_init(load).clone()
+/// What the installed face is wanted for, from the interface language.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum Need {
+    /// Scripts no embedded face has (Arabic in a build without craft-fonts).
+    #[default]
+    Other,
+    /// Simplified Chinese interface text.
+    Hans,
+    /// Traditional Chinese interface text.
+    Hant,
 }
 
-fn load() -> Option<Arc<FontData>> {
+/// The installed fallback face for `need`, read once per need. `None` when it is turned off or no
+/// candidate fits.
+pub fn fallback(need: Need) -> Option<Arc<FontData>> {
+    static OTHER: OnceLock<Option<Arc<FontData>>> = OnceLock::new();
+    static HANS: OnceLock<Option<Arc<FontData>>> = OnceLock::new();
+    static HANT: OnceLock<Option<Arc<FontData>>> = OnceLock::new();
+    let cache = match need {
+        Need::Other => &OTHER,
+        Need::Hans => &HANS,
+        Need::Hant => &HANT,
+    };
+    cache.get_or_init(|| load(need)).clone()
+}
+
+fn load(need: Need) -> Option<Arc<FontData>> {
     if std::env::var_os("PDFCRAFT_SYSTEM_FONTS").is_some_and(|v| v == "0") {
         return None;
     }
-    candidates().iter().find_map(|path| read(path))
+    let (probe, max) = match need {
+        Need::Other => (PROBE, MAX_BYTES),
+        Need::Hans => (HANS_PROBE, MAX_HAN_BYTES),
+        Need::Hant => (HANT_PROBE, MAX_HAN_BYTES),
+    };
+    candidates(need).iter().find_map(|path| read(path, probe, max))
 }
 
 /// Well-known locations of faces with broad script coverage, best first.
-fn candidates() -> Vec<PathBuf> {
+fn candidates(need: Need) -> Vec<PathBuf> {
+    match need {
+        Need::Other => other_candidates(),
+        Need::Hans | Need::Hant => han_candidates(need == Need::Hant),
+    }
+}
+
+fn other_candidates() -> Vec<PathBuf> {
     if cfg!(windows) {
-        let dir = std::env::var_os("WINDIR").or_else(|| std::env::var_os("SystemRoot")).map_or_else(|| PathBuf::from(r"C:\Windows"), PathBuf::from);
-        ["segoeui.ttf", "tahoma.ttf", "arial.ttf"].iter().map(|f| dir.join("Fonts").join(f)).collect()
+        ["segoeui.ttf", "tahoma.ttf", "arial.ttf"].iter().map(|f| windows_fonts().join(f)).collect()
     } else if cfg!(target_os = "macos") {
         ["/System/Library/Fonts/SFArabic.ttf", "/System/Library/Fonts/GeezaPro.ttc", "/System/Library/Fonts/Supplemental/Arial.ttf"]
             .iter()
             .map(PathBuf::from)
             .collect()
     } else {
-        let files = [
+        unix_fonts(&[
             "truetype/noto/NotoSansArabic-Regular.ttf",
             "noto/NotoSansArabic-Regular.ttf",
             "google-noto/NotoSansArabic-Regular.ttf",
@@ -49,21 +87,61 @@ fn candidates() -> Vec<PathBuf> {
             "TTF/DejaVuSans.ttf",
             "dejavu/DejaVuSans.ttf",
             "dejavu-sans-fonts/DejaVuSans.ttf",
-        ];
-        ["/usr/share/fonts", "/usr/local/share/fonts"].iter().flat_map(|dir| files.iter().map(move |f| Path::new(dir).join(f))).collect()
+        ])
     }
 }
 
-fn read(path: &Path) -> Option<Arc<FontData>> {
+/// Chinese sans faces the operating system ships, the UI language's own region first. Noto CJK
+/// and Source Han are left out on purpose (AGENTS.md §1.1).
+fn han_candidates(traditional: bool) -> Vec<PathBuf> {
+    if cfg!(windows) {
+        // Microsoft YaHei / JhengHei, then the older SimSun / MingLiU collections.
+        let files: &[&str] =
+            if traditional { &["msjh.ttc", "msyh.ttc", "mingliu.ttc", "simsun.ttc"] } else { &["msyh.ttc", "msjh.ttc", "simsun.ttc", "mingliu.ttc"] };
+        files.iter().map(|f| windows_fonts().join(f)).collect()
+    } else if cfg!(target_os = "macos") {
+        let files: &[&str] = if traditional {
+            &["PingFang.ttc", "STHeiti Light.ttc", "STHeiti Medium.ttc", "Hiragino Sans GB.ttc"]
+        } else {
+            &["PingFang.ttc", "Hiragino Sans GB.ttc", "STHeiti Light.ttc", "STHeiti Medium.ttc"]
+        };
+        files.iter().map(|f| Path::new("/System/Library/Fonts").join(f)).collect()
+    } else {
+        unix_fonts(&[
+            "truetype/wqy/wqy-microhei.ttc",
+            "wenquanyi/wqy-microhei/wqy-microhei.ttc",
+            "wqy-microhei/wqy-microhei.ttc",
+            "truetype/wqy/wqy-zenhei.ttc",
+            "wenquanyi/wqy-zenhei/wqy-zenhei.ttc",
+            "wqy-zenhei/wqy-zenhei.ttc",
+            "truetype/droid/DroidSansFallbackFull.ttf",
+            "google-droid-sans-fonts/DroidSansFallbackFull.ttf",
+            "droid/DroidSansFallbackFull.ttf",
+            "truetype/arphic/uming.ttc",
+            "arphic-uming/uming.ttc",
+        ])
+    }
+}
+
+fn windows_fonts() -> PathBuf {
+    let dir = std::env::var_os("WINDIR").or_else(|| std::env::var_os("SystemRoot")).map_or_else(|| PathBuf::from(r"C:\Windows"), PathBuf::from);
+    dir.join("Fonts")
+}
+
+fn unix_fonts(files: &'static [&'static str]) -> Vec<PathBuf> {
+    ["/usr/share/fonts", "/usr/local/share/fonts"].iter().flat_map(|dir| files.iter().map(move |f| Path::new(dir).join(f))).collect()
+}
+
+fn read(path: &Path, probe: char, max: u64) -> Option<Arc<FontData>> {
     let meta = std::fs::metadata(path).ok()?;
-    if !meta.is_file() || meta.len() > MAX_BYTES {
+    if !meta.is_file() || meta.len() > max {
         return None;
     }
     let bytes = std::fs::read(path).ok()?;
-    let index = face_with(&bytes, PROBE)?;
+    let index = face_with(&bytes, probe)?;
     let mut data = FontData::from_owned(bytes);
     data.index = index;
-    log::info!("interface font fallback: {}", path.display());
+    log::info!("interface font fallback: {} (face {index})", path.display());
     Some(Arc::new(data))
 }
 
@@ -83,9 +161,9 @@ mod tests {
         assert_eq!(face_with(b"", PROBE), None);
         assert_eq!(face_with(b"not a font at all", PROBE), None);
         assert_eq!(face_with(&[0u8; 4096], PROBE), None);
-        assert!(read(Path::new("definitely/not/here.ttf")).is_none());
+        assert!(read(Path::new("definitely/not/here.ttf"), PROBE, MAX_BYTES).is_none());
         // A directory is not a font.
-        assert!(read(&std::env::temp_dir()).is_none());
+        assert!(read(&std::env::temp_dir(), PROBE, MAX_BYTES).is_none());
     }
 
     #[test]
@@ -93,13 +171,34 @@ mod tests {
         // Inter is Latin, Greek and Cyrillic only.
         let inter = include_bytes!("../../../assets/fonts/Inter-Regular.ttf");
         assert_eq!(face_with(inter, PROBE), None);
+        assert_eq!(face_with(inter, HANS_PROBE), None);
+        assert_eq!(face_with(inter, HANT_PROBE), None);
         assert_eq!(face_with(inter, 'A'), Some(0));
     }
 
+    #[test]
+    fn a_file_over_the_cap_is_not_read() {
+        let inter = Path::new(concat!(env!("CARGO_MANIFEST_DIR"), "/../../assets/fonts/Inter-Regular.ttf"));
+        assert!(read(inter, 'A', MAX_BYTES).is_some());
+        assert!(read(inter, 'A', 1024).is_none());
+    }
+
     #[test]
     fn candidates_are_absolute_font_files() {
-        let list = candidates();
-        assert!(!list.is_empty());
-        assert!(list.iter().all(|p| p.extension().is_some_and(|e| e == "ttf" || e == "ttc")));
+        for need in [Need::Other, Need::Hans, Need::Hant] {
+            let list = candidates(need);
+            assert!(!list.is_empty(), "{need:?}");
+            assert!(list.iter().all(|p| p.extension().is_some_and(|e| e == "ttf" || e == "ttc")), "{need:?}");
+        }
+    }
+
+    #[test]
+    fn han_candidates_skip_adobe_designs() {
+        for need in [Need::Hans, Need::Hant] {
+            for path in candidates(need) {
+                let name = path.to_string_lossy().to_lowercase();
+                assert!(!["notosanscjk", "notoserifcjk", "sourcehan", "source-han"].iter().any(|b| name.contains(b)), "{name}");
+            }
+        }
     }
 }
diff --git a/crates/ui-egui/src/theme.rs b/crates/ui-egui/src/theme.rs
index 1691f832..7d62a6b0 100644
--- a/crates/ui-egui/src/theme.rs
+++ b/crates/ui-egui/src/theme.rs
@@ -23,8 +23,7 @@ pub enum ThemePreference {
 
 impl ThemePreference {
     /// The colours to draw. `system` is what the operating system says, `None` when it says
-    /// nothing; `fallback` is then what the app last drew, so an unanswering desktop leaves the
-    /// user's choice alone.
+    /// nothing; `fallback` is supplied by the caller. PdfCraft uses Light for an unknown desktop.
     pub fn resolve(self, system: Option<bool>, fallback: ThemeKind) -> ThemeKind {
         match self {
             Self::Light => ThemeKind::Light,
@@ -134,28 +133,71 @@ pub fn install_fonts(ctx: &egui::Context) {
     ctx.set_fonts(font_definitions());
 }
 
+/// The interface language's claim on the CJK fallback faces.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum CjkPreference {
+    /// Japanese faces first (every non-Chinese language).
+    #[default]
+    Default,
+    SimplifiedChinese,
+    TraditionalChinese,
+}
+
+impl CjkPreference {
+    /// The preference for a UI language code (`zh-hans`, `zh-hant`, anything else).
+    pub fn for_language(code: &str) -> Self {
+        match code {
+            "zh-hans" => Self::SimplifiedChinese,
+            "zh-hant" => Self::TraditionalChinese,
+            _ => Self::Default,
+        }
+    }
+}
+
 /// Install the interface fonts with the CJK fallback order for the UI language (Chinese
-/// first for Simplified Chinese, Japanese first otherwise). Call it when the language
-/// changes; the new faces take effect next frame.
-pub fn install_fonts_for(ctx: &egui::Context, prefer_hans: bool) {
-    ctx.set_fonts(installed_font_definitions(prefer_hans));
+/// first for Chinese, Japanese first otherwise). Call it when the language changes; the new
+/// faces take effect next frame.
+pub fn install_fonts_for(ctx: &egui::Context, cjk: CjkPreference) {
+    ctx.set_fonts(installed_font_definitions(cjk));
 }
 
 /// The name of the installed face [`installed_font_definitions`] may add after the embedded ones.
 pub const SYSTEM_FALLBACK: &str = "system-fallback";
 
 /// What [`install_fonts_for`] installs: [`font_definitions_for`], then, on desktop, one face
-/// already installed on this machine as the last fallback of every family. It only draws
-/// characters no embedded face has (an Arabic file name in a build without craft-fonts);
+/// already installed on this machine. It only draws characters no embedded face has.
+///
+/// - In a Chinese interface built without a `Hans` craft-fonts face (every release so far,
+///   #826), it is a Chinese system face (Microsoft YaHei, PingFang, …), placed before the
+///   Japanese craft-fonts faces: they lack hundreds of the catalog's characters (欢, 导, 签, …),
+///   and one line drawn from two faces with different vertical metrics would not sit on one
+///   baseline.
+/// - Otherwise it is the last fallback of every family (an Arabic file name in a build without
+///   craft-fonts).
+///
 /// `PDFCRAFT_SYSTEM_FONTS=0` leaves it out.
-pub fn installed_font_definitions(prefer_hans: bool) -> FontDefinitions {
+pub fn installed_font_definitions(cjk: CjkPreference) -> FontDefinitions {
     #[cfg_attr(target_arch = "wasm32", expect(unused_mut))]
-    let mut fonts = font_definitions_for(prefer_hans);
+    let mut fonts = font_definitions_for(cjk == CjkPreference::SimplifiedChinese);
     #[cfg(not(target_arch = "wasm32"))]
-    if let Some(data) = crate::system_fonts::fallback() {
-        fonts.font_data.insert(SYSTEM_FALLBACK.to_owned(), data);
-        for stack in fonts.families.values_mut() {
-            stack.push(SYSTEM_FALLBACK.to_owned());
+    {
+        use crate::system_fonts::{Need, fallback};
+        let need = match cjk {
+            _ if !pdfcraft_fonts::ui_chinese_fonts().is_empty() => Need::Other,
+            CjkPreference::SimplifiedChinese => Need::Hans,
+            CjkPreference::TraditionalChinese => Need::Hant,
+            CjkPreference::Default => Need::Other,
+        };
+        if let Some(data) = fallback(need) {
+            fonts.font_data.insert(SYSTEM_FALLBACK.to_owned(), data);
+            let japanese: Vec<String> = pdfcraft_fonts::ui_japanese_fonts().iter().map(|f| f.name()).collect();
+            for stack in fonts.families.values_mut() {
+                let at = match need {
+                    Need::Other => None,
+                    Need::Hans | Need::Hant => stack.iter().position(|n| japanese.contains(n)),
+                };
+                stack.insert(at.unwrap_or(stack.len()), SYSTEM_FALLBACK.to_owned());
+            }
         }
     }
     fonts
@@ -177,7 +219,8 @@ pub fn font_definitions_for(prefer_hans: bool) -> FontDefinitions {
     let add = |fonts: &mut FontDefinitions, name: &str, bytes: &'static [u8]| {
         fonts.font_data.insert(name.to_owned(), Arc::new(FontData::from_static(bytes)));
     };
-    add(&mut fonts, "Inter", include_bytes!("../../../assets/fonts/Inter-Regular.ttf"));
+    // Shared with typed signatures' fallback glyphs, so the font is embedded once.
+    add(&mut fonts, "Inter", pdfcraft_fonts::INTER_REGULAR);
     add(&mut fonts, "Inter-Medium", include_bytes!("../../../assets/fonts/Inter-Medium.ttf"));
     add(&mut fonts, "Inter-SemiBold", include_bytes!("../../../assets/fonts/Inter-SemiBold.ttf"));
     add(&mut fonts, "JetBrainsMono", include_bytes!("../../../assets/fonts/JetBrainsMono-Regular.ttf"));
@@ -228,8 +271,10 @@ pub fn semibold(size: f32) -> FontId {
 }
 
 pub fn apply(ctx: &egui::Context, kind: ThemeKind) {
-    // egui must use the same theme for popup/menu styles as our custom chrome.
-    ctx.set_theme(if kind == ThemeKind::Dark { egui::Theme::Dark } else { egui::Theme::Light });
+    // Keep the native window inherited. A concrete egui theme pins macOS's
+    // NSWindow appearance and prevents winit from delivering ThemeChanged.
+    // Our saved choice owns the palette; both egui branches receive it below.
+    ctx.set_theme(egui::ThemePreference::System);
     let t = Tokens::for_kind(kind);
     ctx.data_mut(|d| d.insert_temp(egui::Id::new("pdfcraft-theme"), t));
     let mut v = if t.dark() { Visuals::dark() } else { Visuals::light() };
@@ -282,6 +327,9 @@ pub fn apply(ctx: &egui::Context, kind: ThemeKind) {
         s.text_styles.insert(egui::TextStyle::Heading, semibold(17.0));
         s.interaction.tooltip_delay = 0.35;
     });
+    let style = ctx.global_style();
+    ctx.set_style_of(egui::Theme::Light, style.clone());
+    ctx.set_style_of(egui::Theme::Dark, style);
 }
 
 #[cfg(test)]
diff --git a/crates/ui-egui/src/ui_scale.rs b/crates/ui-egui/src/ui_scale.rs
index 2637a0e0..69fc3aeb 100644
--- a/crates/ui-egui/src/ui_scale.rs
+++ b/crates/ui-egui/src/ui_scale.rs
@@ -1,7 +1,9 @@
-//! Preferences ▸ Interface size: how large the interface is drawn, on top of the display's own
-//! scale. `Auto` follows the desktop's text scaling (GNOME's "Large Text" or text scaling factor,
-//! which the desktop app reads at launch), so PdfCraft's labels match the other apps' instead of
-//! staying small and showing their pixels on a 1× display.
+//! Preferences ▸ Interface size: how large the interface is drawn. `Auto` keeps the display's own
+//! scale and adds the desktop's text scaling (GNOME's "Large Text" or text scaling factor, which
+//! the desktop app reads at launch), so PdfCraft's labels match the other apps' instead of staying
+//! small and showing their pixels on a 1× display. A chosen size is absolute, as PhotoCraft's
+//! Interface ▸ UI Scale is: "100%" is one screen pixel per point whatever scale the display
+//! reports, so a system that reports 200% on a 1080p screen doesn't make "100%" draw at 200%.
 //!
 //! The scale is egui's zoom factor: `pixels_per_point` grows with it, so page rasters, which are
 //! rendered at `pixels_per_point` (`canvas::render_scale`), stay one texel per screen pixel.
@@ -11,7 +13,7 @@ pub const MIN: f32 = 0.5;
 pub const MAX: f32 = 3.0;
 
 /// The sizes the Preferences menu offers, in percent.
-pub const PRESETS: [u16; 10] = [50, 75, 90, 100, 110, 125, 150, 175, 200, 250];
+pub const PRESETS: [u16; 12] = [75, 80, 85, 90, 95, 100, 125, 150, 175, 200, 250, 300];
 
 /// A factor from settings, the control channel or the system: finite and within [`MIN`]..=[`MAX`],
 /// or `None`.
@@ -20,9 +22,23 @@ pub fn valid(factor: f64) -> Option<f32> {
     (factor.is_finite() && (MIN..=MAX).contains(&factor)).then_some(factor)
 }
 
-/// The factor to draw at: the preference, or the system's text scale when it is `Auto` (`None`).
-pub fn factor(preference: Option<f32>, system: f32) -> f32 {
-    preference.or_else(|| valid(f64::from(system))).unwrap_or(1.0)
+/// egui's zoom factor on a display whose own scale is `native`: the system's text scale for
+/// `Auto` (`None`), or the chosen size with the display's scale divided back out.
+pub fn zoom(preference: Option<f32>, system: f32, native: f32) -> f32 {
+    match preference {
+        None => valid(f64::from(system)).unwrap_or(1.0),
+        Some(size) => size / usable(native),
+    }
+}
+
+/// The size the interface is drawn at (screen pixels per point) for [`zoom`]'s arguments.
+pub fn drawn(preference: Option<f32>, system: f32, native: f32) -> f32 {
+    usable(native) * zoom(preference, system, native)
+}
+
+/// The display's scale, or 1.0 when egui doesn't know it (or reports nonsense).
+fn usable(native: f32) -> f32 {
+    if native.is_finite() && native > 0.0 { native } else { 1.0 }
 }
 
 /// Parse a control-channel value: `auto`, or a percentage such as `125` or `125%`.
@@ -61,10 +77,22 @@ mod tests {
 
     #[test]
     fn auto_follows_a_usable_system_scale_only() {
-        assert_eq!(factor(None, 1.25), 1.25);
-        assert_eq!(factor(Some(1.5), 1.25), 1.5);
+        assert_eq!(zoom(None, 1.25, 1.0), 1.25);
+        assert_eq!(drawn(None, 1.25, 2.0), 2.5, "Auto keeps the display's scale");
         for system in [f32::NAN, f32::INFINITY, -1.0, 0.0, 0.1, 40.0] {
-            assert_eq!(factor(None, system), 1.0, "{system}");
+            assert_eq!(zoom(None, system, 1.0), 1.0, "{system}");
+        }
+    }
+
+    #[test]
+    fn a_chosen_size_is_absolute_whatever_the_display_reports() {
+        for native in [1.0, 1.25, 2.0, 3.0] {
+            assert_eq!(drawn(Some(1.0), 1.25, native), 1.0, "100% on a {native}× display");
+            assert_eq!(drawn(Some(1.5), 1.0, native), 1.5, "150% on a {native}× display");
+        }
+        assert_eq!(zoom(Some(1.0), 1.0, 2.0), 0.5);
+        for native in [f32::NAN, f32::INFINITY, 0.0, -2.0] {
+            assert_eq!(drawn(Some(1.25), 1.0, native), 1.25, "{native}");
         }
     }
 
@@ -96,13 +124,17 @@ mod tests {
 
     #[test]
     fn the_app_draws_at_the_system_scale_until_a_size_is_chosen() {
-        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1000.0, 700.0)).with_pixels_per_point(1.0).build_eframe(|_cc| {
+        // A display that reports 200% (#456: a 1080p screen whose system reports 2×).
+        let mut h = egui_kittest::Harness::builder().with_size(egui::vec2(1000.0, 700.0)).with_pixels_per_point(2.0).build_eframe(|_cc| {
             let mut app = crate::PdfCraftApp::new();
             app.system_text_scale = 1.25;
             app
         });
         h.run_steps(3);
-        assert_eq!(h.ctx.pixels_per_point(), 1.25, "Auto follows the system's text scale");
+        assert_eq!(h.ctx.pixels_per_point(), 2.5, "Auto follows the display's scale and the system's text scale");
+        h.state_mut().set_option("ui-scale", "100%").expect("a valid size");
+        h.run_steps(3);
+        assert_eq!(h.ctx.pixels_per_point(), 1.0, "100% is one screen pixel per point");
         h.state_mut().set_option("ui-scale", "150%").expect("a valid size");
         h.run_steps(3);
         assert_eq!(h.ctx.pixels_per_point(), 1.5);
@@ -116,6 +148,6 @@ mod tests {
         assert_eq!(restored.ui_scale, None);
         h.state_mut().set_option("ui-scale", "auto").expect("auto");
         h.run_steps(3);
-        assert_eq!(h.ctx.pixels_per_point(), 1.25);
+        assert_eq!(h.ctx.pixels_per_point(), 2.5);
     }
 }
diff --git a/crates/ui-egui/src/units.rs b/crates/ui-egui/src/units.rs
new file mode 100644
index 00000000..d1de152c
--- /dev/null
+++ b/crates/ui-egui/src/units.rs
@@ -0,0 +1,165 @@
+//! The unit lengths are shown in: page sizes (Document Properties, Print) and the margins typed
+//! in Header & Footer and Set Page Boxes. Preferences ▸ Documents and view ▸ Units.
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Unit {
+    #[default]
+    Inches,
+    Millimetres,
+    Centimetres,
+    Points,
+}
+
+impl Unit {
+    pub const ALL: [Unit; 4] = [Unit::Millimetres, Unit::Centimetres, Unit::Inches, Unit::Points];
+
+    /// Units per PDF point.
+    pub fn per_point(self) -> f64 {
+        match self {
+            Unit::Points => 1.0,
+            Unit::Inches => 1.0 / 72.0,
+            Unit::Millimetres => 25.4 / 72.0,
+            Unit::Centimetres => 2.54 / 72.0,
+        }
+    }
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Unit::Points => "pt",
+            Unit::Inches => "in",
+            Unit::Millimetres => "mm",
+            Unit::Centimetres => "cm",
+        }
+    }
+
+    /// Decimals worth showing: a tenth of a millimetre or point, a hundredth of an inch or centimetre.
+    pub fn decimals(self) -> usize {
+        match self {
+            Unit::Millimetres | Unit::Points => 1,
+            Unit::Inches | Unit::Centimetres => 2,
+        }
+    }
+
+    /// Drag speed for a value field in this unit.
+    pub fn speed(self) -> f64 {
+        match self {
+            Unit::Inches | Unit::Centimetres => 0.01,
+            Unit::Millimetres | Unit::Points => 0.5,
+        }
+    }
+
+    /// The unit the system's region measures in: inches in the United States, Liberia and
+    /// Myanmar, millimetres everywhere else; inches when the region can't be told. Used on first
+    /// start, before the user picks one in Preferences.
+    pub fn system() -> Unit {
+        static SYSTEM: std::sync::OnceLock<Unit> = std::sync::OnceLock::new();
+        *SYSTEM.get_or_init(|| detect().unwrap_or_default())
+    }
+
+    /// A page size given in points, e.g. "210.0 × 297.0 mm".
+    pub fn size(self, width_pt: f64, height_pt: f64) -> String {
+        let (k, d) = (self.per_point(), self.decimals());
+        format!("{:.d$} × {:.d$} {}", width_pt * k, height_pt * k, self.label())
+    }
+}
+
+/// The unit for a locale tag's region: `en_US.UTF-8`, `en-US`, `bg-BG`, `zh-Hans-CN`, `en_GB@euro`.
+/// `None` without a region (`C`, `POSIX`, `en`).
+pub(crate) fn unit_for_tag(tag: &str) -> Option<Unit> {
+    let tag = tag.split(['.', '@']).next().unwrap_or_default();
+    let region = tag.split(['-', '_']).skip(1).filter(|p| p.len() == 2 && p.chars().all(|c| c.is_ascii_alphabetic())).last()?;
+    Some(match region.to_ascii_uppercase().as_str() {
+        "US" | "LR" | "MM" => Unit::Inches,
+        _ => Unit::Millimetres,
+    })
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+fn detect() -> Option<Unit> {
+    // The system's own measurement setting first: a terminal's LANG is often en_US whatever the region.
+    #[cfg(target_os = "macos")]
+    if let Ok(out) = std::process::Command::new("/usr/bin/defaults").args(["read", "-g", "AppleMeasurementUnits"]).output()
+        && out.status.success()
+    {
+        match String::from_utf8_lossy(&out.stdout).trim() {
+            "Inches" => return Some(Unit::Inches),
+            "Centimeters" => return Some(Unit::Millimetres),
+            _ => {}
+        }
+    }
+    // AppleMeasurementUnits only exists once someone changed Measurement system by hand, and apps
+    // started from the Finder get no LANG, so the region of the system locale decides next.
+    #[cfg(target_os = "macos")]
+    if let Ok(out) = std::process::Command::new("/usr/bin/defaults").args(["read", "-g", "AppleLocale"]).output()
+        && out.status.success()
+        && let Some(unit) = unit_for_tag(String::from_utf8_lossy(&out.stdout).trim())
+    {
+        return Some(unit);
+    }
+    #[cfg(target_os = "windows")]
+    {
+        use std::os::windows::process::CommandExt;
+        // Region ▸ Measurement system: 0 metric, 1 U.S. The absolute path keeps a `reg` earlier on
+        // PATH from running; CREATE_NO_WINDOW keeps a console from flashing up.
+        let windir = std::env::var_os("SystemRoot").unwrap_or_else(|| "C:\\Windows".into());
+        let reg = std::path::Path::new(&windir).join("System32").join("reg.exe");
+        if let Ok(out) = std::process::Command::new(reg)
+            .args(["query", "HKCU\\Control Panel\\International", "/v", "iMeasure"])
+            .creation_flags(0x0800_0000)
+            .output()
+            && out.status.success()
+        {
+            match String::from_utf8_lossy(&out.stdout).split_whitespace().last() {
+                Some("1") => return Some(Unit::Inches),
+                Some("0") => return Some(Unit::Millimetres),
+                _ => {}
+            }
+        }
+    }
+    ["LC_ALL", "LC_MEASUREMENT", "LANG"].iter().find_map(|var| std::env::var(var).ok().filter(|v| !v.is_empty()).and_then(|v| unit_for_tag(&v)))
+}
+
+#[cfg(target_arch = "wasm32")]
+fn detect() -> Option<Unit> {
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Unit, unit_for_tag};
+
+    #[test]
+    fn region_decides_the_unit() {
+        assert_eq!(unit_for_tag("en_US.UTF-8"), Some(Unit::Inches));
+        assert_eq!(unit_for_tag("en-US"), Some(Unit::Inches));
+        assert_eq!(unit_for_tag("en_GB@euro"), Some(Unit::Millimetres));
+        assert_eq!(unit_for_tag("bg-BG"), Some(Unit::Millimetres));
+        assert_eq!(unit_for_tag("de_DE.UTF-8"), Some(Unit::Millimetres));
+        assert_eq!(unit_for_tag("zh-Hans-CN"), Some(Unit::Millimetres));
+        assert_eq!(unit_for_tag("my_MM"), Some(Unit::Inches));
+        assert_eq!(unit_for_tag("C"), None);
+        assert_eq!(unit_for_tag("POSIX"), None);
+        assert_eq!(unit_for_tag("en"), None);
+        assert_eq!(unit_for_tag(""), None);
+    }
+
+    #[test]
+    fn a4_in_every_unit() {
+        assert_eq!(Unit::Millimetres.size(595.276, 841.89), "210.0 × 297.0 mm");
+        assert_eq!(Unit::Centimetres.size(595.276, 841.89), "21.00 × 29.70 cm");
+        assert_eq!(Unit::Inches.size(612.0, 792.0), "8.50 × 11.00 in");
+        assert_eq!(Unit::Points.size(612.0, 792.0), "612.0 × 792.0 pt");
+    }
+
+    #[test]
+    fn saved_names_round_trip() {
+        for u in Unit::ALL {
+            let v = serde_json::to_value(u).unwrap();
+            assert_eq!(serde_json::from_value::<Unit>(v).unwrap(), u);
+        }
+        assert_eq!(serde_json::to_value(Unit::Millimetres).unwrap(), "millimetres");
+    }
+}
diff --git a/crates/ui-egui/src/updates.rs b/crates/ui-egui/src/updates.rs
index 51fe816b..4e7957e1 100644
--- a/crates/ui-egui/src/updates.rs
+++ b/crates/ui-egui/src/updates.rs
@@ -116,7 +116,7 @@ pub(crate) fn dialog(app: &mut PdfCraftApp, ctx: &egui::Context) {
     let current = env!("CARGO_PKG_VERSION");
     let mut close = false;
     let mut download: Option<String> = None;
-    let modal = egui::Modal::new(egui::Id::new("updates")).show(ctx, |ui| {
+    let modal = crate::widgets::show_modal(ctx, "updates", |ui| {
         ui.set_width(420.0);
         ui.horizontal(|ui| {
             ui.add(crate::icons::image("cloud", 22.0, t.accent));
diff --git a/crates/ui-egui/src/wheel_pager.rs b/crates/ui-egui/src/wheel_pager.rs
index 423ac1d0..a05af23b 100644
--- a/crates/ui-egui/src/wheel_pager.rs
+++ b/crates/ui-egui/src/wheel_pager.rs
@@ -11,9 +11,10 @@
 
 use egui::{MouseWheelUnit, TouchPhase};
 
-/// How far one wheel notch scrolls, in points (egui's native `line_scroll_speed`). Smooth
-/// input turns a page once it has moved this far, so a light swipe turns and resting fingers
-/// don't; smooth line deltas count this many points per line.
+/// One wheel notch, in points (egui's default desktop `line_scroll_speed`, fixed so paging
+/// doesn't change with the scroll speed preference). Smooth input turns a page once it has
+/// moved this far, so a light swipe turns and resting fingers don't; smooth line deltas count
+/// this many points per line.
 const NOTCH_POINTS: f32 = 40.0;
 /// A phase-less point delta at least this big is a wheel notch: egui draws the same line
 /// between wheel steps, which it smooths, and trackpad input, which it passes through.
diff --git a/crates/ui-egui/src/widgets.rs b/crates/ui-egui/src/widgets.rs
index 21448bdc..1fef87e4 100644
--- a/crates/ui-egui/src/widgets.rs
+++ b/crates/ui-egui/src/widgets.rs
@@ -5,6 +5,104 @@ use egui::{Align2, Color32, CornerRadius, Rect, Response, Sense, Stroke, vec2};
 use crate::theme::{self, Tokens};
 use crate::{PdfCraftApp, icons};
 
+/// Horizontal and vertical inset of a single-line field.
+const FIELD_MARGIN: egui::Margin = egui::Margin::symmetric(10, 6);
+/// Outer height of a single-line field, including its inset.
+const FIELD_MIN_HEIGHT: f32 = 30.0;
+/// Padding inside every modal.
+const DIALOG_PAD_X: i8 = 20;
+const DIALOG_PAD_Y: i8 = 16;
+
+fn dialog_frame(ctx: &egui::Context) -> egui::Frame {
+    let t = Tokens::get(ctx);
+    egui::Frame::new()
+        .fill(t.card)
+        .stroke(Stroke::new(1.0, t.border))
+        .corner_radius(CornerRadius::same(10))
+        .inner_margin(egui::Margin::symmetric(DIALOG_PAD_X, DIALOG_PAD_Y))
+        .shadow(ctx.global_style().visuals.window_shadow)
+}
+
+/// A modal with the card fill, a 10-point corner and room around its contents.
+pub fn modal(ctx: &egui::Context, id: impl std::hash::Hash + std::fmt::Debug) -> egui::Modal {
+    egui::Modal::new(egui::Id::new(id)).frame(dialog_frame(ctx))
+}
+
+/// Show [`modal`], outline its controls, and remember the card rect for layout checks.
+pub fn show_modal<R>(ctx: &egui::Context, id: &str, content: impl FnOnce(&mut egui::Ui) -> R) -> egui::ModalResponse<R> {
+    let stored = egui::Id::new(id);
+    modal(ctx, id).show(ctx, |ui| {
+        begin_dialog(ui);
+        let inner = content(ui);
+        // The frame's stroke sits outside this content rect; the stored card is the fill.
+        let card = ui.min_rect().expand2(egui::vec2(f32::from(DIALOG_PAD_X), f32::from(DIALOG_PAD_Y)));
+        ui.ctx().data_mut(|d| d.insert_temp(stored.with("card"), card));
+        inner
+    })
+}
+
+/// Outlined controls at a shared 30-point height, with a focus stroke and 4-point corners.
+///
+/// Dialog fills match the theme's field colour, so radio buttons, check boxes, combo boxes
+/// and number fields need the border or they disappear into the card.
+pub fn begin_dialog(ui: &mut egui::Ui) {
+    let t = Tokens::get(ui.ctx());
+    let w = &mut ui.visuals_mut().widgets;
+    w.inactive.bg_stroke = Stroke::new(1.0, t.border);
+    w.inactive.weak_bg_fill = t.field;
+    // Slider rails and check-box interiors use the plain fill.
+    w.inactive.bg_fill = t.hover;
+    w.hovered.bg_stroke = Stroke::new(1.0, t.text_muted);
+    for state in [&mut w.inactive, &mut w.hovered, &mut w.active, &mut w.open] {
+        state.corner_radius = CornerRadius::same(4);
+    }
+    ui.visuals_mut().selection.stroke = Stroke::new(1.5, t.accent);
+    ui.spacing_mut().interact_size.y = FIELD_MIN_HEIGHT;
+}
+
+/// A single-line field tall enough to read and to click.
+pub fn line(text: &mut dyn egui::TextBuffer) -> egui::TextEdit<'_> {
+    egui::TextEdit::singleline(text).margin(FIELD_MARGIN).min_size(vec2(0.0, FIELD_MIN_HEIGHT))
+}
+
+/// A multiline field with the same horizontal inset as [`line`].
+pub fn block(text: &mut dyn egui::TextBuffer) -> egui::TextEdit<'_> {
+    egui::TextEdit::multiline(text).margin(egui::Margin::symmetric(10, 6))
+}
+
+/// One line that stays within `max_width`, cut on a character boundary with an ellipsis.
+/// Only the first 160 characters are measured, so a huge name cannot lay out thousands of candidates.
+pub(crate) fn fit_line(text: &str, max_width: f32, mut width_of: impl FnMut(&str) -> f32) -> String {
+    if !max_width.is_finite() || max_width <= 0.0 {
+        return String::new();
+    }
+    let mut s: String = text.chars().take(160).collect();
+    if s.len() == text.len() && width_of(text) <= max_width {
+        return text.to_owned();
+    }
+    loop {
+        s.pop();
+        if s.is_empty() {
+            return if width_of("\u{2026}") <= max_width { "\u{2026}".into() } else { String::new() };
+        }
+        let candidate = format!("{s}\u{2026}");
+        if width_of(&candidate) <= max_width {
+            return candidate;
+        }
+    }
+}
+
+pub(crate) fn text_width(ui: &egui::Ui, text: &str, font: &egui::FontId) -> f32 {
+    ui.fonts_mut(|f| f.layout_no_wrap(text.to_owned(), font.clone(), Color32::WHITE).size().x)
+}
+
+/// Draw `text` from `pos` (left, vertically centered) so it never runs past `max_width`.
+pub(crate) fn paint_left(ui: &egui::Ui, pos: egui::Pos2, text: &str, font: egui::FontId, color: Color32, max_width: f32) {
+    let shown = fit_line(text, max_width, |s| text_width(ui, s, &font));
+    let clip = Rect::from_min_size(egui::pos2(pos.x, pos.y - 14.0), vec2(max_width.max(0.0), 28.0));
+    ui.painter().with_clip_rect(clip).text(pos, Align2::LEFT_CENTER, shown, font, color);
+}
+
 /// A mode-bar tab: text with an underline when active.
 pub fn mode_tab(ui: &mut egui::Ui, label: &str, active: bool) -> Response {
     let t = Tokens::get(ui.ctx());
@@ -42,15 +140,20 @@ pub fn pill_button(ui: &mut egui::Ui, label: &str, primary: bool) -> Response {
 
 /// Icon + label, transparent until hovered.
 pub fn ghost_button(ui: &mut egui::Ui, icon: &str, label: &str) -> Response {
+    ghost_button_sized(ui, icon, label, 30.0)
+}
+
+/// [`ghost_button`] at a given height (the macOS title bar is shorter than the tab strip elsewhere).
+pub fn ghost_button_sized(ui: &mut egui::Ui, icon: &str, label: &str, height: f32) -> Response {
     let t = Tokens::get(ui.ctx());
     let font = theme::medium(13.0);
     let w = ui.fonts_mut(|f| f.layout_no_wrap(label.to_owned(), font.clone(), t.text).size().x);
-    let (rect, resp) = ui.allocate_exact_size(vec2(w + 38.0, 30.0), Sense::click());
+    let (rect, resp) = ui.allocate_exact_size(vec2(w + 38.0, height), Sense::click());
     resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, ui.is_enabled(), label));
     if resp.hovered() {
         ui.painter().rect_filled(rect, CornerRadius::same(6), t.hover);
     }
-    icons::paint(ui, Rect::from_min_size(rect.min + vec2(6.0, 6.0), vec2(18.0, 18.0)), icon, 17.0, t.icon);
+    icons::paint(ui, Rect::from_min_size(rect.min + vec2(6.0, (height - 18.0) / 2.0), vec2(18.0, 18.0)), icon, 17.0, t.icon);
     ui.painter().text(rect.left_center() + vec2(30.0, 0.0), Align2::LEFT_CENTER, label, font, t.text);
     resp
 }
@@ -375,4 +478,30 @@ mod tests {
         let again = toast_rect(&mut app, &ctx, 1280.0, &mut now);
         assert!((again.width() - short.width()).abs() < 1.0, "long notices must not impose a permanent minimum width");
     }
+
+    #[test]
+    fn line_field_is_at_least_thirty_points_tall() {
+        let ctx = egui::Context::default();
+        let mut text = String::new();
+        let mut height = 0.0;
+        ctx.run_ui(egui::RawInput { screen_rect: Some(Rect::from_min_size(Pos2::ZERO, vec2(400.0, 200.0))), ..Default::default() }, |ui| {
+            begin_dialog(ui);
+            height = ui.add(line(&mut text)).rect.height();
+        })
+        .drop_without_applying_deltas();
+        assert!(height >= FIELD_MIN_HEIGHT, "field height {height}");
+    }
+
+    #[test]
+    fn fit_line_keeps_short_text_and_ellipsizes_the_rest() {
+        let width = |s: &str| s.chars().count() as f32;
+        assert_eq!(fit_line("localhost", 20.0, width), "localhost");
+        let long = "Apple Worldwide Developer Relations Certification Authority";
+        let fitted = fit_line(long, 24.0, width);
+        assert!(fitted.ends_with('\u{2026}'), "{fitted}");
+        assert!(fitted.chars().count() <= 24, "{fitted}");
+        assert!(long.starts_with(fitted.trim_end_matches('\u{2026}')));
+        assert_eq!(fit_line(long, 0.0, width), "");
+        assert_eq!(fit_line("ééé", 2.0, width), "é\u{2026}");
+    }
 }
diff --git a/crates/ui-egui/src/zoom_snap.rs b/crates/ui-egui/src/zoom_snap.rs
index 9ee9c702..76e6729c 100644
--- a/crates/ui-egui/src/zoom_snap.rs
+++ b/crates/ui-egui/src/zoom_snap.rs
@@ -63,6 +63,10 @@ impl PdfCraftApp {
                 if view_rect[2] - view_rect[0] < 2.0 || view_rect[3] - view_rect[1] < 2.0 {
                     return;
                 }
+                // The tool outlives the tab it was chosen on.
+                if self.views.get(index).map(|v| v.id).is_some_and(|id| !self.may_copy(id)) {
+                    return;
+                }
                 match self.snapshot(index, page, view_rect) {
                     Ok((w, h)) => {
                         self.notify_fmt("The selected area has been copied ({w} × {h} pixels)", &[("w", &w.to_string()), ("h", &h.to_string())])
diff --git a/crates/ui-egui/tests/camera.rs b/crates/ui-egui/tests/camera.rs
new file mode 100644
index 00000000..99d44ec3
--- /dev/null
+++ b/crates/ui-egui/tests/camera.rs
@@ -0,0 +1,216 @@
+//! Scan & OCR ▸ Enhance ▸ Camera image in the real shell (egui_kittest): drag a corner, then
+//! Enhance page; Cancel and Esc leave the page as it was.
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::{PdfCraftApp, QuickTool};
+
+const FIXTURE: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R 4 0 R] /Count 2 /MediaBox [0 0 300 400] >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R >> endobj
+4 0 obj << /Type /Page /Parent 2 0 R >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+fn harness() -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, FIXTURE.to_vec()).unwrap();
+        app.set_option("left", "closed").unwrap();
+        app.set_option("zoom", "100").unwrap();
+        app
+    });
+    h.run_steps(6);
+    h
+}
+
+fn size(h: &Harness<'static, PdfCraftApp>, page: usize) -> (f32, f32) {
+    let s = h.state();
+    let p = &s.session.get(s.views[0].id).unwrap().info.pages[page];
+    (p.width, p.height)
+}
+
+fn undo_label(h: &Harness<'static, PdfCraftApp>) -> Option<String> {
+    let s = h.state();
+    s.session.get(s.views[0].id).unwrap().can_undo().map(str::to_owned)
+}
+
+#[test]
+fn dragging_a_corner_then_enhance_page_straightens_the_page() {
+    let mut h = harness();
+    assert!(h.state_mut().execute("ocr.enhance_camera"));
+    assert_eq!(h.state().quick_tool, QuickTool::EnhanceCamera);
+    h.run_steps(3);
+    let quad = h.state().views[0].camera.expect("the corners start on the current page");
+    assert_eq!(quad.page, 0);
+    assert_eq!(quad.corners, [[15.0, 20.0], [285.0, 20.0], [285.0, 380.0], [15.0, 380.0]], "inset by 5%");
+
+    // Drag the top-left corner to (60, 80) on the page.
+    let r = h.state().views[0].page_screen_rect(0).unwrap();
+    let (a, b) = (r.min + r.size() * 0.05, r.min + r.size() * 0.2);
+    h.hover_at(a);
+    h.run_steps(1);
+    h.drag_at(a);
+    h.run_steps(1);
+    for k in 1..=4 {
+        h.hover_at(a + (b - a) * (k as f32 / 4.0));
+        h.run_steps(1);
+    }
+    h.drop_at(b);
+    h.run_steps(2);
+    let c = h.state().views[0].camera.unwrap().corners[0];
+    assert!((c[0] - 60.0).abs() < 1.0 && (c[1] - 80.0).abs() < 1.0, "{c:?}");
+    assert_eq!(undo_label(&h), None, "dragging changes nothing yet");
+
+    h.get_by_label("Enhance page").click();
+    h.run_steps(4);
+    // The longer of each pair of opposite sides: 270 × 360 pt.
+    let (w, hh) = size(&h, 0);
+    assert!((w - 270.0).abs() < 2.0 && (hh - 360.0).abs() < 2.0, "{w}×{hh}");
+    assert_eq!(size(&h, 1), (300.0, 400.0), "only the page with the corners changes");
+    assert_eq!(undo_label(&h).as_deref(), Some("Enhance camera image"));
+    // The tool stays open for the enhanced page: turn it, then Done.
+    assert_eq!(h.state().quick_tool, QuickTool::EnhanceCamera);
+    assert!(h.state().views[0].camera.is_none());
+    assert_eq!(h.state().views[0].camera_done.map(|d| d.page), Some(0));
+    h.get_by_label("Rotate clockwise").click();
+    h.run_steps(4);
+    let (w, hh) = size(&h, 0);
+    assert!((w - 360.0).abs() < 2.0 && (hh - 270.0).abs() < 2.0, "{w}×{hh}");
+    assert_eq!(undo_label(&h).as_deref(), Some("Rotate page"));
+    h.get_by_label("Done").click();
+    h.run_steps(3);
+    assert_eq!(h.state().quick_tool, QuickTool::Select);
+    assert_eq!(h.state().views[0].camera_done, None);
+}
+
+#[test]
+fn the_clean_up_level_enhances_again_from_the_photo_and_keeps_the_turn() {
+    let mut h = harness();
+    assert!(h.state_mut().execute("ocr.enhance_camera"));
+    h.run_steps(3);
+    h.get_by_label("Enhance page").click();
+    h.run_steps(4);
+    let done = h.state().views[0].camera_done.unwrap();
+    assert_eq!((done.look, done.level, done.steps), (pdfcraft_engine::camera_clean::Look::Colour, 50, 1), "enhanced in colour at the default level");
+    h.get_by_label("Rotate clockwise").click();
+    h.run_steps(4);
+    let turned = size(&h, 0);
+    assert!(turned.0 > turned.1, "{turned:?}");
+
+    // Let go of the slider at 100.
+    let view = &mut h.state_mut().views[0];
+    if let Some(d) = view.camera_done.as_mut() {
+        d.level = 100;
+    }
+    view.pending_action = Some(pdfcraft_ui_egui::canvas::ViewAction::CameraLevel);
+    h.run_steps(4);
+    let done = h.state().views[0].camera_done.unwrap();
+    assert_eq!((done.applied.1, done.steps, done.turns), (100, 2, 90));
+    assert_eq!(size(&h, 0), turned, "still turned");
+    // The history holds one enhancement and one turn, not a pile of them.
+    let s = h.state_mut();
+    let id = s.views[0].id;
+    assert_eq!(s.session.undo(id).unwrap().as_str(), "Rotate page");
+    assert_eq!(s.session.undo(id).unwrap().as_str(), "Enhance camera image");
+    assert_eq!(s.session.get(id).unwrap().can_undo(), None);
+    let p = &s.session.get(id).unwrap().info.pages[0];
+    assert_eq!((p.width, p.height), (300.0, 400.0), "back to the photo");
+}
+
+#[test]
+fn choosing_a_look_enhances_again() {
+    use pdfcraft_engine::camera_clean::Look;
+    let mut h = harness();
+    assert!(h.state_mut().execute("ocr.enhance_camera"));
+    h.run_steps(3);
+    h.get_by_label("Enhance page").click();
+    h.run_steps(4);
+    for (label, look) in [("Black and white", Look::BlackWhite), ("Greyscale", Look::Greyscale), ("Original", Look::Original)] {
+        h.get_by_label(label).click();
+        h.run_steps(4);
+        let done = h.state().views[0].camera_done.unwrap();
+        assert_eq!((done.applied.0, done.steps), (look, 1), "{label}");
+        let s = h.state();
+        assert_eq!(s.session.get(s.views[0].id).unwrap().can_undo(), Some("Enhance camera image"), "{label}");
+    }
+}
+
+#[test]
+fn after_enhance_page_crop_and_organize_take_over() {
+    for (button, then) in [("Crop pages", QuickTool::Crop), ("Organize pages", QuickTool::Select)] {
+        let mut h = harness();
+        assert!(h.state_mut().execute("ocr.enhance_camera"));
+        h.run_steps(3);
+        h.get_by_label("Enhance page").click();
+        h.run_steps(4);
+        assert_eq!(h.state().views[0].camera_done.map(|d| d.page), Some(0));
+        h.get_by_label(button).click();
+        h.run_steps(3);
+        assert_eq!(h.state().quick_tool, then, "{button}");
+        assert_eq!(h.state().views[0].camera_done, None, "{button}");
+        assert_eq!(h.state().views[0].organize, button == "Organize pages");
+    }
+}
+
+#[test]
+fn cancel_and_escape_leave_the_page_alone() {
+    let mut h = harness();
+    assert!(h.state_mut().execute("ocr.enhance_camera"));
+    h.run_steps(3);
+    h.get_by_label("Cancel").click();
+    h.run_steps(3);
+    assert_eq!(h.state().quick_tool, QuickTool::Select);
+    assert!(h.state().views[0].camera.is_none());
+
+    assert!(h.state_mut().execute("ocr.enhance_camera"));
+    h.run_steps(3);
+    assert!(h.state().views[0].camera.is_some());
+    h.key_press(egui::Key::Escape);
+    h.run_steps(3);
+    assert_eq!(h.state().quick_tool, QuickTool::Select);
+    assert!(h.state().views[0].camera.is_none());
+    assert_eq!(size(&h, 0), (300.0, 400.0));
+    assert_eq!(undo_label(&h), None);
+}
+
+/// A turn made outside the tool after the enhancement breaks its run in the history: changing the
+/// level then leaves the page and the history as they are instead of enhancing the straightened
+/// page a second time.
+#[test]
+fn the_level_leaves_the_page_alone_when_another_edit_came_in_between() {
+    let mut h = harness();
+    assert!(h.state_mut().execute("ocr.enhance_camera"));
+    h.run_steps(3);
+    h.get_by_label("Enhance page").click();
+    h.run_steps(4);
+    h.get_by_label("Rotate clockwise").click();
+    h.run_steps(4);
+    // Another "Rotate page" from outside the tool, with the same history label.
+    {
+        let s = h.state_mut();
+        let id = s.views[0].id;
+        s.session.apply(id, pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 }).unwrap();
+    }
+    h.run_steps(2);
+    let before = size(&h, 0);
+    let applied = h.state().views[0].camera_done.unwrap().applied;
+
+    let view = &mut h.state_mut().views[0];
+    if let Some(d) = view.camera_done.as_mut() {
+        d.level = 100;
+    }
+    view.pending_action = Some(pdfcraft_ui_egui::canvas::ViewAction::CameraLevel);
+    h.run_steps(4);
+    assert_eq!(size(&h, 0), before, "the page is not warped again");
+    let done = h.state().views[0].camera_done.unwrap();
+    assert_eq!((done.level, done.applied), (applied.1, applied), "the slider goes back");
+    let s = h.state_mut();
+    let id = s.views[0].id;
+    assert_eq!(s.session.undo(id).unwrap().as_str(), "Rotate page");
+    assert_eq!(s.session.undo(id).unwrap().as_str(), "Rotate page");
+    assert_eq!(s.session.undo(id).unwrap().as_str(), "Enhance camera image");
+    assert_eq!(s.session.get(id).unwrap().can_undo(), None);
+}
diff --git a/crates/ui-egui/tests/commands.rs b/crates/ui-egui/tests/commands.rs
index f12a3220..5a9c443c 100644
--- a/crates/ui-egui/tests/commands.rs
+++ b/crates/ui-egui/tests/commands.rs
@@ -75,6 +75,19 @@ fn every_registered_command_is_implemented() {
         app.set_option("language", "en").unwrap();
         if spec.id.starts_with("form.") || spec.id == "comment.flatten" {
             app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
+        } else if spec.id == "protect.unlock" {
+            // Only a permissions password: opens restricted, and can be unlocked.
+            let mut doc = pdfcraft_cos::Document::open(std::sync::Arc::new(fixture(3))).unwrap();
+            doc.set_encryption(&pdfcraft_cos::NewEncryption {
+                algorithm: pdfcraft_cos::Algorithm::Aes256,
+                user_password: "",
+                owner_password: "owner",
+                permissions: 0b0100,
+                encrypt_metadata: true,
+                seed: [5; 32],
+            })
+            .unwrap();
+            app.open_bytes("restricted.pdf", None, pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()).unwrap();
         } else {
             app.open_bytes("doc.pdf", None, fixture(3)).unwrap();
         }
@@ -154,6 +167,39 @@ fn disabled_commands_explain_themselves() {
     assert!(!app.execute("no.such.command"));
 }
 
+#[test]
+fn a_tool_chosen_with_no_document_asks_for_one_and_runs_on_it() {
+    let dir = std::env::temp_dir().join(format!("pdfcraft-tool-open-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("picked.pdf");
+    std::fs::write(&path, fixture(2)).unwrap();
+    let pick = path.to_string_lossy().into_owned();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.pick_override = Some(vec![pick]);
+        app
+    });
+    h.run_steps(2);
+    h.state_mut().run_command("export.text");
+    assert!(h.state().toast.as_ref().is_none_or(|t| t.0 != "Open a document first"));
+    h.run_steps(3);
+    assert!(h.state().active.is_some(), "the picked file is open");
+    assert!(matches!(h.state().dialog, Some(Dialog::Export(_))), "and the tool runs on it: {:?}", h.state().dialog);
+    // Cancelled: nothing opens and nothing runs.
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.pick_override = Some(Vec::new());
+        app
+    });
+    h.run_steps(2);
+    h.state_mut().run_command("export.text");
+    h.run_steps(3);
+    assert!(h.state().active.is_none() && h.state().dialog.is_none());
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 #[test]
 fn shortcuts_run_registered_commands() {
     let mut h = harness();
@@ -377,6 +423,24 @@ fn view_menu_and_tooltips_write_shortcuts_for_the_platform() {
     assert_eq!(h.query_all_by_label_contains("Ctrl+").count(), 0, "no Ctrl+ on macOS");
 }
 
+#[test]
+fn the_top_bar_save_button_names_its_shortcut_not_a_milestone() {
+    // #962: on Windows the Save button's tooltip and accessibility name read "Save (M4)",
+    // an internal milestone tag, while Print and Document properties named their shortcuts.
+    let mut h = harness();
+    h.ctx.set_os(OperatingSystem::Windows);
+    h.run_steps(2);
+    h.get_by_label("Save (Ctrl+S)");
+    h.get_by_label("Print (Ctrl+P)");
+    assert_eq!(h.query_all_by_label_contains("(M4)").count(), 0, "no milestone tag in the top bar");
+    assert_eq!(h.query_all_by_label_contains("⌘").count(), 0, "no ⌘ outside macOS");
+
+    let mut h = harness();
+    h.ctx.set_os(OperatingSystem::Mac);
+    h.run_steps(2);
+    h.get_by_label("Save (⌘S)");
+}
+
 #[test]
 fn full_screen_toggles_by_shortcut_and_command_and_escape_leaves() {
     let mut h = harness();
@@ -401,3 +465,27 @@ fn the_about_dialog_shows_the_running_version() {
     h.run_steps(3);
     h.get_by_label_contains(&format!("Version {}", env!("CARGO_PKG_VERSION")));
 }
+
+#[test]
+fn command_w_closes_empty_macos_window_but_not_an_empty_windows_window() {
+    for (os, should_close) in [(OperatingSystem::Mac, true), (OperatingSystem::Windows, false)] {
+        let mut h = Harness::builder().with_size(egui::vec2(1000.0, 700.0)).build_eframe(|_cc| PdfCraftApp::new());
+        h.ctx.set_os(os);
+        h.run_steps(4);
+        assert!(h.state().views.is_empty());
+        h.event(egui::Event::Key { key: Key::W, physical_key: None, pressed: true, repeat: false, modifiers: Modifiers::COMMAND });
+        h.step();
+        let closes = h.output().viewport_output.values().any(|v| v.commands.iter().any(|c| matches!(c, egui::ViewportCommand::Close)));
+        assert_eq!(closes, should_close, "{os:?}: only an empty macOS window should close");
+    }
+}
+
+#[test]
+fn command_w_still_closes_the_document_tab_on_macos() {
+    let mut h = harness();
+    h.ctx.set_os(OperatingSystem::Mac);
+    h.run_steps(2);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::W);
+    h.run_steps(2);
+    assert!(h.state().views.is_empty(), "⌘W closes the clean document tab");
+}
diff --git a/crates/ui-egui/tests/comments.rs b/crates/ui-egui/tests/comments.rs
index 236f4e81..1bf2dd3c 100644
--- a/crates/ui-egui/tests/comments.rs
+++ b/crates/ui-egui/tests/comments.rs
@@ -785,6 +785,11 @@ fn hovering_a_comment_shows_its_author_and_text() {
     h.run_steps(3);
     h.get_by_label_contains("Check this figure");
     h.get_by_label_contains("Ada");
+    // The tip is drawn above every window. A dialog must hide it, or the author floats over the dialog.
+    h.state_mut().set_option("dialog", "shortcuts").unwrap();
+    h.hover_at(p);
+    h.run_steps(3);
+    assert!(h.query_by_label_contains("Check this figure").is_none(), "a dialog covers the page hover");
 }
 
 #[test]
diff --git a/crates/ui-egui/tests/control.rs b/crates/ui-egui/tests/control.rs
index 3ca3cb61..95aaaf95 100644
--- a/crates/ui-egui/tests/control.rs
+++ b/crates/ui-egui/tests/control.rs
@@ -992,6 +992,22 @@ fn state_reports_the_selected_pages() {
     assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["active"]["selected_pages"], json!([2, 4]));
 }
 
+#[test]
+fn organize_overview_is_reachable_through_the_control_channel() {
+    let (mut h, c) = harness();
+    ok(&mut h, &c, "ui.set", json!({ "key": "tool", "value": "organize" }));
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["active"]["organize"], true);
+    h.run_steps(3);
+    for label in ["Select page 1", "Select page 3", "Rotate page 1 clockwise"] {
+        ok(&mut h, &c, "ui.click", json!({ "label": label }));
+        h.run_steps(3);
+    }
+    assert_eq!(ok(&mut h, &c, "ui.state", json!({}))["active"]["selected_pages"], json!([1, 3]));
+    let app = h.state();
+    let rotations: Vec<_> = app.session.get(app.views[0].id).unwrap().info.pages.iter().map(|p| p.rotation).collect();
+    assert_eq!(rotations, [90, 0, 0, 0, 0]);
+}
+
 #[test]
 fn saved_signature_can_be_changed_through_the_control_channel() {
     let (mut h, c) = harness();
@@ -1411,3 +1427,84 @@ fn read_mode_retains_existing_rail_click_to_close_policy() {
     assert_eq!(h.state().right, None);
     assert_eq!(h.state().mode, pdfcraft_ui_egui::Mode::Read);
 }
+
+fn navigation_frame(h: &mut Harness<'static, PdfCraftApp>, events: Vec<egui::Event>) {
+    h.input_mut().events.extend(events);
+    h.step();
+}
+
+fn navigation_wheel(h: &mut Harness<'static, PdfCraftApp>, pos: egui::Pos2, delta: f32, ctrl: bool) {
+    let modifiers = egui::Modifiers { ctrl, command: ctrl, ..egui::Modifiers::NONE };
+    navigation_frame(
+        h,
+        vec![
+            egui::Event::ModifiersChanged(modifiers),
+            egui::Event::PointerMoved(pos),
+            egui::Event::MouseWheel { unit: egui::MouseWheelUnit::Point, delta: egui::vec2(0.0, delta), modifiers, phase: egui::TouchPhase::Move },
+        ],
+    );
+    h.run_steps(20);
+    navigation_frame(h, vec![egui::Event::ModifiersChanged(egui::Modifiers::NONE)]);
+}
+
+#[test]
+fn ctrl_wheel_anchors_visible_page_and_plain_wheel_only_scrolls() {
+    for percent in [100, 200, 400] {
+        for fraction in [0.1, 0.5, 0.9] {
+            let (mut h, c) = harness_pages(20);
+            ok(&mut h, &c, "ui.set", json!({"key":"zoom", "value":percent.to_string()}));
+            h.run_steps(4);
+            let viewport = h.state().views[0].viewport_rect();
+            let before = h.state().views[0].page_screen_rect(0).unwrap();
+            let visible = before.intersect(viewport).shrink(15.0);
+            let p = egui::pos2(visible.left() + fraction * visible.width(), visible.top() + fraction * visible.height());
+            let normalised = (p - before.min) / before.size();
+            let old_zoom = h.state().views[0].zoom;
+            navigation_wheel(&mut h, p, 20.0, true);
+            let enlarged = h.state().views[0].page_screen_rect(0).unwrap();
+            let anchored = enlarged.min + normalised * enlarged.size();
+            assert!(h.state().views[0].zoom > old_zoom);
+            assert!((anchored.y - p.y).abs() < 2.0, "percent={percent}, fraction={fraction}");
+            if before.width() > viewport.width() {
+                assert!((anchored.x - p.x).abs() < 2.0);
+            }
+            navigation_wheel(&mut h, p, -20.0, true);
+            assert!((h.state().views[0].zoom - old_zoom).abs() < 0.01);
+            let zoom = h.state().views[0].zoom;
+            let top = h.state().views[0].page_screen_rect(0).unwrap().top();
+            navigation_wheel(&mut h, p, -80.0, false);
+            assert_eq!(h.state().views[0].zoom, zoom);
+            assert!(h.state().views[0].page_screen_rect(0).unwrap().top() < top - 20.0);
+        }
+    }
+}
+
+#[test]
+fn wheel_zoom_is_scoped_to_the_viewport_and_respects_existing_limits() {
+    let (mut h, c) = harness();
+    let outside = egui::pos2(5.0, 5.0);
+    let zoom = h.state().views[0].zoom;
+    navigation_wheel(&mut h, outside, 40.0, true);
+    assert_eq!(h.state().views[0].zoom, zoom);
+    for (percent, delta, expected) in [(6400, 80.0, 64.0), (8, -80.0, 0.08)] {
+        ok(&mut h, &c, "ui.set", json!({"key":"zoom", "value":percent.to_string()}));
+        h.run_steps(4);
+        let p = h.state().views[0].viewport_rect().center();
+        navigation_wheel(&mut h, p, delta, true);
+        assert_eq!(h.state().views[0].zoom, expected);
+    }
+}
+
+#[test]
+fn initial_zoom_option_is_applied_before_the_first_viewport_layout() {
+    for percent in [50, 100, 200, 400] {
+        let h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.open_bytes("initial-zoom.pdf", None, fixture(3)).unwrap();
+            app.set_option("zoom", &percent.to_string()).unwrap();
+            assert_eq!(app.views[0].zoom, percent as f32 / 100.0, "initial options must work before the viewport exists");
+            app
+        });
+        assert_eq!(h.state().views[0].zoom, percent as f32 / 100.0);
+    }
+}
diff --git a/crates/ui-egui/tests/create.rs b/crates/ui-egui/tests/create.rs
index ee81616b..36b5e97c 100644
--- a/crates/ui-egui/tests/create.rs
+++ b/crates/ui-egui/tests/create.rs
@@ -250,3 +250,15 @@ fn multiple_files_that_cannot_be_converted_open_nothing() {
     assert!(app.views.is_empty());
     assert!(app.toast.is_some());
 }
+
+#[test]
+fn multiple_files_past_a_thousand_are_all_used() {
+    let mut app = PdfCraftApp::new();
+    app.set_option("language", "en").unwrap();
+    let pdf = app.session.create_from_text("a", "from a pdf").unwrap();
+    let files: Vec<(String, Vec<u8>)> = (0..1001).map(|i| (format!("f{i}.pdf"), pdf.to_vec())).collect();
+    app.use_files(pdfcraft_ui_egui::FilePurpose::CreateMultiple, files);
+    assert_eq!(app.views.len(), 1);
+    let doc = app.session.get(app.views[0].id).unwrap();
+    assert_eq!(doc.info.pages.len(), 1001, "every picked file is used, in order");
+}
diff --git a/crates/ui-egui/tests/date_format.rs b/crates/ui-egui/tests/date_format.rs
index aa523d45..0fbe9760 100644
--- a/crates/ui-egui/tests/date_format.rs
+++ b/crates/ui-egui/tests/date_format.rs
@@ -110,7 +110,7 @@ fn month_names_follow_the_date_language_or_else_the_interface_language() {
     let text = |h: &Harness<'static, PdfCraftApp>| h.state().date_text(None).unwrap();
     assert_eq!(text(&h), h.state().session.today_text(None, Some("cs")).unwrap(), "follows the interface (Czech)");
     // The picker offers following the interface first, then the interface languages.
-    assert!(shows(&h, "Same as interface (Čeština)"));
+    assert!(shows(&h, "Stejný jako rozhraní (Čeština)"));
     h.state_mut().set_option("date-language", "es").unwrap();
     h.run_steps(2);
     assert_eq!(text(&h), h.state().session.today_text(None, Some("es")).unwrap());
diff --git a/crates/ui-egui/tests/dialog_chrome.rs b/crates/ui-egui/tests/dialog_chrome.rs
new file mode 100644
index 00000000..8a403535
--- /dev/null
+++ b/crates/ui-egui/tests/dialog_chrome.rs
@@ -0,0 +1,83 @@
+//! Dialog cards keep their padding, and text fields are tall enough to use.
+
+use egui::accesskit::Role;
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::PdfCraftApp;
+
+fn fixture() -> Vec<u8> {
+    let objs = [
+        "<< /Type /Catalog /Pages 2 0 R >>",
+        "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 200 300] >>",
+        "<< /Type /Page /Parent 2 0 R /MediaBox [0 0 200 300] >>",
+    ];
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+fn card(h: &Harness<'_, PdfCraftApp>, id: &str) -> egui::Rect {
+    h.ctx.data(|d| d.get_temp(egui::Id::new(id).with("card"))).unwrap_or_else(|| panic!("missing dialog card {id}"))
+}
+
+fn protected() -> Vec<u8> {
+    let mut doc = pdfcraft_cos::Document::open(std::sync::Arc::new(fixture())).unwrap();
+    doc.set_encryption(&pdfcraft_cos::NewEncryption {
+        algorithm: pdfcraft_cos::Algorithm::Aes256,
+        user_password: "pw",
+        owner_password: "owner",
+        permissions: -1,
+        encrypt_metadata: true,
+        seed: [4; 32],
+    })
+    .unwrap();
+    pdfcraft_cos::write_full(&doc, &Default::default()).unwrap()
+}
+
+#[test]
+fn document_properties_fields_are_tall_and_inset() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("doc.pdf", None, fixture()).unwrap();
+        app.set_option("dialog", "properties").unwrap();
+        app
+    });
+    h.run_steps(4);
+    let card = card(&h, "dialog");
+    let heading = h.get_by_label("Document Properties").rect();
+    assert!(heading.left() - card.left() >= 16.0, "heading inset {heading:?} in {card:?}");
+    assert!(heading.top() - card.top() >= 16.0, "heading inset {heading:?} in {card:?}");
+    let field = h.get_by_role_and_label(Role::TextInput, "Title").rect();
+    assert!(field.height() >= 30.0, "title field {field:?}");
+    assert!(field.left() >= card.left() + 16.0, "title field {field:?} in {card:?}");
+    assert!(field.right() <= card.right() - 16.0, "title field {field:?} in {card:?}");
+}
+
+#[test]
+fn password_prompt_field_is_tall_and_inset() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("secret.pdf", None, protected()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    let card = card(&h, "password");
+    let field = h.get_by_role(Role::PasswordInput).rect();
+    assert!(field.height() >= 30.0, "password field {field:?}");
+    assert!(field.left() - card.left() >= 16.0, "password field {field:?} in {card:?}");
+    assert!(card.right() - field.right() >= 16.0, "password field {field:?} in {card:?}");
+    let heading = h.get_by_label("Password required").rect();
+    assert!(heading.top() - card.top() >= 16.0, "heading inset {heading:?} in {card:?}");
+}
diff --git a/crates/ui-egui/tests/editing.rs b/crates/ui-egui/tests/editing.rs
index 518399f9..4acc4990 100644
--- a/crates/ui-egui/tests/editing.rs
+++ b/crates/ui-egui/tests/editing.rs
@@ -50,6 +50,117 @@ fn organize(pages: usize) -> Harness<'static, PdfCraftApp> {
     harness(pages, |app| app.set_option("organize", "on").unwrap())
 }
 
+#[test]
+fn organize_tool_opens_the_overview_directly_and_can_be_reentered() {
+    let mut h = harness(12, |_| {});
+    assert!(!h.state().views[0].organize);
+    h.get_by_label("Organize pages").click();
+    h.run_steps(3);
+    assert!(h.state().views[0].organize);
+    h.get_by_label("Page 1");
+    h.get_by_label("Page 5");
+    h.get_by_label("Select page 2").click();
+    h.run_steps(2);
+    h.get_by_label("Close").click();
+    h.run_steps(2);
+    assert!(!h.state().views[0].organize);
+    h.state_mut().set_option("tool", "organize").unwrap();
+    h.state_mut().set_option("tool", "organize").unwrap();
+    h.run_steps(2);
+    assert!(h.state().views[0].organize, "entering the tool is idempotent");
+    assert_eq!(h.state().views[0].target_pages(), [1]);
+    h.state_mut().set_option("tool", "edit").unwrap();
+    h.run_steps(2);
+    assert!(!h.state().views[0].organize, "another tool returns to the document");
+}
+
+#[test]
+fn organize_tool_chosen_before_opening_a_document_shows_its_pages() {
+    let mut app = PdfCraftApp::new();
+    app.set_option("tool", "organize").unwrap();
+    app.open_bytes("doc.pdf", None, fixture(3)).unwrap();
+    assert!(app.views[0].organize);
+}
+
+#[test]
+fn organize_checkboxes_toggle_multiple_pages_without_modifiers() {
+    let mut h = organize(4);
+    h.get_by_label("Select page 1").click();
+    h.run_steps(2);
+    h.get_by_label("Select page 3").click();
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].target_pages(), [0, 2]);
+    h.get_by_label("Select page 1").click();
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].target_pages(), [2]);
+    h.get_by_label("Page 4").click_modifiers(Modifiers::SHIFT);
+    h.run_steps(2);
+    assert_eq!(h.state().views[0].target_pages(), [0, 1, 2, 3], "checkbox toggles update the range anchor");
+}
+
+#[test]
+fn organize_page_actions_rotate_only_the_named_page_and_undo() {
+    let mut h = organize(3);
+    h.get_by_label("Select page 1").click();
+    h.run_steps(2);
+    h.get_by_label("Select page 3").click();
+    h.run_steps(2);
+    h.get_by_label("Rotate page 1 clockwise").click();
+    h.run_steps(3);
+    let rotations = |h: &Harness<'static, PdfCraftApp>| {
+        h.state().session.get(h.state().views[0].id).unwrap().info.pages.iter().map(|p| p.rotation).collect::<Vec<_>>()
+    };
+    assert_eq!(rotations(&h), [90, 0, 0]);
+    assert_eq!(h.state().views[0].target_pages(), [0, 2], "a local action preserves the multi-selection");
+    h.get_by_label("Rotate counterclockwise").click();
+    h.run_steps(3);
+    assert_eq!(rotations(&h), [0, 0, 270], "toolbar actions apply to the selection");
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(rotations(&h), [90, 0, 0]);
+    h.get_by_label("Rotate page 1 counterclockwise").click();
+    h.run_steps(3);
+    assert_eq!(rotations(&h), [0, 0, 0]);
+}
+
+#[test]
+fn organize_hover_actions_delete_only_the_named_page_and_undo() {
+    let mut h = organize(3);
+    h.get_by_label("Page 2").hover();
+    h.run_steps(2);
+    h.get_by_label("Delete page 2").click();
+    h.run_steps(3);
+    assert_eq!(page_texts(h.state()), ["Page 1", "Page 3"]);
+    h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
+    h.run_steps(3);
+    assert_eq!(page_texts(h.state()), ["Page 1", "Page 2", "Page 3"]);
+    let single = organize(1);
+    assert!(single.get_by_label("Delete page 1").accesskit_node().is_disabled());
+}
+
+#[test]
+fn organize_local_actions_respect_document_permissions() {
+    let mut h = harness(3, |app| {
+        app.apply_edit(pdfcraft_engine::Edit::Protect(pdfcraft_engine::Protection {
+            permissions_password: Some("owner".into()),
+            changes: pdfcraft_engine::Changes::None,
+            ..Default::default()
+        }));
+        let bytes = app.session.save_bytes(app.views[0].id).unwrap();
+        app.open_bytes("restricted.pdf", None, bytes.as_ref().clone()).unwrap();
+        app.set_option("tool", "organize").unwrap();
+    });
+    h.get_by_label("Select page 2").click();
+    h.run_steps(2);
+    assert!(h.get_by_label("Rotate page 2 clockwise").accesskit_node().is_disabled());
+    assert!(h.get_by_label("Rotate page 2 counterclockwise").accesskit_node().is_disabled());
+    assert!(h.get_by_label("Delete page 2").accesskit_node().is_disabled());
+    let app = h.state();
+    let view = &app.views[app.active.unwrap()];
+    assert_eq!(view.target_pages(), [1]);
+    assert!(!app.session.get(view.id).unwrap().dirty);
+}
+
 /// Page labels of the active document, read back from its current bytes.
 fn page_texts(app: &PdfCraftApp) -> Vec<String> {
     let doc = app.session.get(app.views[0].id).unwrap();
@@ -735,7 +846,7 @@ fn combine_files_opens_in_its_own_tab() {
     h.state_mut().execute("page.combine");
     h.run_steps(3);
     assert!(h.state().combine_showing() && h.state().active.is_none());
-    h.get_by_label("Add the PDFs to combine");
+    h.get_by_label("Add the files to combine");
     // Back to the document, then to Combine through its tab.
     h.get_by_label("doc.pdf").click();
     h.run_steps(3);
@@ -991,33 +1102,93 @@ fn columns_resize_and_the_layout_is_kept_in_the_settings() {
 }
 
 #[test]
-fn a_folder_adds_its_pdfs_in_order_and_optionally_its_subfolders() {
+fn a_folder_adds_its_pdfs_images_and_text_in_order_and_optionally_its_subfolders() {
     let dir = std::env::temp_dir().join(format!("pdfcraft-combine-folder-{}", std::process::id()));
     let _ = std::fs::remove_dir_all(&dir);
     std::fs::create_dir_all(dir.join("sub")).unwrap();
     for (name, pages) in [("page10.pdf", 1), ("page2.PDF", 2), ("sub/inner.pdf", 3)] {
         std::fs::write(dir.join(name), fixture(pages)).unwrap();
     }
-    std::fs::write(dir.join("notes.txt"), b"not a pdf").unwrap();
+    // #569: images and text files join too; other files are left out.
+    std::fs::write(dir.join("notes.txt"), b"Some notes").unwrap();
+    std::fs::write(dir.join("readme.md"), b"# not combinable").unwrap();
     let mut h = harness(1, |_| {});
     h.state_mut().execute("page.combine");
     h.run_steps(2);
     h.state_mut().pick_override = Some(vec![dir.to_string_lossy().into_owned()]);
     h.get_by_label("Add folder…").click();
     h.run_steps(4);
-    assert_eq!(combine_names(&h), ["page2.PDF", "page10.pdf"], "PDFs only, numbers by value");
+    assert_eq!(combine_names(&h), ["notes.txt", "page2.PDF", "page10.pdf"], "numbers by value");
     // The toolbar's menu: the folder and its subfolders, as one undo step.
     h.get_by_label("More ways to add files").click();
     h.run_steps(2);
     h.get_by_label("Add folder and subfolders…").click();
     h.run_steps(4);
-    assert_eq!(combine_names(&h), ["page2.PDF", "page10.pdf", "page2.PDF", "page10.pdf", "inner.pdf"]);
+    assert_eq!(combine_names(&h), ["notes.txt", "page2.PDF", "page10.pdf", "notes.txt", "page2.PDF", "page10.pdf", "inner.pdf"]);
     h.key_press_modifiers(Modifiers::COMMAND, Key::Z);
     h.run_steps(2);
-    assert_eq!(combine_names(&h).len(), 2);
+    assert_eq!(combine_names(&h).len(), 3);
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+/// #569: an image or a text file added to Combine files becomes a PDF as it joins the list, an
+/// ordinary row with its pages.
+#[test]
+fn images_and_text_files_join_the_combine_list_as_pdfs() {
+    let mut png = std::io::Cursor::new(Vec::new());
+    image::RgbImage::from_pixel(40, 20, image::Rgb([90, 120, 200])).write_to(&mut png, image::ImageFormat::Png).unwrap();
+    let mut h = combine_of(&[("one.pdf", 2)]);
+    h.state_mut()
+        .use_files(pdfcraft_ui_egui::FilePurpose::Combine, vec![("scan.png".into(), png.into_inner()), ("notes.txt".into(), b"Some notes".to_vec())]);
+    h.run_steps(3);
+    assert_eq!(combine_names(&h), ["one.pdf", "scan.png", "notes.txt"]);
+    let draft = &h.state().combine_draft;
+    assert!(draft.iter().all(|f| f.bytes.starts_with(b"%PDF-") && f.problem.is_none()), "made into PDFs");
+    assert_eq!(draft.iter().map(|f| f.pages).collect::<Vec<_>>(), [2, 1, 1]);
+    h.get_by_label("Combine").click();
+    h.run_steps(3);
+    assert_eq!(texts_of(h.state(), 1), ["Page 1", "Page 2", "", "Some notes"]);
+}
+
+/// A file that can't be read (a damaged image, a type that can't be made into a PDF) joins the
+/// list all the same, with why; Combine asks before leaving it out, and Cancel changes nothing.
+#[test]
+fn files_that_cannot_be_read_are_listed_and_left_out_once_the_user_agrees() {
+    let mut h = combine_of(&[("one.pdf", 2)]);
+    let bad = vec![("broken.jpg".to_string(), b"\xff\xd8\xff\xe0 not a JPEG".to_vec()), ("report.docx".to_string(), b"PK\x03\x04".to_vec())];
+    h.state_mut().use_files(pdfcraft_ui_egui::FilePurpose::Combine, bad);
+    h.run_steps(3);
+    assert_eq!(combine_names(&h), ["one.pdf", "broken.jpg", "report.docx"]);
+    for f in &h.state().combine_draft[1..] {
+        let why = f.problem.as_deref().expect("why it can't be combined");
+        assert!(why.starts_with("Can't be read: ") && !why.contains(&f.name), "{why}");
+        assert!(f.lock.is_none() && f.pages == 0);
+    }
+    h.get_by_label_contains("this file type can't be converted");
+    // One readable file is not enough to combine.
+    assert!(h.get_by_label("Combine").accesskit_node().is_disabled());
+    h.state_mut().use_files(pdfcraft_ui_egui::FilePurpose::Combine, vec![("two.pdf".into(), fixture(1))]);
+    h.run_steps(3);
+    assert!(!h.get_by_label("Combine").accesskit_node().is_disabled());
+    // Combine asks first, naming the files left out; Cancel leaves everything as it was.
+    h.get_by_label("Combine").click();
+    h.run_steps(3);
+    h.get_by_label("Leave out files that can't be read?");
+    h.get_by_label("• broken.jpg");
+    h.get_by_label("• report.docx");
+    h.get_by_label("Cancel").click();
+    h.run_steps(3);
+    assert!(h.query_by_label("Leave out files that can't be read?").is_none());
+    assert_eq!(h.state().views.len(), 1, "nothing combined");
+    assert_eq!(combine_names(&h).len(), 4);
+    // Asked again: Combine the rest.
+    h.get_by_label("Combine").click();
+    h.run_steps(3);
+    h.get_by_label("Combine the rest").click();
+    h.run_steps(3);
+    assert_eq!(texts_of(h.state(), 1), ["Page 1", "Page 2", "Page 1"]);
+}
+
 fn type_password(h: &mut Harness<'static, PdfCraftApp>, password: &str) {
     let field = h.get_by_role(Role::PasswordInput);
     field.focus();
@@ -1341,7 +1512,9 @@ fn zoomed_pages_in_view_are_rendered_at_the_size_drawn() {
         app.set_option("organize", "on").unwrap();
         app.set_option("grid-zoom", "300").unwrap();
     });
-    let drawn = 146.0 * 3.0 * h.ctx.pixels_per_point();
+    // The 200 × 300 fixture fits by height; keep its aspect ratio instead of stretching
+    // it to the full cell width. Request enough pixels for that actual preview width.
+    let drawn = 194.0 * 3.0 * (200.0 / 300.0) * h.ctx.pixels_per_point();
     let sharp = |h: &Harness<'static, PdfCraftApp>, page| h.state().views[0].grid_page_pixels(page);
     for _ in 0..200 {
         if sharp(&h, 0).is_some_and(|w| w as f32 >= drawn * 0.9) {
@@ -1543,6 +1716,61 @@ fn the_security_notice_wraps_beside_its_buttons_and_lines_up_with_them() {
     }
 }
 
+/// #995, #1077: a file with only a permissions password opens without asking, restricted. Its
+/// notice offers Unlock…, which takes the permissions password and lifts the restrictions.
+#[test]
+fn the_security_notice_unlocks_with_the_permissions_password() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("locked.pdf", None, protected("", "owner", 0b0100)).unwrap();
+        app
+    });
+    h.run_steps(4);
+    h.get_by_label_contains("This document is secured");
+    h.get_by_label("Unlock…").click();
+    h.run_steps(2);
+    h.get_by_label_contains("Enter its permissions password");
+    type_password(&mut h, "wrong");
+    h.get_by_label("Incorrect password. Try again.");
+    type_password(&mut h, "owner");
+    assert!(h.state().unlock_prompt.is_none());
+    assert!(h.query_by_label_contains("This document is secured").is_none(), "the restrictions are lifted");
+    h.state_mut().set_option("dialog", "properties").unwrap();
+    h.run_steps(2);
+    h.get_by_label("Security").click();
+    h.run_steps(3);
+    h.get_by_label("Owner password (no restrictions apply)");
+    assert!(!h.state().session.get(h.state().active_ids().unwrap().1).unwrap().dirty, "unlocking is not an edit");
+}
+
+/// Changing a restricted document's security asks for its permissions password first (Acrobat
+/// does too), then carries on.
+#[test]
+fn remove_security_asks_for_the_permissions_password_first() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("locked.pdf", None, protected("", "owner", 0b0100)).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("protect.remove"));
+    h.run_steps(2);
+    assert!(h.state().unlock_prompt.is_some(), "asks for the password");
+    // Cancelling changes nothing.
+    h.key_press(Key::Escape);
+    h.run_steps(2);
+    assert!(h.state().unlock_prompt.is_none());
+    let id = h.state().active_ids().unwrap().1;
+    assert!(!h.state().session.get(id).unwrap().dirty);
+    assert!(h.state_mut().execute("protect.remove"));
+    h.run_steps(2);
+    type_password(&mut h, "owner");
+    let doc = h.state().session.get(id).unwrap();
+    assert!(doc.dirty && doc.security_summary().is_none(), "security is removed (written by the next save)");
+}
+
 #[test]
 fn restricted_documents_show_a_notice_and_block_page_changes() {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
@@ -1571,6 +1799,78 @@ fn restricted_documents_show_a_notice_and_block_page_changes() {
     assert!(h.query_all_by_label("Not allowed").count() >= 4);
 }
 
+/// Table 22, bit 5 (#568): a document whose security withholds copying keeps its text and images
+/// in. ⌘C, snapshots and exports are refused with a notice; the owner password lifts that.
+#[test]
+fn copying_out_of_a_document_honours_its_security() {
+    fn open(password: &'static str) -> Harness<'static, PdfCraftApp> {
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.system_clipboard = false;
+            app.open_bytes("no-copy.pdf", None, protected("pw", "owner", -1 ^ 0b1_0000)).unwrap();
+            app.submit_password(Some(password.into()));
+            app
+        });
+        // Select the page's text once its text layer is loaded.
+        for _ in 0..40 {
+            h.run_steps(2);
+            if h.state_mut().views[0].select_all() {
+                break;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(5));
+        }
+        assert_eq!(h.state().views[0].selected_text().as_deref(), Some("Page 1"));
+        h
+    }
+    fn copy(h: &mut Harness<'static, PdfCraftApp>) -> bool {
+        h.state_mut().toast = None;
+        h.event(egui::Event::Copy);
+        let mut copied = false;
+        for _ in 0..4 {
+            h.step();
+            copied |= h.output().platform_output.commands.iter().any(|c| matches!(c, egui::OutputCommand::CopyText(t) if t == "Page 1"));
+        }
+        copied
+    }
+    fn snapshot(h: &mut Harness<'static, PdfCraftApp>) {
+        // Around "Page 1", at (20, 150) on the 200 × 300 pt page.
+        let r = h.state().views[0].page_screen_rect(0).expect("on screen");
+        let at = |x: f32, y: f32| egui::pos2(r.left() + x / 200.0 * r.width(), r.top() + (300.0 - y) / 300.0 * r.height());
+        let (a, b) = (at(15.0, 175.0), at(120.0, 140.0));
+        h.hover_at(a);
+        h.run_steps(1);
+        h.drag_at(a);
+        h.run_steps(1);
+        h.hover_at(b);
+        h.run_steps(1);
+        h.drop_at(b);
+        h.run_steps(3);
+    }
+    let refused = Some("The document's security settings don't allow copying text and images");
+
+    let mut h = open("pw");
+    assert!(!copy(&mut h), "⌘C copies nothing");
+    assert_eq!(h.state().toast.as_ref().map(|t| t.0.as_str()), refused);
+    for command in ["edit.snapshot", "export.image", "export.text", "export.docx", "export.html", "export.rtf", "export.all_images"] {
+        h.state_mut().toast = None;
+        assert!(!h.state_mut().execute(command), "{command} is refused");
+        assert_eq!(h.state().toast.as_ref().map(|t| t.0.as_str()), refused, "{command} says why");
+    }
+    assert_eq!(h.state().dialog, None, "no export dialog");
+    // The snapshot tool, chosen on another tab, takes nothing here either.
+    h.state_mut().set_option("quick", "snapshot").unwrap();
+    snapshot(&mut h);
+    assert!(h.state().last_snapshot.is_none());
+    assert_eq!(h.state().toast.as_ref().map(|t| t.0.as_str()), refused);
+
+    let mut h = open("owner");
+    assert!(copy(&mut h), "the owner may copy");
+    assert!(h.state_mut().execute("edit.snapshot"));
+    snapshot(&mut h);
+    assert!(h.state().last_snapshot.is_some());
+}
+
 #[test]
 fn replace_pages_dialog_swaps_page_content() {
     let mut app = PdfCraftApp::new();
diff --git a/crates/ui-egui/tests/fonts.rs b/crates/ui-egui/tests/fonts.rs
index bbb69d1a..3ccfdf37 100644
--- a/crates/ui-egui/tests/fonts.rs
+++ b/crates/ui-egui/tests/fonts.rs
@@ -129,7 +129,7 @@ fn telugu_ui_text_uses_craft_fonts() {
 #[test]
 fn system_fallback_fills_missing_scripts() {
     assert!(!theme::font_definitions().font_data.contains_key(theme::SYSTEM_FALLBACK));
-    let defs = theme::installed_font_definitions(false);
+    let defs = theme::installed_font_definitions(theme::CjkPreference::Default);
     if !defs.font_data.contains_key(theme::SYSTEM_FALLBACK) {
         eprintln!("skipping system_fallback_fills_missing_scripts: no installed fallback font (or PDFCRAFT_SYSTEM_FONTS=0)");
         assert!(defs.families.values().all(|stack| !stack.iter().any(|n| n == theme::SYSTEM_FALLBACK)));
@@ -147,6 +147,62 @@ fn system_fallback_fills_missing_scripts() {
     assert!(layout_widths(&mut fonts, ARABIC).iter().all(|w| w.is_finite() && *w > 0.0));
 }
 
+/// The Han characters of a catalog's translations.
+fn catalog_han(catalog: &str) -> String {
+    let mut han: Vec<char> = catalog
+        .lines()
+        .filter(|l| !l.starts_with('#'))
+        .filter_map(|l| l.split('\t').nth(2))
+        .flat_map(str::chars)
+        .filter(|c| matches!(*c, '\u{3400}'..='\u{9fff}' | '\u{f900}'..='\u{faff}'))
+        .collect();
+    han.sort_unstable();
+    han.dedup();
+    han.into_iter().collect()
+}
+
+/// In a Chinese interface built without a `Hans` face (every release so far, #826), a Chinese
+/// face installed on this machine goes before the Japanese faces, which lack hundreds of the
+/// catalog's characters, and draws every Han character of both Chinese catalogs.
+#[test]
+fn chinese_ui_uses_an_installed_chinese_face() {
+    if !pdfcraft_fonts::ui_chinese_fonts().is_empty() {
+        eprintln!("skipping chinese_ui_uses_an_installed_chinese_face: a Hans face is bundled");
+        return;
+    }
+    for (cjk, catalog) in [
+        (theme::CjkPreference::SimplifiedChinese, include_str!("../src/i18n/zh-hans.tsv")),
+        (theme::CjkPreference::TraditionalChinese, include_str!("../src/i18n/zh-hant.tsv")),
+    ] {
+        let defs = theme::installed_font_definitions(cjk);
+        if !defs.font_data.contains_key(theme::SYSTEM_FALLBACK) {
+            eprintln!("skipping chinese_ui_uses_an_installed_chinese_face: no installed Chinese face (or PDFCRAFT_SYSTEM_FONTS=0)");
+            return;
+        }
+        for (family, stack) in &defs.families {
+            let system = stack.iter().position(|n| n == theme::SYSTEM_FALLBACK).expect("in every family");
+            assert_eq!(stack.iter().filter(|n| *n == theme::SYSTEM_FALLBACK).count(), 1, "{family:?}");
+            let own = stack.iter().position(|n| n.starts_with("Inter") || n == "JetBrainsMono").expect("the app's own font");
+            assert!(own < system, "{family:?}: {stack:?}");
+            if let Some(first_ja) = stack.iter().position(|n| n.starts_with("BIZ UDPGothic")) {
+                assert!(system < first_ja, "{family:?}: {stack:?}");
+            }
+        }
+        let han = catalog_han(catalog);
+        assert!(han.contains('欢') || han.contains('說'), "{cjk:?}");
+        let mut fonts = Fonts::new(TextOptions::default(), defs);
+        for id in families() {
+            let missing: String = han.chars().filter(|c| !fonts.has_glyphs(&id, &c.to_string())).collect();
+            assert!(missing.is_empty(), "{cjk:?} {id:?} lacks {missing}");
+        }
+    }
+    // Other languages keep the installed face last, as before.
+    let defs = theme::installed_font_definitions(theme::CjkPreference::Default);
+    for stack in defs.families.values() {
+        assert!(stack.iter().position(|n| n == theme::SYSTEM_FALLBACK).is_none_or(|i| i + 1 == stack.len()), "{stack:?}");
+    }
+}
+
 /// Without craft-fonts the interface fonts still install and lay out any text (Japanese falls
 /// back to egui's replacement glyph) without panicking; Latin text is unaffected.
 #[test]
diff --git a/crates/ui-egui/tests/forms.rs b/crates/ui-egui/tests/forms.rs
index 57a80dff..69c06af7 100644
--- a/crates/ui-egui/tests/forms.rs
+++ b/crates/ui-egui/tests/forms.rs
@@ -181,6 +181,68 @@ fn saving_while_still_typing_in_a_field_saves_the_text() {
     let _ = std::fs::remove_dir_all(&dir);
 }
 
+#[test]
+fn tabbing_back_to_the_same_field_then_saving_keeps_the_committed_value() {
+    // A form with one text field wraps Tab back to that field. Multiple widgets of one
+    // field share its value too: opening the next widget must see the accepted edit.
+    for (case, shared_widgets, backwards, same_frame) in [
+        ("single-forward", false, false, false),
+        ("single-backward", false, true, false),
+        ("shared-forward", true, false, false),
+        ("shared-backward", true, true, false),
+        ("same-frame", false, false, true),
+    ] {
+        let dir = scratch(case);
+        let out = dir.join("saved.pdf");
+        let bytes = if shared_widgets {
+            pdf_from_objects(&[
+                "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>",
+                "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>",
+                "<< /Type /Page /Parent 2 0 R /Annots [6 0 R 7 0 R] >>",
+                "<< /FT /Tx /T (qty) /V (4) /Kids [6 0 R 7 0 R] >>",
+                "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>",
+                "<< /Type /Annot /Subtype /Widget /Parent 4 0 R /Rect [20 350 280 372] /P 3 0 R /F 4 >>",
+                "<< /Type /Annot /Subtype /Widget /Parent 4 0 R /Rect [20 250 280 272] /P 3 0 R /F 4 >>",
+            ])
+        } else {
+            validated_form()
+        };
+        let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.open_bytes("tab.pdf", None, bytes).unwrap();
+            app.set_option("left", "closed").unwrap();
+            app.set_option("zoom", "150").unwrap();
+            app
+        });
+        h.run_steps(6);
+        click_field(&mut h, "qty", 0);
+        h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+        h.event(egui::Event::Text("42".into()));
+        h.run_steps(2);
+        h.state_mut().save_override = Some(out.to_string_lossy().into_owned());
+        let modifiers = if backwards { egui::Modifiers::SHIFT } else { egui::Modifiers::NONE };
+        if same_frame {
+            one_frame(&mut h, vec![key(egui::Key::Tab, modifiers), key(egui::Key::S, egui::Modifiers::COMMAND)]);
+        } else {
+            h.key_press_modifiers(modifiers, egui::Key::Tab);
+            h.run_steps(3);
+            h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::S);
+        }
+        h.run_steps(4);
+        assert_eq!(saved_value(&out, "qty"), ["42"], "{case}: saving cannot restore the old value");
+        assert_eq!(value(&h, "qty"), ["42"], "{case}");
+        // One typing action is one history entry, even after saving. Escape closes the
+        // untouched editor before undoing the document rather than the TextEdit buffer.
+        h.key_press(egui::Key::Escape);
+        h.state_mut().undo();
+        assert_eq!(value(&h, "qty"), ["4"], "{case}: a single undo restores the original");
+        h.state_mut().redo();
+        assert_eq!(value(&h, "qty"), ["42"], "{case}: redo restores the committed value");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
+
 #[test]
 fn closing_while_still_typing_in_a_field_asks_to_save() {
     let mut h = harness();
@@ -284,13 +346,16 @@ fn exporting_form_data_while_typing_includes_the_text() {
 
 /// One text field, `qty`, whose validation script refuses values over 100.
 fn validated_form() -> Vec<u8> {
-    let objs = [
+    pdf_from_objects(&[
         "<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [4 0 R] /DA (/Helv 0 Tf 0 g) /DR << /Font << /Helv 5 0 R >> >> >> >>",
         "<< /Type /Pages /Kids [3 0 R] /Count 1 /MediaBox [0 0 300 400] >>",
         "<< /Type /Page /Parent 2 0 R /Annots [4 0 R] >>",
         "<< /Type /Annot /Subtype /Widget /FT /Tx /T (qty) /V (4) /Rect [20 350 280 372] /P 3 0 R /F 4 /AA << /V << /S /JavaScript /JS (if (event.value > 100) { app.alert('At most 100'); event.rc = false; }) >> >> >>",
         "<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>",
-    ];
+    ])
+}
+
+fn pdf_from_objects(objs: &[&str]) -> Vec<u8> {
     let mut out = b"%PDF-1.7\n".to_vec();
     let mut offsets = Vec::new();
     for (i, o) in objs.iter().enumerate() {
@@ -355,7 +420,16 @@ fn a_save_shortcut_pressed_while_typing_saves_only_the_document_it_was_pressed_i
 
 #[test]
 fn a_value_refused_on_enter_keeps_save_in_the_same_frame_from_running() {
-    let dir = scratch("enter-refused");
+    refused_value_stops_save(egui::Key::Enter, "enter-refused");
+}
+
+#[test]
+fn a_value_refused_on_tab_keeps_save_in_the_same_frame_from_running() {
+    refused_value_stops_save(egui::Key::Tab, "tab-refused");
+}
+
+fn refused_value_stops_save(commit_key: egui::Key, case: &str) {
+    let dir = scratch(case);
     let out = dir.join("saved.pdf");
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
@@ -370,7 +444,7 @@ fn a_value_refused_on_enter_keeps_save_in_the_same_frame_from_running() {
     h.event(egui::Event::Text("500".into()));
     h.run_steps(2);
     h.state_mut().save_override = Some(out.to_string_lossy().into_owned());
-    one_frame(&mut h, vec![key(egui::Key::Enter, egui::Modifiers::NONE), key(egui::Key::S, egui::Modifiers::COMMAND)]);
+    one_frame(&mut h, vec![key(commit_key, egui::Modifiers::NONE), key(egui::Key::S, egui::Modifiers::COMMAND)]);
     h.run_steps(3);
     assert_eq!(value(&h, "qty"), ["4"]);
     assert!(!out.exists(), "nothing is saved right after the field refused its value");
@@ -475,3 +549,104 @@ mod revert_tests {
         assert!(output.text.unwrap().plain_text().contains("Saved original"), "saved AP still draws the original value");
     }
 }
+
+#[test]
+fn calculated_field_and_script_side_effect_on_another_page_re_render() {
+    let mut h = harness();
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::InsertBlankPage { at: 1, width: 300.0, height: 400.0 }));
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::AddField {
+        page: 1,
+        rect: [20.0, 20.0, 100.0, 40.0],
+        kind: pdfcraft_engine::NewField::Text { multiline: false },
+        name: Some("page2_field".into()),
+    }));
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::SetFieldScript {
+        name: "page2_field".into(),
+        event: "calculate".into(),
+        script: Some("event.value = 'from_' + getField('name').value;".into()),
+    }));
+    for _ in 0..60 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    click_field(&mut h, "name", 0);
+    h.event(egui::Event::Text("hello".into()));
+    h.run_steps(2);
+    h.key_press(egui::Key::Tab);
+    h.run_steps(2);
+    assert_eq!(value(&h, "page2_field"), ["from_hello"]);
+    // Wait for all re-renders to complete.
+    for _ in 0..60 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert_eq!(value(&h, "name"), ["hello"]);
+    assert_eq!(value(&h, "page2_field"), ["from_hello"]);
+}
+
+#[test]
+fn overlay_clears_after_fresh_tiles_zoom_then_edit_and_rejected_edit() {
+    let mut h = harness();
+    // 1. Fresh tiles: edit puts field in unbaked, and after tiles arrive, unbaked clears.
+    click_field(&mut h, "name", 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+    h.event(egui::Event::Text("GoodVal".into()));
+    h.run_steps(2);
+    h.key_press(egui::Key::Tab);
+    h.run_steps(2);
+    assert_eq!(value(&h, "name"), ["GoodVal"]);
+    for _ in 0..60 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(!h.state().views[0].forms.unbaked.contains(&("name".to_string(), 0)));
+
+    // 2. Rejected edit: typing rejected by validate script leaves unbaked clean.
+    assert!(h.state_mut().apply_edit(pdfcraft_engine::Edit::SetFieldScript {
+        name: "city".into(),
+        event: "validate".into(),
+        script: Some("event.rc = false;".into()),
+    }));
+    click_field(&mut h, "city", 0);
+    h.event(egui::Event::Text("BadVal".into()));
+    h.run_steps(2);
+    h.key_press(egui::Key::Tab);
+    h.run_steps(2);
+    assert!(!h.state().views[0].forms.unbaked.contains(&("city".to_string(), 0)));
+    h.key_press(egui::Key::Escape);
+    h.run_steps(2);
+
+    // 3. Zoom then edit: zoom to another scale, let tiles settle, then edit.
+    h.state_mut().views[0].zoom_step(true);
+    for _ in 0..60 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    click_field(&mut h, "name", 0);
+    h.key_press_modifiers(egui::Modifiers::COMMAND, egui::Key::A);
+    h.event(egui::Event::Text("ZoomedVal".into()));
+    h.run_steps(2);
+    h.key_press(egui::Key::Tab);
+    h.run_steps(2);
+    assert_eq!(value(&h, "name"), ["ZoomedVal"]);
+    for _ in 0..60 {
+        h.run_steps(2);
+        if !h.state().render_pending() {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(5));
+    }
+    assert!(!h.state().views[0].forms.unbaked.contains(&("name".to_string(), 0)));
+}
diff --git a/crates/ui-egui/tests/javascript.rs b/crates/ui-egui/tests/javascript.rs
index a5c5a6af..786a4301 100644
--- a/crates/ui-egui/tests/javascript.rs
+++ b/crates/ui-egui/tests/javascript.rs
@@ -92,8 +92,11 @@ fn document_scripts_and_preferences() {
     h.run_steps(2);
     let id = h.state().active_ids().unwrap().1;
     assert_eq!(h.state().session.get(id).unwrap().document_scripts()[0].0, "init");
+    // Main added preferences above JavaScript; keep the checkbox inside this test viewport.
+    h.set_size(egui::vec2(1400.0, 1400.0));
     h.state_mut().dialog = Some(Dialog::Preferences);
-    h.run_steps(2);
+    h.run_steps(4);
+    assert!(h.ctx.content_rect().contains_rect(h.get_by_label("Enable Acrobat JavaScript").rect()));
     h.get_by_label("Enable Acrobat JavaScript").click();
     h.run_steps(2);
     assert!(!h.state().session.javascript());
diff --git a/crates/ui-egui/tests/prepare.rs b/crates/ui-egui/tests/prepare.rs
index cd6e0132..b23f1a9f 100644
--- a/crates/ui-egui/tests/prepare.rs
+++ b/crates/ui-egui/tests/prepare.rs
@@ -7,7 +7,8 @@ use egui_kittest::kittest::Queryable;
 use pdfcraft_ui_egui::{PdfCraftApp, QuickTool};
 
 fn harness() -> Harness<'static, PdfCraftApp> {
-    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|cc| {
+        cc.egui_ctx.options_mut(|options| options.warn_on_id_clash = true);
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
         app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
@@ -157,6 +158,27 @@ fn appearance_tab_restyles_the_field() {
     h.get_by_label("Appearance").click();
     h.run_steps(2);
     h.get_by_label("Line Style:");
+    fn no_grid_id_warning(shape: &egui::Shape) -> bool {
+        match shape {
+            egui::Shape::Vec(shapes) => shapes.iter().all(no_grid_id_warning),
+            egui::Shape::Text(text) => !text.galley.job.text.contains("Grid ID"),
+            _ => true,
+        }
+    }
+    // Check egui's actual painted diagnostics, rather than reproducing the ID formula.
+    assert!(h.output().shapes.iter().all(|shape| no_grid_id_warning(&shape.shape)), "palette grids must not share an ID");
+    let before = h.state().field_props.as_ref().unwrap().look.unwrap();
+    assert_eq!(h.get_all_by_label("No color").count(), 2);
+    h.get_all_by_label("No color").next().unwrap().click();
+    h.run_steps(2);
+    let border = h.state().field_props.as_ref().unwrap().look.as_ref().unwrap().border;
+    assert_eq!(border, if before.border.is_some() { None } else { Some([0.0; 3]) });
+    assert_eq!(h.state().field_props.as_ref().unwrap().look.as_ref().unwrap().fill, before.fill);
+    h.get_all_by_label("No color").nth(1).unwrap().click();
+    h.run_steps(2);
+    let look = h.state().field_props.as_ref().unwrap().look.as_ref().unwrap();
+    assert_eq!(look.border, border);
+    assert_eq!(look.fill, if before.fill.is_some() { None } else { Some([0.0; 3]) });
     {
         let d = h.state_mut().field_props.as_mut().unwrap();
         let l = d.look.as_mut().expect("a look");
diff --git a/crates/ui-egui/tests/print.rs b/crates/ui-egui/tests/print.rs
index 02d5f415..4db97e8b 100644
--- a/crates/ui-egui/tests/print.rs
+++ b/crates/ui-egui/tests/print.rs
@@ -1,7 +1,7 @@
 //! The Print dialog in the real shell (egui_kittest): settings, preview sheets, Save as PDF.
 
 use egui_kittest::Harness;
-use egui_kittest::kittest::Queryable;
+use egui_kittest::kittest::{NodeT, Queryable};
 use pdfcraft_ui_egui::{Dialog, PdfCraftApp};
 
 fn harness() -> Harness<'static, PdfCraftApp> {
@@ -243,3 +243,42 @@ fn printers_listed_in_the_background_preselect_the_default_unless_one_was_picked
     assert!(!h.state().print_draft.printers_loading);
     assert_eq!(h.state().print_draft.printer, None, "Save as PDF, as picked");
 }
+
+#[test]
+fn architectural_page_can_be_matched_at_100_percent() {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 1000.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        let bytes = app.session.create_blank(2592.0, 1728.0, 1).unwrap();
+        app.open_bytes("architectural.pdf", None, bytes.as_ref().clone()).unwrap();
+        app
+    });
+    h.run_steps(4);
+    assert!(h.state_mut().execute("print.dialog"));
+    h.run_steps(3);
+    h.get_by_label("PDF page: 36.00 × 24.00 in");
+    h.get_by_label("Match page at 100%").click();
+    h.run_steps(3);
+    h.get_by_value("ARCH D (24 x 36 in)");
+    h.get_by_label("PDF scale: 100.00%");
+    h.get_by_label("36.00 × 24.00 in");
+    h.get_by_label("Printer paper and scaling may differ. Check driver settings.");
+    let settings = h.state().print_draft.settings(1, &[]).unwrap();
+    assert_eq!(settings.paper, (1728.0, 2592.0));
+    assert_eq!(settings.layout, pdfcraft_engine::print::Layout::Size(pdfcraft_engine::print::SizeMode::Actual));
+}
+
+#[test]
+fn custom_page_cannot_silently_match_a_standard_paper() {
+    let mut h = harness();
+    assert!(h.state_mut().execute("print.dialog"));
+    h.run_steps(3);
+    // The 300 x 400 pt fixture is not a standard sheet.
+    assert!(pdfcraft_engine::print::matching_paper((300.0, 400.0)).is_none());
+    let before = h.state().print_draft.clone();
+    assert!(h.get_by_label("Match page at 100%").accesskit_node().is_disabled());
+    h.get_by_label("Match page at 100%").click();
+    h.run_steps(3);
+    assert_eq!(h.state().print_draft.paper, before.paper);
+    assert_eq!(h.state().print_draft.size, before.size);
+}
diff --git a/crates/ui-egui/tests/reload.rs b/crates/ui-egui/tests/reload.rs
new file mode 100644
index 00000000..dc0ed869
--- /dev/null
+++ b/crates/ui-egui/tests/reload.rs
@@ -0,0 +1,206 @@
+//! A document reloads when its file changes on disk (#431): a LaTeX or Typst build rewriting the
+//! open PDF. Here the watcher looks once per frame on the test's thread (`run_inline`); in the
+//! app a worker thread looks every quarter second.
+
+use std::path::PathBuf;
+use std::time::{Duration, SystemTime};
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::{PdfCraftApp, SaveTarget};
+
+/// An `n`-page document with a proper xref table; page `i` shows "Page i+1", and with `notes`
+/// each page has a sticky note.
+fn fixture_with(n: usize, notes: bool) -> Vec<u8> {
+    let mut objs: Vec<String> = vec!["<< /Type /Catalog /Pages 2 0 R >>".into()];
+    let kids: Vec<String> = (0..n).map(|i| format!("{} 0 R", 4 + 2 * i)).collect();
+    objs.push(format!("<< /Type /Pages /Kids [{}] /Count {n} /MediaBox [0 0 200 300] >>", kids.join(" ")));
+    objs.push("<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>".into());
+    let annots = if notes { " /Annots [<< /Type /Annot /Subtype /Text /Rect [10 10 30 30] /Contents (note) >>]" } else { "" };
+    for i in 0..n {
+        objs.push(format!("<< /Type /Page /Parent 2 0 R /Contents {} 0 R /Resources << /Font << /F1 3 0 R >> >>{annots} >>", 5 + 2 * i));
+        let body = format!("BT /F1 24 Tf 20 150 Td (Page {}) Tj ET", i + 1);
+        objs.push(format!("<< /Length {} >>\nstream\n{body}\nendstream", body.len()));
+    }
+    let mut out = b"%PDF-1.7\n".to_vec();
+    let mut offsets = Vec::new();
+    for (i, o) in objs.iter().enumerate() {
+        offsets.push(out.len());
+        out.extend_from_slice(format!("{} 0 obj\n{o}\nendobj\n", i + 1).as_bytes());
+    }
+    let xref = out.len();
+    out.extend_from_slice(format!("xref\n0 {}\n0000000000 65535 f \n", objs.len() + 1).as_bytes());
+    for o in offsets {
+        out.extend_from_slice(format!("{o:010} 00000 n \n").as_bytes());
+    }
+    out.extend_from_slice(format!("trailer\n<< /Size {} /Root 1 0 R >>\nstartxref\n{xref}\n%%EOF\n", objs.len() + 1).as_bytes());
+    out
+}
+
+fn fixture(n: usize) -> Vec<u8> {
+    fixture_with(n, false)
+}
+
+/// A PDF in a fresh temp folder, removed when the test ends.
+struct TempPdf {
+    dir: PathBuf,
+    path: String,
+    builds: std::cell::Cell<u64>,
+}
+
+impl TempPdf {
+    fn new(test: &str, bytes: &[u8]) -> Self {
+        let dir = std::env::temp_dir().join(format!("pdfcraft-reload-{test}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("thesis.pdf").to_string_lossy().into_owned();
+        std::fs::write(&path, bytes).unwrap();
+        Self { dir, path, builds: std::cell::Cell::new(0) }
+    }
+
+    /// Rewrite it as a build does: new contents, and a later modification time every time.
+    fn rebuild(&self, bytes: &[u8]) {
+        std::fs::write(&self.path, bytes).unwrap();
+        self.builds.set(self.builds.get() + 1);
+        let file = std::fs::File::options().write(true).open(&self.path).unwrap();
+        file.set_modified(SystemTime::now() + Duration::from_secs(60 * self.builds.get())).unwrap();
+    }
+}
+
+impl Drop for TempPdf {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.dir);
+    }
+}
+
+fn harness(path: &str) -> Harness<'static, PdfCraftApp> {
+    let path = path.to_owned();
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.run_inline = true;
+        app.open_path(&path);
+        app
+    });
+    h.run_steps(4);
+    h
+}
+
+fn pages(h: &Harness<'static, PdfCraftApp>) -> usize {
+    let app = h.state();
+    app.session.get(app.views[0].id).unwrap().info.pages.len()
+}
+
+fn dirty(h: &Harness<'static, PdfCraftApp>) -> bool {
+    let app = h.state();
+    app.session.get(app.views[0].id).unwrap().dirty
+}
+
+fn rotate_first_page(h: &mut Harness<'static, PdfCraftApp>) {
+    h.state_mut().views[0].select_pages(&[0]);
+    h.state_mut().apply_edit(pdfcraft_engine::Edit::RotatePages { pages: vec![0], degrees: 90 });
+}
+
+#[test]
+fn a_rebuilt_file_reloads_in_place_keeping_the_page_and_zoom() {
+    let file = TempPdf::new("rebuild", &fixture(3));
+    let mut h = harness(&file.path);
+    let id = h.state().views[0].id;
+    h.state_mut().views[0].fit = pdfcraft_ui_egui::canvas::Fit::None;
+    h.state_mut().views[0].zoom = 1.5;
+    h.state_mut().views[0].go_to_page(2);
+    h.run_steps(4);
+    file.rebuild(&fixture(4));
+    // One look sees the change, the next sees it settled and reloads.
+    h.run_steps(3);
+    let app = h.state();
+    assert_eq!(pages(&h), 4, "the new version shows");
+    assert_eq!((app.views.len(), app.views[0].id), (1, id), "in the same tab");
+    assert_eq!((app.views[0].current, app.views[0].zoom), (2, 1.5), "at the same page and zoom");
+}
+
+#[test]
+fn a_half_written_file_waits_until_the_pdf_is_whole() {
+    let file = TempPdf::new("partial", &fixture(2));
+    let mut h = harness(&file.path);
+    let whole = fixture(5);
+    // A build part-way through: whole objects up to the fourth page, no cross-reference table
+    // or end yet. The lenient parser would open this as a document with pages missing.
+    let cut = whole.windows(9).position(|w| w == b"\n10 0 obj").unwrap();
+    file.rebuild(&whole[..cut]);
+    h.run_steps(4);
+    assert_eq!(pages(&h), 2, "half a file is not loaded");
+    file.rebuild(&whole);
+    h.run_steps(3);
+    assert_eq!(pages(&h), 5, "the whole one is");
+}
+
+#[test]
+fn saving_does_not_reload_or_lose_undo() {
+    let file = TempPdf::new("save", &fixture(2));
+    let mut h = harness(&file.path);
+    rotate_first_page(&mut h);
+    h.state_mut().save_active(SaveTarget::InPlace);
+    h.run_steps(4);
+    let app = h.state();
+    let doc = app.session.get(app.views[0].id).unwrap();
+    assert!(!doc.dirty, "saved");
+    assert!(doc.can_undo().is_some(), "a reload would have cleared the undo history");
+}
+
+#[test]
+fn unsaved_changes_are_kept_until_reload_is_chosen() {
+    let file = TempPdf::new("dirty", &fixture(2));
+    let mut h = harness(&file.path);
+    rotate_first_page(&mut h);
+    file.rebuild(&fixture(4));
+    h.run_steps(3);
+    assert_eq!((pages(&h), dirty(&h)), (2, true), "not replaced behind the user's back");
+    h.get_by_label_contains("This file changed on disk");
+    h.get_by_label("Reload").click();
+    h.run_steps(3);
+    assert_eq!((pages(&h), dirty(&h)), (4, false), "replaced when asked");
+    assert!(h.query_by_label_contains("This file changed on disk").is_none());
+}
+
+#[test]
+fn a_deleted_file_leaves_the_document_open() {
+    let file = TempPdf::new("deleted", &fixture(2));
+    let mut h = harness(&file.path);
+    std::fs::remove_file(&file.path).unwrap();
+    h.run_steps(4);
+    assert_eq!((h.state().views.len(), pages(&h)), (1, 2), "still open, as it was");
+    file.rebuild(&fixture(3));
+    h.run_steps(3);
+    assert_eq!(pages(&h), 3, "and the next build shows");
+}
+
+#[test]
+fn nothing_reloads_with_the_preference_off() {
+    assert!(PdfCraftApp::new().reload_changed_files, "on by default");
+    let file = TempPdf::new("off", &fixture(2));
+    let mut h = harness(&file.path);
+    h.state_mut().reload_changed_files = false;
+    h.run_steps(1);
+    file.rebuild(&fixture(3));
+    h.run_steps(4);
+    assert_eq!(pages(&h), 2);
+    let mut restarted = PdfCraftApp::new();
+    restarted.restore(&h.state().persist());
+    assert!(!restarted.reload_changed_files, "the choice is kept");
+}
+
+#[test]
+fn a_shorter_new_version_drops_what_pointed_into_the_old_one() {
+    let file = TempPdf::new("shorter", &fixture_with(5, true));
+    let mut h = harness(&file.path);
+    h.state_mut().views[0].go_to_page(4);
+    h.state_mut().views[0].select_pages(&[3, 4]);
+    h.state_mut().views[0].comments.selected = Some((4, 0));
+    h.run_steps(2);
+    file.rebuild(&fixture(1));
+    h.run_steps(4);
+    let view = &h.state().views[0];
+    assert_eq!(pages(&h), 1);
+    assert_eq!(view.current, 0, "the page is clamped");
+    assert!(view.selected.is_empty() && view.comments.selected.is_none(), "no selection points past the new version");
+}
diff --git a/crates/ui-egui/tests/signing.rs b/crates/ui-egui/tests/signing.rs
index 516f8446..9a6558d2 100644
--- a/crates/ui-egui/tests/signing.rs
+++ b/crates/ui-egui/tests/signing.rs
@@ -2,7 +2,7 @@
 
 use egui::{Pos2, pos2};
 use egui_kittest::Harness;
-use egui_kittest::kittest::Queryable;
+use egui_kittest::kittest::{NodeT, Queryable};
 use pdfcraft_engine::SignatureStatus;
 use pdfcraft_ui_egui::{Dialog, PdfCraftApp, QuickTool, RightPanel, SignStep};
 
@@ -181,6 +181,9 @@ fn certifying_without_a_visible_signature() {
     h.get_by_label("Continue").click();
     h.run_steps(2);
     assert_eq!(h.state().digital_ids.len(), 1);
+    // The dialog shrinks onto this step. egui centers an area from the previous frame's size,
+    // so give the buttons a frame to land before clicking.
+    h.run_steps(2);
     h.get_by_label("Continue").click();
     h.run_steps(2);
     h.get_by_label("Certify as \"Test Signer EC\"");
@@ -247,6 +250,71 @@ fn clicking_an_empty_signature_field_signs_it() {
     assert!(sig.signed && sig.visible);
 }
 
+#[test]
+fn the_fill_and_sign_signature_or_an_image_shows_in_a_digital_signature() {
+    use pdfcraft_ui_egui::SignGraphic;
+    use pdfcraft_ui_egui::fill_sign::SavedSig;
+    let dir = dir().join("graphic");
+    std::fs::create_dir_all(&dir).unwrap();
+    let mut h = harness(dir.clone());
+    let p12 = concat!(env!("CARGO_MANIFEST_DIR"), "/../sign/tests/data/ec-p256.p12");
+    let cert = pdfcraft_engine::sign::pkcs12::open(&std::fs::read(p12).unwrap(), "test").unwrap().certificate;
+    let sign_as = |h: &mut Harness<'static, PdfCraftApp>, rect: [f64; 4]| {
+        h.state_mut().start_signing(0, Some(rect), None, None);
+        let entry = h.state_mut().add_digital_id(p12, &cert);
+        let d = h.state_mut().sign_draft.as_mut().unwrap();
+        (d.selected, d.step, d.password) = (Some(entry), SignStep::SignAs, "test".into());
+        h.run_steps(2);
+    };
+
+    // Without a saved Fill & Sign signature there is nothing to choose.
+    sign_as(&mut h, [20.0, 110.0, 280.0, 140.0]);
+    h.get_by_label("Graphic");
+    assert!(h.get_by_label("Fill & Sign signature").accesskit_node().is_disabled(), "disabled without one");
+    h.get_by_label("Cancel").click();
+    h.run_steps(2);
+
+    // The saved signature (typed here) takes the name's place.
+    h.state_mut().signature = Some(SavedSig::Typed("Grace Hopper".into()));
+    sign_as(&mut h, [20.0, 110.0, 280.0, 140.0]);
+    h.get_by_label("Fill & Sign signature").click();
+    h.run_steps(2);
+    assert_eq!(h.state().sign_draft.as_ref().unwrap().graphic, SignGraphic::FillSign);
+    h.get_by_label("Sign").click();
+    h.run_steps(6);
+    let s = h.state();
+    assert_eq!(s.sign_draft.as_ref().and_then(|d| d.error.clone()), None);
+    let sig = s.session.get(s.views[0].id).unwrap().signatures.iter().find(|x| x.signed).cloned().unwrap();
+    assert!(sig.visible && sig.status == SignatureStatus::Unknown, "{:?}", sig.details);
+    // Remembered for the next signature, and across a restart.
+    assert_eq!(s.sign_graphic, SignGraphic::FillSign);
+    sign_as(&mut h, [20.0, 20.0, 280.0, 60.0]);
+    assert_eq!(h.state().sign_draft.as_ref().unwrap().graphic, SignGraphic::FillSign);
+
+    // An image (the picker's result is set directly: the file dialog is native).
+    let image = {
+        let mut png = std::io::Cursor::new(Vec::new());
+        image::RgbaImage::from_pixel(60, 20, image::Rgba([200, 0, 0, 255])).write_to(&mut png, image::ImageFormat::Png).unwrap();
+        pdfcraft_engine::SignatureImage::from_bytes(png.get_ref()).unwrap()
+    };
+    h.state_mut().sign_draft.as_mut().unwrap().graphic = SignGraphic::Image(image.clone());
+    h.run_steps(2);
+    h.get_by_label("Choose image…");
+    h.get_by_label("Sign").click();
+    h.run_steps(6);
+    let s = h.state();
+    assert_eq!(s.sign_draft.as_ref().and_then(|d| d.error.clone()), None);
+    let signed = std::fs::read(dir.join("contract_signed.pdf")).unwrap();
+    assert!(signed.windows(6).any(|w| w == b"/Image"), "the image is embedded");
+    assert_eq!(s.session.get(s.views[0].id).unwrap().signatures.iter().filter(|x| x.signed).count(), 2);
+    let mut fresh = PdfCraftApp::new();
+    fresh.restore(&s.persist());
+    assert_eq!(fresh.sign_graphic, SignGraphic::Image(image));
+    // A saved choice that can't be read back falls back to the name.
+    fresh.restore(r#"{"sign_graphic": {"Image": "not base64"}}"#);
+    assert_eq!(fresh.sign_graphic, SignGraphic::Name);
+}
+
 #[test]
 fn os_store_identities_are_not_persisted() {
     let mut app = PdfCraftApp::new();
diff --git a/crates/ui-egui/tests/theme_button.rs b/crates/ui-egui/tests/theme_button.rs
new file mode 100644
index 00000000..14f34086
--- /dev/null
+++ b/crates/ui-egui/tests/theme_button.rs
@@ -0,0 +1,41 @@
+//! The title bar's theme button: a click cycles System, Light and Dark; a right-click opens the
+//! menu with the appearance settings.
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_ui_egui::PdfCraftApp;
+
+fn harness() -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app
+    });
+    h.run_steps(6);
+    h
+}
+
+fn preference(h: &Harness<'static, PdfCraftApp>) -> String {
+    format!("{:?}", h.state().theme_preference)
+}
+
+#[test]
+fn a_click_cycles_the_theme_and_a_right_click_opens_the_menu() {
+    let mut h = harness();
+    assert_eq!(preference(&h), "Light", "new installs start Light");
+    for (label, next) in
+        [("Display theme: Light gray", "Dark"), ("Display theme: Dark gray", "System"), ("Display theme: Use system setting", "Light")]
+    {
+        h.get_by_label(label).click();
+        h.run_steps(4);
+        assert_eq!(preference(&h), next);
+    }
+    assert!(h.query_by_label("Appearance settings…").is_none(), "a plain click opens no menu");
+
+    h.get_by_label("Display theme: Light gray").click_secondary();
+    h.run_steps(4);
+    h.get_by_label("Appearance settings…").click();
+    h.run_steps(4);
+    h.run_steps(10);
+    assert!(h.query_by_label("Light theme").is_some(), "Preferences opens on Appearance");
+}
diff --git a/crates/ui-egui/tests/trust_signer.rs b/crates/ui-egui/tests/trust_signer.rs
new file mode 100644
index 00000000..27bd2f3c
--- /dev/null
+++ b/crates/ui-egui/tests/trust_signer.rs
@@ -0,0 +1,87 @@
+//! The Signatures panel's one-click "Add to trusted certificates" must store the signer shown in
+//! the row, not the chain top the document embedded in the CMS (audit v3-098). Signing with a
+//! certificate whose CMS carries its issuer chain gives a signature whose `chain.last()` (the
+//! self-signed root) differs from its `certificate` (the signer); the click must trust the signer.
+
+use egui_kittest::Harness;
+use egui_kittest::kittest::Queryable;
+use pdfcraft_engine::SignatureStatus;
+use pdfcraft_ui_egui::{PdfCraftApp, SignStep};
+
+const FIXTURE: &[u8] = b"%PDF-1.7
+1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj
+2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj
+3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 300 200] /Contents 4 0 R /Resources << /Font << /F1 5 0 R >> >> >> endobj
+4 0 obj << /Length 45 >> stream
+BT /F1 14 Tf 20 150 Td (Please sign below) Tj ET
+endstream endobj
+5 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj
+trailer << /Root 1 0 R >>
+%%EOF";
+
+fn dir() -> std::path::PathBuf {
+    static NEXT: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+    let n = NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    let d = std::env::temp_dir().join(format!("pdfcraft-trust-signer-{}-{n}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&d);
+    std::fs::create_dir_all(&d).unwrap();
+    d
+}
+
+fn harness(dir: std::path::PathBuf) -> Harness<'static, PdfCraftApp> {
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(move |_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("contract.pdf", None, FIXTURE.to_vec()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        app.export_dir_override = Some(dir.to_string_lossy().into_owned());
+        app.save_override = Some(dir.join("contract_signed.pdf").to_string_lossy().into_owned());
+        app
+    });
+    h.run_steps(6);
+    h
+}
+
+#[test]
+fn one_click_trust_stores_the_displayed_signer_not_the_embedded_root() {
+    let dir = dir();
+    let mut h = harness(dir);
+    // Sign with chain.p12, whose CMS embeds the signer's issuer chain (signer + self-signed root).
+    let p12 = concat!(env!("CARGO_MANIFEST_DIR"), "/../sign/tests/data/chain.p12");
+    let id = pdfcraft_engine::sign::pkcs12::open(&std::fs::read(p12).unwrap(), "test").unwrap();
+    let entry = h.state_mut().add_digital_id(p12, &id.certificate);
+    h.state_mut().start_signing(0, None, None, None);
+    {
+        let d = h.state_mut().sign_draft.as_mut().unwrap();
+        d.selected = Some(entry);
+        d.step = SignStep::SignAs;
+        d.password = "test".into();
+    }
+    h.run_steps(2);
+    h.get_by_label("Sign").click();
+    h.run_steps(6);
+
+    // The signature validates as Unknown and carries a two-certificate chain whose top (the root)
+    // is a different certificate from the displayed signer.
+    let (signer, root) = {
+        let s = h.state();
+        let sig = s.session.get(s.views[0].id).unwrap().signatures.iter().find(|x| x.signed).cloned().expect("a signed field");
+        assert_eq!(sig.status, SignatureStatus::Unknown, "untrusted before the click");
+        assert_eq!(sig.chain.len(), 2, "the CMS embeds the signer and its root: {:?}", sig.chain.len());
+        let signer = sig.certificate.clone().expect("a signer certificate");
+        let root = sig.chain.last().cloned().expect("a chain top");
+        assert_ne!(signer.raw, root.raw, "the embedded chain top must differ from the signer for this test to be meaningful");
+        (signer, root)
+    };
+
+    // Expand the signature row and use the one-click trust button.
+    h.get_by_label_contains("Signed by").click();
+    h.run_steps(2);
+    h.get_by_label("Add to trusted certificates").click();
+    h.run_steps(3);
+
+    // The trust store holds exactly the displayed signer, never the document-supplied root.
+    let trusted = h.state().session.trusted_certificates().to_vec();
+    assert!(trusted.iter().any(|c| c.raw == signer.raw), "the displayed signer should be trusted");
+    assert!(!trusted.iter().any(|c| c.raw == root.raw), "the embedded root must not be trusted by the one-click action");
+}
diff --git a/crates/ui-egui/tests/ui.rs b/crates/ui-egui/tests/ui.rs
index a10ad230..ded8c0ca 100644
--- a/crates/ui-egui/tests/ui.rs
+++ b/crates/ui-egui/tests/ui.rs
@@ -114,6 +114,99 @@ fn opening_a_pdf_shows_comments_and_bookmarks() {
     h.get_by_label("Beta section");
 }
 
+/// Read mode hides the tools, not the navigation panes: the rail's Bookmarks button opens the
+/// bookmarks when Read is the default workspace (#932), and the left tool pane stays hidden.
+#[test]
+fn read_mode_rail_buttons_open_their_panels() {
+    use pdfcraft_ui_egui::{Mode, RightPanel};
+    let mut h = harness(|app| {
+        app.default_mode = Mode::Read;
+        app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens");
+    });
+    assert_eq!(h.state().mode, Mode::Read);
+    assert_eq!(h.state().right, None, "Read mode opens with the panes closed");
+    assert!(h.query_by_label("Alpha section").is_none());
+    h.get_by_label("Bookmarks").click();
+    h.run_steps(3);
+    assert_eq!(h.state().right, Some(RightPanel::Bookmarks));
+    h.get_by_label("Alpha section");
+    h.get_by_label("Beta section");
+    // The same button closes them again (the open panel's title is also "Bookmarks").
+    h.get_by_role_and_label(egui::accesskit::Role::Button, "Bookmarks").click();
+    h.run_steps(3);
+    assert_eq!(h.state().right, None);
+    assert!(h.query_by_label("Alpha section").is_none());
+    // A document that asks for its outline (/PageMode /UseOutlines) shows it in Read mode too.
+    let pdf = String::from_utf8(FIXTURE.to_vec()).unwrap().replace("/Outlines 6 0 R", "/Outlines 6 0 R /PageMode /UseOutlines");
+    h.state_mut().open_bytes("outline.pdf", None, pdf.into_bytes()).unwrap();
+    h.run_steps(3);
+    assert_eq!(h.state().mode, Mode::Read);
+    h.get_by_label("Alpha section");
+}
+
+/// Switching to Read mode closes the open pane, and switching back reopens it.
+#[test]
+fn read_mode_closes_the_panes_and_leaving_it_brings_them_back() {
+    use pdfcraft_ui_egui::{Mode, RightPanel};
+    let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
+    assert_eq!(h.state().right, Some(RightPanel::Comments));
+    h.get_by_label("Read").click();
+    h.run_steps(3);
+    assert_eq!(h.state().mode, Mode::Read);
+    assert_eq!(h.state().right, None);
+    assert!(h.query_by_label_contains("Check the numbers").is_none(), "the Comments panel is hidden");
+    h.state_mut().run_command("view.read_mode");
+    h.run_steps(3);
+    assert_eq!(h.state().mode, Mode::AllTools);
+    assert_eq!(h.state().right, Some(RightPanel::Comments));
+    // A pane opened in Read mode stays open on the way out.
+    h.state_mut().run_command("view.read_mode");
+    h.run_steps(2);
+    h.get_by_label("Page thumbnails").click();
+    h.run_steps(2);
+    h.get_by_label("All tools").click();
+    h.run_steps(3);
+    assert_eq!(h.state().right, Some(RightPanel::Pages));
+}
+
+/// A pane closed in Read mode stays closed on the way out: leaving Read mode doesn't bring back the
+/// pane saved on the way in, and closing Comments keeps its close preference.
+#[test]
+fn a_pane_closed_in_read_mode_stays_closed_when_leaving_it() {
+    use pdfcraft_ui_egui::{Mode, RightPanel};
+    let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
+    assert_eq!(h.state().right, Some(RightPanel::Comments));
+    h.get_by_label("Read").click();
+    h.run_steps(3);
+    assert_eq!(h.state().right, None);
+    // Open Comments from the rail, then close it again.
+    h.get_by_role_and_label(egui::accesskit::Role::Button, "Comments").click();
+    h.run_steps(3);
+    assert_eq!(h.state().right, Some(RightPanel::Comments));
+    h.get_by_role_and_label(egui::accesskit::Role::Button, "Comments").click();
+    h.run_steps(3);
+    assert_eq!(h.state().right, None);
+    assert!(h.state().comments_panel_closed);
+    // Leave Read mode through the toolbar.
+    h.get_by_label("All tools").click();
+    h.run_steps(3);
+    assert_eq!(h.state().mode, Mode::AllTools);
+    assert_eq!(h.state().right, None, "the pane closed in Read mode stays closed");
+    assert!(h.state().comments_panel_closed);
+    // The same through the Read mode command.
+    h.state_mut().choose_right_panel(Some(RightPanel::Comments));
+    h.state_mut().run_command("view.read_mode");
+    h.run_steps(2);
+    assert_eq!(h.state().mode, Mode::Read);
+    h.state_mut().choose_right_panel(Some(RightPanel::Comments));
+    h.state_mut().choose_right_panel(None);
+    h.state_mut().run_command("view.read_mode");
+    h.run_steps(3);
+    assert_ne!(h.state().mode, Mode::Read);
+    assert_eq!(h.state().right, None);
+    assert!(h.state().comments_panel_closed);
+}
+
 /// A right-to-left file name opens, lays out and paints; the tab's accessible name keeps the
 /// logical text (only the painted label is put in visual order).
 #[test]
@@ -225,6 +318,26 @@ fn tabs_shrink_to_fit_then_arrows_step_through_them_and_open_stays_in_sight() {
     assert!(open.left() > 0.0 && open.right() <= discord.left(), "Open {open:?} stays in sight left of Discord {discord:?}");
 }
 
+/// macOS (#789): with the integrated title bar, the strip is the 28 pt band AppKit centres the
+/// traffic lights in, and everything in it fits that band and clears the lights.
+#[cfg(target_os = "macos")]
+#[test]
+fn the_integrated_title_bar_is_the_traffic_light_band() {
+    let h = harness(|app| {
+        app.integrated_titlebar = true;
+        app.open_bytes("band.pdf", None, FIXTURE.to_vec()).unwrap();
+    });
+    let band = 28.0;
+    for label in ["Home", "band.pdf", "Open", "Discord", "Keyboard shortcuts"] {
+        let r = h.get_by_label(label).rect();
+        assert!(r.top() >= 0.0 && r.bottom() <= band, "{label}: {r:?} inside the {band} pt title bar");
+        assert!(r.height() >= 24.0, "{label}: {r:?} stays clickable");
+    }
+    // Content starts after the three lights (the last one ends 62 pt in) with a gap.
+    let home = h.get_by_label("Home").rect();
+    assert!(home.left() >= 62.0 + 4.0, "Home {home:?} clears the traffic lights");
+}
+
 #[test]
 fn narrow_tab_strips_accept_vertical_wheel_scrolling() {
     for width in [600.0, 900.0] {
@@ -503,6 +616,43 @@ fn dropping_a_pdf_on_the_window_opens_it() {
     h.get_by_label_contains("dropped.pdf");
 }
 
+#[test]
+fn a_file_dropped_on_the_page_grid_is_read_from_disk_and_inserted() {
+    // The grid's drop reads a file from its path when its turn to be inserted comes, and inserts it
+    // at the end when the pointer doesn't say where it went (about a second).
+    let dir = std::env::temp_dir().join(format!("pdfcraft-grid-drop-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("dropped.pdf");
+    let setup = PdfCraftApp::new();
+    let pdf = setup.session.create_from_text("dropped", "from disk").unwrap();
+    std::fs::write(&path, pdf.as_slice()).unwrap();
+    let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        let grid = app.session.create_from_text("grid", "one page").unwrap();
+        app.open_bytes("grid.pdf", None, grid.to_vec()).unwrap();
+        app.views[0].organize = true;
+        app
+    });
+    h.run_steps(3);
+    let pages = |h: &egui_kittest::Harness<'_, PdfCraftApp>| {
+        let app = h.state();
+        app.session.get(app.views[0].id).unwrap().info.pages.len()
+    };
+    assert_eq!(pages(&h), 1);
+    let file: egui::DroppedFileHandle = std::sync::Arc::new(Dropped { path: path.clone(), bytes: Vec::new() });
+    h.input_mut().dropped_files.push(file);
+    for _ in 0..300 {
+        h.run_steps(1);
+        if pages(&h) == 2 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(10));
+    }
+    assert_eq!(pages(&h), 2, "the dropped file's page is inserted at the end of the grid");
+    let _ = std::fs::remove_dir_all(&dir);
+}
+
 #[test]
 fn pdfs_dropped_on_the_combine_tab_join_its_list() {
     let mut h = Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_eframe(|_cc| {
@@ -787,6 +937,27 @@ fn cancelling_then_discarding_an_earlier_dirty_tab_preserves_the_selected_docume
     }
 }
 
+#[test]
+fn long_german_tool_labels_stay_within_the_sidebar() {
+    use pdfcraft_ui_egui::{LeftPanel, Mode};
+    let mut h = harness(|app| app.open_bytes("fixture.pdf", None, FIXTURE.to_vec()).expect("fixture opens"));
+    h.state_mut().set_option("language", "de").unwrap();
+    h.state_mut().mode = Mode::AllTools;
+    h.state_mut().left_open = true;
+    // The tool heading has to leave room for Back and Close even when translated.
+    h.state_mut().left = LeftPanel::Tool("fill_sign");
+    h.run_steps(4);
+    let heading =
+        painted_text(&h).into_iter().find(|(s, ..)| s.starts_with("Ausfüllen und")).expect("translated heading is painted, whole or elided");
+    assert!(heading.2.right() <= 272.0, "translated heading runs past the sidebar: {:?}", heading.2);
+    // A long sub-tool name must stop before its status chip, not paint over the PDF.
+    h.state_mut().left = LeftPanel::Tool("protect");
+    h.run_steps(4);
+    let item =
+        painted_text(&h).into_iter().find(|(s, ..)| s == "Ausgeblendete Informationen entfernen").expect("long translated sub-tool is painted");
+    assert!(item.2.right() <= 272.0, "translated tool item runs past the sidebar: {:?}", item.2);
+}
+
 #[test]
 fn document_tabs_expose_selection_and_activate_from_keyboard() {
     use egui::accesskit::Role;
diff --git a/crates/ui-egui/tests/animate.rs b/crates/ui-egui/tests/ui_group/animate.rs
similarity index 100%
rename from crates/ui-egui/tests/animate.rs
rename to crates/ui-egui/tests/ui_group/animate.rs
diff --git a/crates/ui-egui/tests/bulk_fields.rs b/crates/ui-egui/tests/ui_group/bulk_fields.rs
similarity index 98%
rename from crates/ui-egui/tests/bulk_fields.rs
rename to crates/ui-egui/tests/ui_group/bulk_fields.rs
index b2c75c26..31732751 100644
--- a/crates/ui-egui/tests/bulk_fields.rs
+++ b/crates/ui-egui/tests/ui_group/bulk_fields.rs
@@ -89,8 +89,11 @@ fn shared_properties_preserve_mixed_values_and_undo_the_whole_change() {
     h.state_mut().bulk_field_props.as_mut().unwrap().required.value = true;
     h.get_by_label("Appearance").click();
     h.run_steps(4);
+    h.get_by_label("Line Thickness:").scroll_to_me();
+    h.run_steps(4);
     h.get_by_label("Line Thickness:").click();
     h.run_steps(4);
+    assert!(h.state().bulk_field_props.as_ref().unwrap().width.apply, "thickness click enables the property");
     h.state_mut().bulk_field_props.as_mut().unwrap().width.value = 4.0;
     h.get_by_label("OK").click();
     h.run_steps(4);
diff --git a/crates/ui-egui/tests/column_select.rs b/crates/ui-egui/tests/ui_group/column_select.rs
similarity index 100%
rename from crates/ui-egui/tests/column_select.rs
rename to crates/ui-egui/tests/ui_group/column_select.rs
diff --git a/crates/ui-egui/tests/identity.rs b/crates/ui-egui/tests/ui_group/identity.rs
similarity index 100%
rename from crates/ui-egui/tests/identity.rs
rename to crates/ui-egui/tests/ui_group/identity.rs
diff --git a/crates/ui-egui/tests/layer_actions.rs b/crates/ui-egui/tests/ui_group/layer_actions.rs
similarity index 100%
rename from crates/ui-egui/tests/layer_actions.rs
rename to crates/ui-egui/tests/ui_group/layer_actions.rs
diff --git a/crates/ui-egui/tests/links.rs b/crates/ui-egui/tests/ui_group/links.rs
similarity index 100%
rename from crates/ui-egui/tests/links.rs
rename to crates/ui-egui/tests/ui_group/links.rs
diff --git a/crates/ui-egui/tests/ui_group/main.rs b/crates/ui-egui/tests/ui_group/main.rs
new file mode 100644
index 00000000..4c59ca93
--- /dev/null
+++ b/crates/ui-egui/tests/ui_group/main.rs
@@ -0,0 +1,20 @@
+//! One test binary for the UI tests that are safe to share a process (#454): each links the whole
+//! UI and render stack, so grouping them saves a link unit apiece. Tests that hold a GPU device,
+//! write screenshots, use process-ID temporary paths or probe installed fonts stay standalone
+//! in `tests/`. A file in this folder is only built if it is listed here.
+
+mod animate;
+mod bulk_fields;
+mod column_select;
+mod identity;
+mod layer_actions;
+mod links;
+mod marks;
+mod pageboxes;
+mod pdf_links;
+mod protect;
+mod redact;
+mod text_select;
+mod theme;
+mod updates;
+mod xfa;
diff --git a/crates/ui-egui/tests/marks.rs b/crates/ui-egui/tests/ui_group/marks.rs
similarity index 98%
rename from crates/ui-egui/tests/marks.rs
rename to crates/ui-egui/tests/ui_group/marks.rs
index 0a216ba5..285442f9 100644
--- a/crates/ui-egui/tests/marks.rs
+++ b/crates/ui-egui/tests/ui_group/marks.rs
@@ -64,6 +64,7 @@ fn watermark_and_background_dialogs() {
     h.state_mut().execute("edit.watermark");
     h.run_steps(2);
     assert!(h.query_by(|n| n.label().as_deref() == Some("OK") && n.is_disabled()).is_some(), "OK waits for text");
+    h.get_by_label("Offset from centre");
     h.state_mut().marks_draft.wm.text = "DRAFT".into();
     h.run_steps(2);
     h.get_by_label("OK").click();
diff --git a/crates/ui-egui/tests/pageboxes.rs b/crates/ui-egui/tests/ui_group/pageboxes.rs
similarity index 100%
rename from crates/ui-egui/tests/pageboxes.rs
rename to crates/ui-egui/tests/ui_group/pageboxes.rs
diff --git a/crates/ui-egui/tests/pdf_links.rs b/crates/ui-egui/tests/ui_group/pdf_links.rs
similarity index 96%
rename from crates/ui-egui/tests/pdf_links.rs
rename to crates/ui-egui/tests/ui_group/pdf_links.rs
index a149b3d3..d5eabb2a 100644
--- a/crates/ui-egui/tests/pdf_links.rs
+++ b/crates/ui-egui/tests/ui_group/pdf_links.rs
@@ -11,7 +11,7 @@ fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).with_step_dt(1.0 / 60.0).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
-        app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
+        app.open_bytes("form.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
         app.set_option("zoom", "150").unwrap();
         app
     });
diff --git a/crates/ui-egui/tests/protect.rs b/crates/ui-egui/tests/ui_group/protect.rs
similarity index 100%
rename from crates/ui-egui/tests/protect.rs
rename to crates/ui-egui/tests/ui_group/protect.rs
diff --git a/crates/ui-egui/tests/redact.rs b/crates/ui-egui/tests/ui_group/redact.rs
similarity index 98%
rename from crates/ui-egui/tests/redact.rs
rename to crates/ui-egui/tests/ui_group/redact.rs
index 74d883ca..2de4cc85 100644
--- a/crates/ui-egui/tests/redact.rs
+++ b/crates/ui-egui/tests/ui_group/redact.rs
@@ -10,7 +10,7 @@ fn harness() -> Harness<'static, PdfCraftApp> {
     let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
         let mut app = PdfCraftApp::new();
         app.set_option("language", "en").unwrap();
-        app.open_bytes("form.pdf", None, include_bytes!("data/form.pdf").to_vec()).unwrap();
+        app.open_bytes("form.pdf", None, include_bytes!("../data/form.pdf").to_vec()).unwrap();
         app.set_option("zoom", "150").unwrap();
         app
     });
diff --git a/crates/ui-egui/tests/text_select.rs b/crates/ui-egui/tests/ui_group/text_select.rs
similarity index 79%
rename from crates/ui-egui/tests/text_select.rs
rename to crates/ui-egui/tests/ui_group/text_select.rs
index 342668b5..fc8d19a8 100644
--- a/crates/ui-egui/tests/text_select.rs
+++ b/crates/ui-egui/tests/ui_group/text_select.rs
@@ -139,3 +139,28 @@ fn shift_click_extends_the_selection_from_its_anchor() {
     shift_click(&mut h, n);
     assert_eq!(h.state().views[0].selected_text(), None);
 }
+
+/// Issue #1024: multi-click selection triggers immediately on pointer press, before release.
+#[test]
+fn multiclick_selects_on_pointer_press_before_release() {
+    let (mut h, at) = harness(|_| {});
+    // First click: press and release.
+    click(&mut h, at);
+    // Second click: press and HOLD (do not release).
+    h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("quick"), "word highlights on press");
+    // Release the second click: still selected.
+    h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("quick"), "word stays selected on release");
+
+    // Third click: press and HOLD.
+    h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: true, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("The quick brown fox"), "line highlights on press");
+    // Release third click.
+    h.event(Event::PointerButton { pos: at, button: PointerButton::Primary, pressed: false, modifiers: Modifiers::NONE });
+    h.run_steps(1);
+    assert_eq!(h.state().views[0].selected_text().as_deref(), Some("The quick brown fox"), "line stays selected on release");
+}
diff --git a/crates/ui-egui/tests/theme.rs b/crates/ui-egui/tests/ui_group/theme.rs
similarity index 51%
rename from crates/ui-egui/tests/theme.rs
rename to crates/ui-egui/tests/ui_group/theme.rs
index 2b16796f..2a7e0e26 100644
--- a/crates/ui-egui/tests/theme.rs
+++ b/crates/ui-egui/tests/ui_group/theme.rs
@@ -21,15 +21,18 @@ fn assert_theme(h: &Harness<'static, PdfCraftApp>, preference: ThemePreference,
     assert_eq!(h.state().theme, kind);
     assert_eq!(Tokens::get(&h.ctx).kind, kind);
     assert_eq!(h.ctx.global_style().visuals.dark_mode, kind == ThemeKind::Dark);
-    assert_eq!(h.ctx.theme(), if kind == ThemeKind::Dark { egui::Theme::Dark } else { egui::Theme::Light });
+    assert_eq!(h.ctx.options(|o| o.theme_preference), egui::ThemePreference::System);
+    for branch in [egui::Theme::Light, egui::Theme::Dark] {
+        let style = h.ctx.style_of(branch);
+        assert_eq!(style.visuals.dark_mode, kind == ThemeKind::Dark);
+        assert_eq!(style.visuals.panel_fill, Tokens::for_kind(kind).panel);
+    }
 }
 
-fn open_toolbar(h: &mut Harness<'static, PdfCraftApp>, label: &str) {
+/// A click on the title bar's theme button cycles Light, Dark, System.
+fn click_toolbar(h: &mut Harness<'static, PdfCraftApp>, label: &str) {
     h.get_by_label(&format!("Display theme: {label}")).click();
     h.run_steps(3);
-    for choice in ["Use system setting", "Light gray", "Dark gray"] {
-        h.get_by_label(choice);
-    }
 }
 
 fn open_view_menu(h: &mut Harness<'static, PdfCraftApp>) {
@@ -50,18 +53,16 @@ fn toolbar_and_view_menu_share_three_state_preferences() {
     let mut h = harness();
     // Explicit light wins even on a dark desktop, including egui's popup style.
     assert_theme(&h, ThemePreference::Light, ThemeKind::Light);
-    open_toolbar(&mut h, "Light gray");
-    h.get_by_label("Use system setting").click();
-    h.run_steps(3);
+    click_toolbar(&mut h, "Light gray");
+    assert_theme(&h, ThemePreference::Dark, ThemeKind::Dark);
+    click_toolbar(&mut h, "Dark gray");
     assert_theme(&h, ThemePreference::System, ThemeKind::Dark);
 
     open_view_menu(&mut h);
     h.get_by_label("Light gray").click();
     h.run_steps(3);
     assert_theme(&h, ThemePreference::Light, ThemeKind::Light);
-    open_toolbar(&mut h, "Light gray");
-    h.get_by_label("Dark gray").click();
-    h.run_steps(3);
+    click_toolbar(&mut h, "Light gray");
     assert_theme(&h, ThemePreference::Dark, ThemeKind::Dark);
 
     open_view_menu(&mut h);
@@ -71,9 +72,8 @@ fn toolbar_and_view_menu_share_three_state_preferences() {
     h.input_mut().system_theme = Some(egui::Theme::Light);
     h.run_steps(3);
     assert_theme(&h, ThemePreference::System, ThemeKind::Light);
-    open_toolbar(&mut h, "Use system setting");
-    h.get_by_label("Dark gray").click();
-    h.run_steps(3);
+    click_toolbar(&mut h, "Use system setting");
+    click_toolbar(&mut h, "Light gray");
     // A manual choice exits system mode and survives subsequent OS changes.
     h.input_mut().system_theme = Some(egui::Theme::Dark);
     h.run_steps(2);
@@ -116,13 +116,91 @@ fn commands_and_options_apply_before_the_first_frame() {
     assert_eq!(app.theme, ThemeKind::Dark);
     app.run_command("view.theme.system");
     assert_eq!(app.theme_preference, ThemePreference::System);
+    assert_eq!(app.theme, ThemeKind::Light);
     // The existing palette/control toggle also goes through the preference setter.
     app.run_command("view.theme");
-    assert_eq!(app.theme_preference, ThemePreference::Light);
-    assert_eq!(app.theme, ThemeKind::Light);
+    assert_eq!(app.theme_preference, ThemePreference::Dark);
+    assert_eq!(app.theme, ThemeKind::Dark);
     app.run_command("view.theme.light");
     app.set_option("theme", "dark").unwrap();
     assert!(app.set_option("theme", "purple").unwrap_err().contains("light, dark, or system"));
     assert_eq!(app.theme_preference, ThemePreference::Dark);
     assert_eq!(app.theme, ThemeKind::Dark);
 }
+
+#[test]
+fn restored_system_tracks_native_input_without_rewriting_saved_preference() {
+    let mut h = Harness::builder().with_size(egui::vec2(1100.0, 800.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.restore(r#"{"theme":"System"}"#);
+        app
+    });
+    for (input, expected) in [
+        (Some(egui::Theme::Dark), ThemeKind::Dark),
+        (Some(egui::Theme::Light), ThemeKind::Light),
+        (None, ThemeKind::Light),
+        (Some(egui::Theme::Dark), ThemeKind::Dark),
+    ] {
+        h.input_mut().system_theme = input;
+        h.run_steps(3);
+        assert_theme(&h, ThemePreference::System, expected);
+        assert_eq!(serde_json::from_str::<serde_json::Value>(&h.state().persist()).unwrap()["theme"], "System");
+    }
+    for (manual, expected) in [(ThemePreference::Light, ThemeKind::Light), (ThemePreference::Dark, ThemeKind::Dark)] {
+        h.state_mut().set_theme_preference(manual);
+        for input in [Some(egui::Theme::Dark), Some(egui::Theme::Light), None] {
+            h.input_mut().system_theme = input;
+            h.run_steps(3);
+            assert_theme(&h, manual, expected);
+        }
+    }
+}
+
+#[test]
+fn unknown_system_uses_light_after_a_manual_dark_choice() {
+    let mut app = PdfCraftApp::new();
+    app.set_theme_preference(ThemePreference::Dark);
+    app.set_theme_preference(ThemePreference::System);
+    assert_eq!(app.theme, ThemeKind::Light);
+    assert_eq!(serde_json::from_str::<serde_json::Value>(&app.persist()).unwrap()["theme"], "System");
+}
+
+#[test]
+fn native_appearance_remains_inherited_for_every_saved_choice() {
+    #[derive(Clone)]
+    struct NativeCommands(std::sync::Arc<std::sync::Mutex<Vec<egui::SystemTheme>>>);
+    impl egui::Plugin for NativeCommands {
+        fn debug_name(&self) -> &'static str {
+            "theme-command-proof"
+        }
+        fn output_hook(&mut self, _ctx: &egui::Context, output: &mut egui::FullOutput) {
+            for command in output.viewport_output.values().flat_map(|v| &v.commands) {
+                if let egui::ViewportCommand::SetTheme(theme) = command {
+                    self.0.lock().unwrap().push(*theme);
+                }
+            }
+        }
+    }
+    for preference in [ThemePreference::System, ThemePreference::Light, ThemePreference::Dark] {
+        let commands = NativeCommands(Default::default());
+        let observed = commands.clone();
+        let mut h = Harness::builder().with_size(egui::vec2(1100.0, 800.0)).build_eframe(move |cc| {
+            cc.egui_ctx.add_plugin(commands);
+            let mut app = PdfCraftApp::new();
+            app.set_option("language", "en").unwrap();
+            app.set_theme_preference(preference);
+            app
+        });
+        h.input_mut().system_theme = Some(egui::Theme::Light);
+        h.run_steps(3);
+        h.input_mut().system_theme = Some(egui::Theme::Dark);
+        h.run_steps(3);
+        // Observe the actual app's startup and later viewport output. This proves
+        // native window intent, not operating-system ThemeChanged delivery.
+        let commands = observed.0.lock().unwrap();
+        assert!(!commands.is_empty());
+        assert!(commands.iter().all(|theme| *theme == egui::SystemTheme::SystemDefault), "{commands:?}");
+        assert_eq!(h.ctx.options(|o| o.theme_preference), egui::ThemePreference::System);
+    }
+}
diff --git a/crates/ui-egui/tests/updates.rs b/crates/ui-egui/tests/ui_group/updates.rs
similarity index 100%
rename from crates/ui-egui/tests/updates.rs
rename to crates/ui-egui/tests/ui_group/updates.rs
diff --git a/crates/ui-egui/tests/xfa.rs b/crates/ui-egui/tests/ui_group/xfa.rs
similarity index 95%
rename from crates/ui-egui/tests/xfa.rs
rename to crates/ui-egui/tests/ui_group/xfa.rs
index 587972d5..ccae2ea5 100644
--- a/crates/ui-egui/tests/xfa.rs
+++ b/crates/ui-egui/tests/ui_group/xfa.rs
@@ -135,10 +135,10 @@ fn xfa_buttons_run_their_scripts_in_the_app() {
     };
     assert!(!names(&h).iter().any(|n| n == "amount_2"));
     click_field(&mut h, "addRow");
-    assert!(names(&h).iter().any(|n| n == "amount_2"), "{:?}", names(&h));
+    assert!(names(&h).iter().any(|n| n == "amount_2"), "{:?}; script console: {:?}", names(&h), h.state().js_console.log);
     // The message box shows as a notice.
     click_field(&mut h, "hello");
-    h.get_by_label_contains("Hello 2");
+    assert!(h.query_by_label_contains("Hello 2").is_some(), "script console: {:?}", h.state().js_console.log);
 }
 
 #[test]
@@ -147,7 +147,7 @@ fn messages_from_scripts_run_on_open_show_right_away() {
         .replace("if (qty.rawValue === null) qty.rawValue = 2;", r#"xfa.host.messageBox("Welcome to the form"); xfa.host.print();"#);
     let mut h = open(pdfcraft_xfa::fixtures::shell(&tpl));
     h.run_steps(2);
-    h.get_by_label_contains("Welcome to the form");
+    assert!(h.query_by_label_contains("Welcome to the form").is_some(), "script console: {:?}", h.state().js_console.log);
     assert_eq!(h.state().dialog, None, "an initialize script can't open the Print dialog");
     let id = h.state().views[0].id;
     assert!(h.state_mut().session.take_js_output(id).is_empty(), "nothing waits for the next edit");
diff --git a/crates/ui-egui/tests/view.rs b/crates/ui-egui/tests/view.rs
index bc216c23..e1963d33 100644
--- a/crates/ui-egui/tests/view.rs
+++ b/crates/ui-egui/tests/view.rs
@@ -157,6 +157,24 @@ fn two_up_layout_places_pages_side_by_side() {
     assert!(c.min.y > a.max.y);
 }
 
+#[test]
+fn two_page_view_shows_one_spread_at_a_time_until_continuous() {
+    use pdfcraft_ui_egui::canvas::PageLayout;
+    // Two-page view without continuous scrolling shows just the current spread; the continuous
+    // checkbox reveals the rest (#752).
+    let mut h = harness(&[("layout", "two-page"), ("zoom", "50")]);
+    h.run_steps(4);
+    assert_eq!(h.state().views[0].layout, PageLayout::TwoUp);
+    assert!(!h.state().views[0].continuous(), "`two-page` is the non-scrolling two-page display");
+    assert!(rect(&h, 0).is_some() && rect(&h, 1).is_some(), "the first spread is on screen");
+    assert!(rect(&h, 2).is_none(), "the next spread is not shown until paged or scrolled");
+    // Turning on continuous scrolling lays every spread out in one column.
+    h.state_mut().set_option("continuous", "on").unwrap();
+    h.run_steps(4);
+    assert!(rect(&h, 2).is_some(), "continuous scrolling reveals the later spreads");
+    assert_eq!(h.state().views[0].layout, PageLayout::TwoUp, "the base layout is unchanged");
+}
+
 #[test]
 fn single_page_layout_shows_one_page_at_a_time() {
     let mut h = harness(&[("layout", "single"), ("zoom", "50")]);
@@ -253,9 +271,15 @@ fn page_display_commands_switch_layouts() {
     assert!(h.state().views[0].cover, "the cover toggle flips");
     assert!(h.state_mut().execute("view.layout.cover"));
     assert!(!h.state().views[0].cover, "toggling twice restores");
-    h.state_mut().execute("view.layout.continuous");
+    // Continuous scrolling is an independent toggle over the base layout (#752).
+    assert!(h.state().views[0].continuous(), "the default view scrolls continuously");
+    h.state_mut().execute("view.continuous");
     h.run_steps(3);
-    assert_eq!(h.state().views[0].layout, pdfcraft_ui_egui::canvas::PageLayout::Continuous);
+    assert!(!h.state().views[0].continuous(), "the checkbox turns continuous scrolling off");
+    assert_eq!(h.state().views[0].layout, pdfcraft_ui_egui::canvas::PageLayout::TwoUp, "toggling scrolling leaves the base layout");
+    h.state_mut().execute("view.layout.single");
+    assert_eq!(h.state().views[0].layout, pdfcraft_ui_egui::canvas::PageLayout::Single);
+    assert!(!h.state().views[0].continuous(), "switching the base layout leaves scrolling off");
 }
 
 #[test]
@@ -264,7 +288,8 @@ fn layout_option_rejects_typos() {
     assert!(h.state_mut().set_option("layout", "singel").is_err());
     assert!(h.state_mut().set_option("default-layout", "bogus").is_err());
     assert!(h.state_mut().set_option("cover", "maybe").is_err());
-    assert_eq!(h.state().views[0].layout, pdfcraft_ui_egui::canvas::PageLayout::Continuous);
+    assert_eq!(h.state().views[0].layout, pdfcraft_ui_egui::canvas::PageLayout::Single);
+    assert!(h.state().views[0].continuous(), "a rejected typo leaves the default display unchanged");
     assert!(h.state_mut().set_option("cover", "on").is_err(), "cover needs two-page view first");
     h.state_mut().set_option("layout", "two-up").unwrap();
     h.state_mut().set_option("cover", "on").unwrap();
@@ -286,8 +311,9 @@ fn view_options_without_a_document() {
 #[test]
 fn default_page_display_is_used_for_new_documents() {
     use pdfcraft_ui_egui::canvas::PageLayout;
-    // The factory default is continuous scrolling without snap jumps.
-    assert_eq!(PdfCraftApp::new().view_defaults.layout, PageLayout::Continuous);
+    // The factory default is single page, scrolling continuously, without snap jumps.
+    assert_eq!(PdfCraftApp::new().view_defaults.layout, PageLayout::Single);
+    assert!(PdfCraftApp::new().view_defaults.continuous);
     let mut h = harness(&[]);
     h.state_mut().set_option("default-layout", "single").unwrap();
     h.state_mut().open_bytes("other.pdf", None, PAGES.to_vec()).expect("opens");
@@ -309,7 +335,8 @@ fn default_page_display_is_used_for_new_documents() {
     let mut legacy = PdfCraftApp::new();
     legacy.set_option("language", "en").unwrap();
     legacy.restore("{}");
-    assert_eq!(legacy.view_defaults.layout, PageLayout::Continuous);
+    assert_eq!(legacy.view_defaults.layout, PageLayout::Single);
+    assert!(legacy.view_defaults.continuous, "a legacy file without the key keeps the factory default");
 }
 
 #[test]
@@ -367,9 +394,9 @@ fn rail_page_display_menu_offers_acrobats_view_choices() {
         h.get_by_label(item).click();
         h.run_steps(4);
     };
-    let shown = |h: &Harness<'static, PdfCraftApp>| (h.state().views[0].layout, h.state().views[0].fit);
+    let shown = |h: &Harness<'static, PdfCraftApp>| (h.state().views[0].layout, h.state().views[0].continuous(), h.state().views[0].fit);
     pick(&mut h, "Fit one full page");
-    assert_eq!(shown(&h), (PageLayout::Single, Fit::Page));
+    assert_eq!(shown(&h), (PageLayout::Single, false, Fit::Page), "one full page at a time, not scrolling");
     // The whole page fits at once, so the wheel turns pages without zooming out first.
     let at = h.state().views[0].viewport_rect().center();
     h.hover_at(at);
@@ -382,7 +409,7 @@ fn rail_page_display_menu_offers_acrobats_view_choices() {
     pick(&mut h, "Zoom to page level");
     assert_eq!(h.state().views[0].fit, Fit::Page);
     pick(&mut h, "Fit to width scrolling");
-    assert_eq!(shown(&h), (PageLayout::Continuous, Fit::Width));
+    assert_eq!(shown(&h), (PageLayout::Single, true, Fit::Width), "single page, scrolling continuously");
 }
 
 #[test]
@@ -920,3 +947,66 @@ trailer << /Root 1 0 R >>
     let first = detail(&mut h);
     assert!(first * 10 > sharp * 7, "the first frame after zooming lost its detail: {first} against {sharp}");
 }
+
+#[test]
+fn sidebar_collapse_and_resize_preserves_scroll_position() {
+    use pdfcraft_ui_egui::canvas::Fit;
+    let mut h = Harness::builder().with_size(egui::vec2(1400.0, 900.0)).build_eframe(|_cc| {
+        let mut app = PdfCraftApp::new();
+        app.set_option("language", "en").unwrap();
+        app.open_bytes("pages.pdf", None, PAGES.to_vec()).expect("opens");
+        app.set_option("left", "closed").unwrap();
+        app.set_option("panel", "bookmarks").unwrap();
+        app.set_option("layout", "continuous").unwrap();
+        app
+    });
+    let mut width = 0.0;
+    for _ in 0..400 {
+        h.run_steps(1);
+        let w = h.state().views[0].viewport_rect().width();
+        if w == width {
+            break;
+        }
+        width = w;
+    }
+    h.state_mut().views[0].go_to_page(2);
+    h.run_steps(6);
+
+    let v = &h.state().views[0];
+    assert_eq!(v.current, 2);
+    assert_eq!(v.fit, Fit::Width);
+    let zoom_before = v.zoom;
+    let rect_before = v.page_screen_rect(2).expect("page 2 on screen");
+    let vp_before = v.viewport_rect();
+    let rel_y_before = rect_before.min.y - vp_before.min.y;
+
+    // Collapse bookmarks panel: available width increases, so fit-width zoom increases.
+    h.state_mut().set_option("panel", "none").unwrap();
+    h.run_steps(6);
+
+    let v = &h.state().views[0];
+    let zoom_after = v.zoom;
+    assert!(zoom_after > zoom_before, "zoom increased when panel collapsed: {zoom_after} vs {zoom_before}");
+    assert_eq!(v.current, 2, "still on page 2 after panel collapsed");
+    let rect_after = v.page_screen_rect(2).expect("page 2 still on screen");
+    let vp_after = v.viewport_rect();
+    let rel_y_after = rect_after.min.y - vp_after.min.y;
+    assert!((rel_y_after - rel_y_before).abs() < 1.0, "page 2 scroll position preserved: before {rel_y_before}, after {rel_y_after}");
+
+    // Reopen bookmarks panel: available width decreases, so fit-width zoom decreases.
+    h.state_mut().set_option("panel", "bookmarks").unwrap();
+    for _ in 0..400 {
+        h.run_steps(1);
+        let w = h.state().views[0].viewport_rect().width();
+        if w == width {
+            break;
+        }
+        width = w;
+    }
+    let v = &h.state().views[0];
+    assert_eq!(v.current, 2, "still on page 2 after panel reopened");
+    let rect_reopened = v.page_screen_rect(2).expect("page 2 still on screen");
+    let vp_reopened = v.viewport_rect();
+    let rel_y_reopened = rect_reopened.min.y - vp_reopened.min.y;
+    assert!((rel_y_reopened - rel_y_before).abs() < 1.0, "page 2 scroll position preserved on reopen: before {rel_y_before}, after {rel_y_reopened}");
+}
diff --git a/crates/ui-egui/tests/viewer.rs b/crates/ui-egui/tests/viewer.rs
index 22eaa744..fa32dc8c 100644
--- a/crates/ui-egui/tests/viewer.rs
+++ b/crates/ui-egui/tests/viewer.rs
@@ -281,6 +281,8 @@ fn initial_view_is_edited_and_honoured_on_open() {
         v.language = Some("de-DE".into());
     }
     h.run_steps(2);
+    // The dialog's height settles a frame after it opens; egui centers from the previous size.
+    h.run_steps(2);
     h.get_by_label("OK").click();
     h.run_steps(3);
     let s = h.state();
@@ -404,6 +406,8 @@ fn an_earlier_revision_opens_from_document_properties() {
     h.state_mut().dialog = Some(Dialog::Properties(pdfcraft_ui_egui::PropsTab::Advanced));
     h.run_steps(2);
     h.run_steps(2);
+    // Let the dialog finish centering before the revision button is clicked.
+    h.run_steps(2);
     h.get_by_label("View revision 1").click();
     h.run_steps(3);
     let s = h.state();
@@ -548,7 +552,8 @@ fn arrow_and_page_keys_move_through_a_scrolling_document() {
     h.state_mut().active = Some(0);
     h.state_mut().views[0].fit = Fit::Width;
     h.run_steps(4);
-    assert_eq!(h.state().views[0].layout, PageLayout::Continuous);
+    assert_eq!(h.state().views[0].layout, PageLayout::Single);
+    assert!(h.state().views[0].continuous(), "the default view scrolls continuously");
     let press = |h: &mut Harness<'static, PdfCraftApp>, key, times: usize| {
         for _ in 0..times {
             h.key_press(key);
@@ -582,6 +587,7 @@ fn arrow_and_page_keys_move_through_a_scrolling_document() {
     assert_eq!(press(&mut h, Key::ArrowRight, 1), 2);
     // single-page view keeps Page Down for the next page
     h.state_mut().views[0].layout = PageLayout::Single;
+    h.state_mut().views[0].continuous = false;
     h.run_steps(4);
     assert_eq!(press(&mut h, Key::PageDown, 1), 3);
 }
@@ -595,6 +601,7 @@ fn up_and_down_turn_pages_in_single_page_view() {
     let mut h = harness();
     h.state_mut().active = Some(0);
     h.state_mut().views[0].layout = PageLayout::Single;
+    h.state_mut().views[0].continuous = false;
     h.state_mut().views[0].fit = Fit::Page;
     h.run_steps(4);
     let press = |h: &mut Harness<'static, PdfCraftApp>, key, times: usize| {
@@ -794,3 +801,37 @@ fn pages_panel_thumbnails_have_a_context_menu() {
     h.run_steps(3);
     assert_eq!(h.state().page_clipboard.as_ref().map(|c| c.pages.clone()), Some(vec![2]));
 }
+
+/// #444, #186: a mouse-wheel notch scrolls as far as the scroll speed preference says;
+/// trackpad (point) scrolling keeps its own speed. The choice is saved.
+#[test]
+fn the_scroll_speed_preference_scales_mouse_wheel_notches() {
+    use pdfcraft_ui_egui::scroll_speed::ScrollSpeed;
+    let scrolled = |speed: ScrollSpeed, unit: egui::MouseWheelUnit, dy: f32| -> f32 {
+        let mut h = harness();
+        h.state_mut().scroll_speed = speed;
+        h.run_steps(2);
+        let i = h.state().active.expect("a document is shown");
+        let top = |h: &Harness<'static, PdfCraftApp>| h.state().views[i].page_screen_rect(0).expect("page 1 on screen").min.y;
+        let before = top(&h);
+        h.event(egui::Event::PointerMoved(h.state().views[i].viewport_rect().center()));
+        h.event(egui::Event::MouseWheel { unit, delta: egui::vec2(0.0, -dy), phase: egui::TouchPhase::Move, modifiers: egui::Modifiers::NONE });
+        // egui spreads a wheel notch over a few frames.
+        h.run_steps(30);
+        before - top(&h)
+    };
+    let line = egui::MouseWheelUnit::Line;
+    let normal = scrolled(ScrollSpeed::Normal, line, 1.0);
+    assert!((normal - ScrollSpeed::Normal.line_points()).abs() < 1.0, "one notch at Normal scrolled {normal}");
+    let (slow, fast) = (scrolled(ScrollSpeed::Slow, line, 1.0), scrolled(ScrollSpeed::Fast, line, 1.0));
+    assert!((slow * 2.0 - normal).abs() < 1.0 && (fast - normal * 2.0).abs() < 1.0, "slow {slow}, normal {normal}, fast {fast}");
+    let point = egui::MouseWheelUnit::Point;
+    let (normal_points, fast_points) = (scrolled(ScrollSpeed::Normal, point, 30.0), scrolled(ScrollSpeed::Fast, point, 30.0));
+    assert!(normal_points > 0.0 && (normal_points - fast_points).abs() < 1.0, "trackpad: {normal_points} vs {fast_points}");
+    let mut app = PdfCraftApp::new();
+    app.set_option("scroll_speed", "fast").unwrap();
+    assert!(app.set_option("scroll_speed", "warp").unwrap_err().contains("slow, normal, or fast"));
+    let mut again = PdfCraftApp::new();
+    again.restore(&app.persist());
+    assert_eq!(again.scroll_speed, ScrollSpeed::Fast);
+}
diff --git a/crates/xfa/src/data.rs b/crates/xfa/src/data.rs
index ac80d419..9c0f51dd 100644
--- a/crates/xfa/src/data.rs
+++ b/crates/xfa/src/data.rs
@@ -73,6 +73,9 @@ fn to_node(n: roxmltree::Node, depth: usize) -> DataNode {
 /// The `xfa:data` element of the datasets packet in `xdp` (or a bare datasets document), as a
 /// tree whose root is that element.
 pub fn parse_datasets(xdp: &str) -> Option<DataNode> {
+    if crate::xml_nesting_depth(xdp) > crate::MAX_XML_DEPTH {
+        return None;
+    }
     let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
     let doc = roxmltree::Document::parse_with_options(xdp, opts).ok()?;
     let datasets = doc.descendants().find(|n| n.is_element() && n.tag_name().name() == "datasets")?;
@@ -584,6 +587,10 @@ fn merge(text: &str, within: Within, op: Op, warnings: &mut Vec<String>) -> Merg
         Op::Values(w) => w,
         Op::Remove(_) => &[],
     };
+    if crate::xml_nesting_depth(text) > crate::MAX_XML_DEPTH {
+        warnings.push("The XFA data nests XML elements deeper than the reader accepts; the field values were not written to it".into());
+        return Merged::Failed;
+    }
     let opts = || roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
     // A packet of an array may use the prefixes the XDP envelope declares: read it inside
     // an element declaring the usual ones.
diff --git a/crates/xfa/src/fixtures.rs b/crates/xfa/src/fixtures.rs
index f91cc7c5..a6c79a2a 100644
--- a/crates/xfa/src/fixtures.rs
+++ b/crates/xfa/src/fixtures.rs
@@ -324,3 +324,36 @@ pub fn shell(xdp: &str) -> Vec<u8> {
     ];
     assemble(objs)
 }
+
+/// A dynamic form with two signature boxes of which `sign` has been signed: the file holds the
+/// field a signing application leaves (named by its SOM path, its value a signature dictionary)
+/// and the picture drawn in the box, a solid blue rectangle.
+pub fn signed_shell() -> Vec<u8> {
+    let xdp = r##"<?xml version="1.0" encoding="UTF-8"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" layout="tb">
+ <pageSet><pageArea name="page"><contentArea x="0.5in" y="0.5in" w="7.5in" h="10in"/><medium short="8.5in" long="11in"/></pageArea></pageSet>
+ <subform name="body" layout="tb" w="7.5in">
+  <field name="sign" w="3in" h="1in"><ui><signature/></ui></field>
+  <field name="other" w="3in" h="1in"><ui><signature/></ui></field>
+ </subform>
+</subform>
+</template>
+</xdp:xdp>
+"##;
+    let picture = "0 0 1 rg 0 0 100 40 re f";
+    let objs: Vec<Vec<u8>> = vec![
+        b"<< /Type /Catalog /Pages 2 0 R /NeedsRendering true /AcroForm << /XFA 5 0 R /Fields [6 0 R] /SigFlags 3 >> >>".to_vec(),
+        b"<< /Type /Pages /Kids [3 0 R] /Count 1 >>".to_vec(),
+        b"<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 4 0 R >>".to_vec(),
+        b"<< /Length 44 >>\nstream\nBT /F1 12 Tf 72 700 Td (Please wait...) Tj ET\nendstream".to_vec(),
+        format!("<< /Length {} >>\nstream\n{xdp}\nendstream", xdp.len()).into_bytes(),
+        b"<< /T (form[0]) /Kids [7 0 R] >>".to_vec(),
+        b"<< /T (body[0]) /Parent 6 0 R /Kids [8 0 R] >>".to_vec(),
+        b"<< /T (sign[0]) /Parent 7 0 R /FT /Sig /V 9 0 R /Type /Annot /Subtype /Widget /Rect [0 0 0 0] /AP << /N 10 0 R >> >>".to_vec(),
+        b"<< /Type /Sig /Name (A Signer) >>".to_vec(),
+        format!("<< /Type /XObject /Subtype /Form /BBox [0 0 100 40] /Length {} >>\nstream\n{picture}\nendstream", picture.len()).into_bytes(),
+    ];
+    assemble(objs)
+}
diff --git a/crates/xfa/src/layout.rs b/crates/xfa/src/layout.rs
index 615afbb0..ee8af4cf 100644
--- a/crates/xfa/src/layout.rs
+++ b/crates/xfa/src/layout.rs
@@ -30,6 +30,10 @@ const MAX_MEASURES: usize = 2_000_000;
 const MAX_INSTANCES: usize = 50;
 /// Largest picture taken from the data (decoded bytes), as for template pictures.
 const MAX_DATA_IMAGE: usize = 32 << 20;
+/// Most picture bytes one layout keeps, all copies together. Each laid-out picture holds its
+/// own copy, so a large picture in repeating subforms would otherwise multiply into gigabytes
+/// (a failed allocation aborts the app); a real form's logos and photos stay far below.
+const MAX_IMAGE_BYTES: usize = 256 << 20;
 /// Placeholder for the page count in text laid out before the count is known.
 const PAGE_COUNT_MARK: char = '\u{E000}';
 
@@ -195,11 +199,16 @@ struct Layouter<'t> {
     warned: HashSet<String>,
     fields: usize,
     items: usize,
+    /// Picture bytes laid out so far (see [`MAX_IMAGE_BYTES`]).
+    image_bytes: usize,
     /// Container sizes by (address of the subform or area in the template, available width,
     /// depth), with the inherited font and paragraph they were measured with.
     measured: RefCell<HashMap<MeasureKey, Measured>>,
     /// Measurements made so far (see [`MAX_MEASURES`]).
     measures: Cell<usize>,
+    /// The fields and draws of the block being placed: (first item, one past the last, top,
+    /// bottom) on the last page. A page break keeps each whole (see `split_block`).
+    leaves: Vec<(usize, usize, f64, f64)>,
 }
 
 /// How many instances of a repeating subform to lay out: what the data holds once it holds
@@ -246,8 +255,10 @@ pub fn layout(tpl: &Template, data: Option<&DataNode>) -> Result<Form, XfaError>
         warned: HashSet::new(),
         fields: 0,
         items: 0,
+        image_bytes: 0,
         measured: RefCell::new(HashMap::new()),
         measures: Cell::new(0),
+        leaves: Vec::new(),
     };
     let ctx = Ctx { font: Font::default(), para: Para::default(), som: String::new() };
     l.new_page()?;
@@ -312,6 +323,75 @@ fn splittable(node: &Node) -> bool {
     matches!(node, Node::Subform(s) if matches!(s.layout, Layout::Tb | Layout::Table) && s.common.h.is_none())
 }
 
+/// Top and bottom of an item a page break must not cut (text, a picture, a field); `None`
+/// for fills and lines, which are cut at the break.
+fn solid_extent(item: &Item) -> Option<(f64, f64)> {
+    match item {
+        Item::Text(s) => Some((s.baseline - s.face.size * 0.8, s.baseline + s.face.size * 0.2)),
+        Item::Image { rect, .. } => Some((rect.y, rect.bottom())),
+        Item::Widget(w) => Some((w.rect.y, w.rect.bottom())),
+        Item::Fill { .. } | Item::Line { .. } => None,
+    }
+}
+
+/// `item` as the part above `cut` and the part below: solid items go whole to the side their
+/// top is on, fills and lines crossing the cut are cut in two.
+fn divide(item: Item, cut: f64) -> (Option<Item>, Option<Item>) {
+    if let Some((top, _)) = solid_extent(&item) {
+        return if top < cut - 0.01 { (Some(item), None) } else { (None, Some(item)) };
+    }
+    match item {
+        Item::Fill { rect, color } => {
+            if rect.bottom() <= cut + 0.01 {
+                (Some(Item::Fill { rect, color }), None)
+            } else if rect.y >= cut - 0.01 {
+                (None, Some(Item::Fill { rect, color }))
+            } else {
+                let above = Rect::new(rect.x, rect.y, rect.w, cut - rect.y);
+                let below = Rect::new(rect.x, cut, rect.w, rect.bottom() - cut);
+                (Some(Item::Fill { rect: above, color }), Some(Item::Fill { rect: below, color }))
+            }
+        }
+        Item::Line { from, to, width, color, dashed } => {
+            let (lo, hi) = if from.1 <= to.1 { (from, to) } else { (to, from) };
+            if lo.1 >= cut {
+                (None, Some(Item::Line { from, to, width, color, dashed }))
+            } else if hi.1 <= cut {
+                (Some(Item::Line { from, to, width, color, dashed }), None)
+            } else {
+                // lo.1 < cut < hi.1, so the divisor is positive.
+                let t = (cut - lo.1) / (hi.1 - lo.1);
+                let mid = (lo.0 + (hi.0 - lo.0) * t, cut);
+                (Some(Item::Line { from: lo, to: mid, width, color, dashed }), Some(Item::Line { from: mid, to: hi, width, color, dashed }))
+            }
+        }
+        other => (Some(other), None),
+    }
+}
+
+/// `item` moved by (`dx`, `dy`).
+fn moved(mut item: Item, dx: f64, dy: f64) -> Item {
+    match &mut item {
+        Item::Fill { rect, .. } | Item::Image { rect, .. } => {
+            rect.x += dx;
+            rect.y += dy;
+        }
+        Item::Line { from, to, .. } => {
+            *from = (from.0 + dx, from.1 + dy);
+            *to = (to.0 + dx, to.1 + dy);
+        }
+        Item::Text(s) => {
+            s.x += dx;
+            s.baseline += dy;
+        }
+        Item::Widget(w) => {
+            w.rect.x += dx;
+            w.rect.y += dy;
+        }
+    }
+    item
+}
+
 fn is_row(node: &Node) -> bool {
     matches!(node, Node::Subform(s) if s.layout == Layout::Row)
 }
@@ -491,6 +571,143 @@ impl Layouter<'_> {
         Ok(true)
     }
 
+    /// Place `node` as one block of size (`w`, `h`) at the cursor: in this content area when it fits,
+    /// in the next when it fits there, and across as many as it takes when it is taller than a
+    /// content area (a positioned or fixed-height subform holding more than a page).
+    fn flow_block(&mut self, node: &Node, x: f64, (w, h): (f64, f64), ctx: &Ctx, depth: usize, sib: usize) -> Result<(), XfaError> {
+        let (rect, y, _) = self.cursor();
+        if y + h > rect.bottom() + 0.01 && h <= rect.h + 0.01 {
+            self.make_room(h)?;
+        }
+        let (rect, y, _) = self.cursor();
+        let first = self.pages.last().map_or(0, |p| p.items.len());
+        self.leaves.clear();
+        self.draw_node(node, Rect::new(x, y, w, h), ctx, depth, sib)?;
+        let page_h = self.pages.last().map_or(f64::INFINITY, |p| p.height);
+        // What was drawn, when it is lower than the block's own height says (content that
+        // outgrows a fixed height) and ends off the page.
+        let drawn = self
+            .pages
+            .last()
+            .and_then(|p| p.items.get(first..))
+            .unwrap_or_default()
+            .iter()
+            .filter_map(solid_extent)
+            .map(|e| e.1)
+            .fold(y + h, f64::max);
+        if y + h <= rect.bottom() + 0.01 && drawn <= page_h + 0.01 {
+            self.leaves.clear();
+            self.place(h);
+            return Ok(());
+        }
+        self.split_block(first, y, drawn)
+    }
+
+    /// Remember that the items the last page got since `start` are one field or draw at
+    /// `rect`, to be kept together by a page break.
+    fn keep_whole(&mut self, start: usize, rect: Rect) {
+        let end = self.pages.last().map_or(0, |p| p.items.len());
+        if end > start {
+            self.leaves.push((start, end, rect.y, rect.bottom()));
+        }
+    }
+
+    fn item_count(&self) -> usize {
+        self.pages.last().map_or(0, |p| p.items.len())
+    }
+
+    /// Spread the items the last page holds from index `first` on (a block drawn from `top` to
+    /// `end`, past the bottom of its content area) over this and the following content areas.
+    /// Breaks fall between text, pictures and fields, never through one that fits in an area;
+    /// fills and lines are cut at the break.
+    fn split_block(&mut self, first: usize, top: f64, end: f64) -> Result<(), XfaError> {
+        let items: Vec<Item> = match self.pages.last_mut() {
+            Some(p) if first <= p.items.len() => p.items.split_off(first),
+            _ => return Ok(()),
+        };
+        // Each item with the extent of the field or draw it belongs to: such a leaf moves
+        // whole (its border with its text), unless it is taller than a content area.
+        let area_h = self.cursor().0.h;
+        let mut extents: Vec<Option<(f64, f64)>> = vec![None; items.len()];
+        for (start, end, top, bottom) in std::mem::take(&mut self.leaves) {
+            if bottom - top <= area_h + 0.01
+                && let Some(slots) = start.checked_sub(first).and_then(|s| extents.get_mut(s..end.saturating_sub(first)))
+            {
+                slots.fill(Some((top, bottom)));
+            }
+        }
+        let mut rest: Vec<(Item, Option<(f64, f64)>)> = items.into_iter().zip(extents).collect();
+        let origin_x = self.cursor().0.x;
+        // An item's place on the current page is its drawn place moved by (dx, -shift).
+        let (mut dx, mut shift) = (0.0, 0.0);
+        let mut seg_top = top;
+        let mut first_segment = true;
+        loop {
+            let (rect, _, placed) = self.cursor();
+            let limit = rect.bottom() + shift;
+            let mut cut = limit;
+            if rect.h < 1.0 {
+                // No room to split into: leave the rest here.
+                cut = f64::INFINITY;
+            } else {
+                // The lowest break at or above the bottom that crosses no solid item: going
+                // through them from the lowest top up, a break moved to an item's top can't
+                // cross one already passed.
+                let mut solid: Vec<(f64, f64)> =
+                    rest.iter().filter_map(|(item, kept)| kept.or_else(|| solid_extent(item))).filter(|e| e.0 < limit - 0.01).collect();
+                solid.sort_by(|a, b| b.0.total_cmp(&a.0));
+                for (t, b) in solid {
+                    if t < cut - 0.01 && b > cut + 0.01 {
+                        cut = t;
+                    }
+                }
+                if cut <= seg_top + 0.01 {
+                    // An item taller than what is left. Start it in a fresh area if this one
+                    // already holds something; otherwise cut through it.
+                    cut = if first_segment && placed && seg_top > rect.y + 0.01 { seg_top } else { limit };
+                }
+            }
+            let mut here = Vec::new();
+            let mut below = Vec::new();
+            for (item, kept) in rest {
+                if let Some((top, _)) = kept {
+                    if top < cut - 0.01 {
+                        here.push(item)
+                    } else {
+                        below.push((item, kept))
+                    }
+                    continue;
+                }
+                match divide(item, cut) {
+                    (Some(a), None) => here.push(a),
+                    (None, Some(b)) => below.push((b, None)),
+                    (Some(a), Some(b)) => {
+                        here.push(a);
+                        below.push((b, None));
+                    }
+                    (None, None) => {}
+                }
+            }
+            if let Some(p) = self.pages.last_mut() {
+                p.items.extend(here.into_iter().map(|it| moved(it, dx, -shift)));
+            }
+            if below.is_empty() {
+                if let Some(c) = &mut self.cur {
+                    c.y = (end - shift).min(c.rect.bottom()).max(c.y);
+                    c.placed = true;
+                }
+                return Ok(());
+            }
+            rest = below;
+            seg_top = cut;
+            first_segment = false;
+            self.next_area()?;
+            let (rect, _, _) = self.cursor();
+            shift = cut - rect.y;
+            dx = rect.x - origin_x;
+        }
+    }
+
     fn page_has_flow(&self) -> bool {
         self.cur.as_ref().is_some_and(|c| c.placed || c.content > 0)
     }
@@ -518,10 +735,7 @@ impl Layouter<'_> {
             if !matches!(sf.layout, Layout::Tb | Layout::Table) || sf.common.h.is_some() {
                 // Not splittable: one block.
                 let (_, h) = self.size_of(node, w, ctx_parent, depth);
-                self.make_room(h)?;
-                let (_, y, _) = self.cursor();
-                self.draw_node(node, Rect::new(x, y, w, h), ctx_parent, depth, sib + i)?;
-                self.place(h);
+                self.flow_block(node, x, (w, h), ctx_parent, depth, sib + i)?;
                 continue;
             }
             let m = sf.common.margin;
@@ -543,10 +757,7 @@ impl Layouter<'_> {
                             continue;
                         }
                         let (cw, ch) = self.size_of(child, inner_w, &ctx, depth + 1);
-                        self.make_room(ch)?;
-                        let (_, y, _) = self.cursor();
-                        self.draw_node(child, Rect::new(inner_x, y, cw, ch), &ctx, depth + 1, csib)?;
-                        self.place(ch);
+                        self.flow_block(child, inner_x, (cw, ch), &ctx, depth + 1, csib)?;
                     }
                 }
             }
@@ -605,10 +816,7 @@ impl Layouter<'_> {
                 continue;
             }
             let (cw, ch) = self.size_of(child, inner_w, ctx, depth + 1);
-            self.make_room(ch)?;
-            let (_, y, _) = self.cursor();
-            self.draw_node(child, Rect::new(x, y, cw, ch), ctx, depth + 1, csib)?;
-            self.place(ch);
+            self.flow_block(child, x, (cw, ch), ctx, depth + 1, csib)?;
         }
         Ok(())
     }
@@ -662,10 +870,11 @@ impl Layouter<'_> {
 
     fn measure(&self, node: &Node, avail_w: f64, ctx: &Ctx, depth: usize) -> (f64, f64) {
         let c = node.common();
-        // The container's own SOM, under which its repeating children count their instances.
-        // Measurements are cached per template node, so instance 0 stands for all of them.
-        let som = ctx.with_som(c, 0).som;
-        let ctx = ctx.child(c);
+        // The node's own SOM: its repeating children count their instances under it, and a
+        // growing text field finds its value at it. Measurements are cached per template node,
+        // so instance 0 stands for all of them.
+        let ctx = ctx.with_som(c, 0);
+        let som = ctx.som.clone();
         // A container without a width is as wide as its content (a radio group beside its
         // question, say); a leaf without one takes what is available.
         let w = match c.w {
@@ -697,7 +906,7 @@ impl Layouter<'_> {
                             .filter(|k| k.common().presence.occupies())
                             .map(|k| self.size_of(k, inner_w, &ctx, depth + 1).1 * self.instances(k, &som) as f64)
                             .sum(),
-                        Layout::LrTb | Layout::RlTb => self.packed_height(&s.children, inner_w, &ctx, depth),
+                        Layout::LrTb | Layout::RlTb => self.pack_instances(&s.children, inner_w, &ctx, depth, &som).1,
                         Layout::Table => {
                             let cols = self.columns(s, inner_w);
                             s.children
@@ -715,7 +924,13 @@ impl Layouter<'_> {
                 content + c.margin.vertical()
             }
         };
-        (w, clamp_opt(h, c.min_h, c.max_h))
+        // A flowed subform is as tall as what it holds: other viewers do not stretch one to
+        // the `minH` a designer left on it.
+        let min_h = match node {
+            Node::Subform(s) if c.h.is_none() && s.layout != Layout::Positioned => None,
+            _ => c.min_h,
+        };
+        (w, clamp_opt(h, min_h, c.max_h))
     }
 
     /// The natural width of a container's content within `avail_w`.
@@ -787,7 +1002,7 @@ impl Layouter<'_> {
         let lines = if f.multiline { 3.0 } else { 1.0 };
         let ui = match f.ui {
             Ui::CheckButton => f.check_size.unwrap_or(10.0).max(text::line_height(font.size)),
-            _ => text::line_height(font.size) * lines + 4.0 + f.ui_margin.vertical(),
+            _ => (text::line_height(font.size) * lines).max(self.grown_text_height(f, inner_w, ctx)) + 4.0 + f.ui_margin.vertical(),
         };
         match self.caption_reserve(f, inner_w, ctx) {
             Some((Placement::Top | Placement::Bottom, r)) => ui + r,
@@ -807,6 +1022,25 @@ impl Layouter<'_> {
         }
     }
 
+    /// The height the text of a multi-line text field takes (its value in the data, else the
+    /// template's), for a field without a fixed height, which grows to hold its text. `ctx`
+    /// is the field's own (its SOM ends in the field). Zero for anything else.
+    fn grown_text_height(&self, f: &Field, inner_w: f64, ctx: &Ctx) -> f64 {
+        if f.ui != Ui::TextEdit || !f.multiline || f.common.h.is_some() || f.common.name.is_none() {
+            return 0.0;
+        }
+        let value = self.data.and_then(|d| d.value_at(&data_path(self.tpl, &ctx.som))).filter(|t| !t.trim().is_empty()).or_else(|| f.value.plain());
+        let Some(value) = value.filter(|t| !t.trim().is_empty()) else { return 0.0 };
+        // Beside a caption the text has what the caption leaves; 2pt of padding on each side.
+        let beside = match self.caption_reserve(f, inner_w, ctx) {
+            Some((Placement::Top | Placement::Bottom, _)) | None => 0.0,
+            Some((_, r)) => r,
+        };
+        let w = (inner_w - beside - f.ui_margin.horizontal() - 4.0).max(1.0);
+        let font = ctx.font.apply(&f.common.font);
+        text::measure_height(&text::plain(value.trim_end()), w, &ctx.para, &Face::of(&font), &|_| String::new())
+    }
+
     fn group_height(&self, g: &ExclGroup, inner_w: f64, ctx: &Ctx, depth: usize) -> f64 {
         let nodes: Vec<Node> = g.fields.iter().map(|f| Node::Field(Box::new(f.clone()))).collect();
         match g.layout {
@@ -828,8 +1062,10 @@ impl Layouter<'_> {
             .fold(0.0, f64::max)
     }
 
-    /// Left-to-right packing: rows of children, wrapped at the available width.
-    fn pack(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize) -> (Vec<(usize, Rect)>, f64) {
+    /// Left-to-right packing: rows of children, wrapped at the available width, as (child,
+    /// instance, place). A repeating subform is packed once per instance it has under the
+    /// container at `som`.
+    fn pack_instances(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize, som: &str) -> (Vec<(usize, usize, Rect)>, f64) {
         let mut out = Vec::new();
         let (mut x, mut y, mut line_h) = (0.0, 0.0, 0.0);
         for (i, k) in children.iter().enumerate() {
@@ -837,18 +1073,26 @@ impl Layouter<'_> {
                 continue;
             }
             let (w, h) = self.size_of(k, inner_w, ctx, depth + 1);
-            if x > 0.0 && x + w > inner_w + 0.05 {
-                y += line_h;
-                x = 0.0;
-                line_h = 0.0;
+            for instance in 0..self.instances(k, som) {
+                if x > 0.0 && x + w > inner_w + 0.05 {
+                    y += line_h;
+                    x = 0.0;
+                    line_h = 0.0;
+                }
+                out.push((i, instance, Rect::new(x, y, w, h)));
+                x += w;
+                line_h = line_h.max(h);
             }
-            out.push((i, Rect::new(x, y, w, h)));
-            x += w;
-            line_h = line_h.max(h);
         }
         (out, y + line_h)
     }
 
+    /// [`Self::pack_instances`] for children that don't repeat (the fields of a group).
+    fn pack(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize) -> (Vec<(usize, Rect)>, f64) {
+        let (placed, h) = self.pack_instances(children, inner_w, ctx, depth, "");
+        (placed.into_iter().map(|(i, _, r)| (i, r)).collect(), h)
+    }
+
     fn packed_height(&self, children: &[Node], inner_w: f64, ctx: &Ctx, depth: usize) -> f64 {
         self.pack(children, inner_w, ctx, depth).1
     }
@@ -923,8 +1167,21 @@ impl Layouter<'_> {
             return Ok(());
         }
         match node {
-            Node::Draw(d) => self.draw_draw(d, rect, ctx),
-            Node::Field(f) => self.draw_field(f, rect, ctx, None, sib),
+            Node::Draw(d) => {
+                let start = self.item_count();
+                self.draw_draw(d, rect, ctx)?;
+                // Text and pictures stay with their border; a bare line or rectangle is cut.
+                if matches!(d.value, Value::Text(_) | Value::Rich(_) | Value::Image { .. }) {
+                    self.keep_whole(start, rect);
+                }
+                Ok(())
+            }
+            Node::Field(f) => {
+                let start = self.item_count();
+                self.draw_field(f, rect, ctx, None, sib)?;
+                self.keep_whole(start, rect);
+                Ok(())
+            }
             Node::ExclGroup(g) => self.draw_group(g, rect, ctx, depth, sib),
             Node::Area(a) => {
                 let ctx = ctx.with_som(&a.common, sib);
@@ -962,11 +1219,13 @@ impl Layouter<'_> {
                         }
                     }
                     Layout::LrTb | Layout::RlTb => {
-                        let (placed, _) = self.pack(&s.children, inner.w, &ctx, depth);
-                        for (i, r) in placed {
+                        // A repeating subform here (rows of fields under a heading) gets its
+                        // instances, as in the other layouts.
+                        let (placed, _) = self.pack_instances(&s.children, inner.w, &ctx, depth, &ctx.som);
+                        for (i, instance, r) in placed {
                             if let Some(k) = s.children.get(i) {
                                 let x = if s.layout == Layout::RlTb { inner.right() - r.x - r.w } else { inner.x + r.x };
-                                self.draw_node(k, Rect::new(x, inner.y + r.y, r.w, r.h), &ctx, depth + 1, sib_index(&s.children, i))?;
+                                self.draw_node(k, Rect::new(x, inner.y + r.y, r.w, r.h), &ctx, depth + 1, sib_index(&s.children, i) + instance)?;
                             }
                         }
                     }
@@ -1039,7 +1298,20 @@ impl Layouter<'_> {
             Value::Rich(r) => r.clone(),
             _ => return Ok(()),
         };
-        let block = text::layout(&rich, rect, para, &Face::of(font), &|id| self.embed(id));
+        let face = Face::of(font);
+        // Text that doesn't fit the height it was given (the template's face is narrower than
+        // the standard one drawn in its place, so it wraps to more lines) is drawn smaller,
+        // down to 70%, rather than over what lies below.
+        let fits = |k: f64| text::measure_height(&rich, rect.w / k, para, &face, &|id| self.embed(id)) <= rect.h / k + 1.0;
+        let scale = if rect.h < 4.0 || fits(1.0) { 1.0 } else { [0.95, 0.9, 0.85, 0.8, 0.75].into_iter().find(|k| fits(*k)).unwrap_or(0.7) };
+        let mut block = text::layout(&rich, Rect::new(rect.x, rect.y, rect.w / scale, rect.h / scale), para, &face, &|id| self.embed(id));
+        if scale < 1.0 {
+            for s in &mut block.spans {
+                s.x = rect.x + (s.x - rect.x) * scale;
+                s.baseline = rect.y + (s.baseline - rect.y) * scale;
+                s.face.size *= scale;
+            }
+        }
         self.push_block(block)
     }
 
@@ -1118,6 +1390,10 @@ impl Layouter<'_> {
 
     /// A picture scaled to fit `inner`, keeping its shape, from its top left.
     fn draw_image(&mut self, data: &[u8], content_type: &str, inner: Rect) -> Result<(), XfaError> {
+        self.image_bytes = self.image_bytes.saturating_add(data.len());
+        if self.image_bytes > MAX_IMAGE_BYTES {
+            return Err(XfaError::TooLarge("the form's pictures are too large together to lay out".into()));
+        }
         let fitted = match crate::image::size(data) {
             Some((iw, ih)) if iw > 0 && ih > 0 && inner.w > 0.0 && inner.h > 0.0 => {
                 let k = (inner.w / iw as f64).min(inner.h / ih as f64);
@@ -1248,6 +1524,25 @@ impl Layouter<'_> {
             // Shown as text, not as a field.
             return self.draw_value_text(&f.value, ui.inset(&f.ui_margin), &fctx.font, &fctx.para);
         }
+        // A text field that grew past what a content area holds can't be one widget: its text
+        // is drawn as lines the page breaks fall between, and stays what the data holds.
+        if f.ui == Ui::TextEdit && f.multiline && f.common.h.is_none() && rect.h > self.cursor().0.h + 0.01 {
+            let value =
+                self.data.and_then(|d| d.value_at(&data_path(self.tpl, &som_path()))).filter(|t| !t.trim().is_empty()).or_else(|| f.value.plain());
+            if let Some(value) = value.filter(|t| !t.trim().is_empty()) {
+                let name = f.common.name.clone().unwrap_or_else(|| "a text field".into());
+                self.warn_once(format!("{name}: its text is longer than a page; it is shown across pages and can't be edited here"));
+                let m = Margin {
+                    top: f.ui_margin.top + 2.0,
+                    bottom: f.ui_margin.bottom + 2.0,
+                    left: f.ui_margin.left + 2.0,
+                    right: f.ui_margin.right + 2.0,
+                };
+                let para = Para { v_align: VAlign::Top, ..fctx.para.clone() };
+                let block = text::layout(&text::plain(value.trim_end()), ui.inset(&m), &para, &Face::of(&fctx.font), &|_| String::new());
+                return self.push_block(block);
+            }
+        }
         let face = match (&f.ui, &f.caption) {
             // Buttons show their caption in the caption's font.
             (Ui::Button, Some(cap)) => Face::of(&ctx.font.apply(&cap.font)),
@@ -1354,16 +1649,14 @@ impl Layouter<'_> {
     }
 }
 
-/// The widget's own border from the `<ui>` border element. Without one, text fields and check
-/// boxes get a solid box, as Designer draws them.
+/// The widget's own border from the `<ui>` border element. Without one, a check box gets a
+/// solid box, as Designer draws it, and any other field has no box of its own.
 fn widget_border(b: Option<&Border>, check: bool) -> WidgetBorder {
     let Some(b) = b else {
-        return WidgetBorder {
-            color: Some([0.0, 0.0, 0.0]),
-            fill: if check { Some([1.0, 1.0, 1.0]) } else { None },
-            shape: BorderShape::Full,
-            width: 0.5,
-        };
+        if !check {
+            return WidgetBorder { color: None, fill: None, shape: BorderShape::None, width: 0.0 };
+        }
+        return WidgetBorder { color: Some([0.0, 0.0, 0.0]), fill: Some([1.0, 1.0, 1.0]), shape: BorderShape::Full, width: 0.5 };
     };
     let vis = b.visible_edges();
     let shape = match vis {
diff --git a/crates/xfa/src/lib.rs b/crates/xfa/src/lib.rs
index a1758ab4..f9fd29d3 100644
--- a/crates/xfa/src/lib.rs
+++ b/crates/xfa/src/lib.rs
@@ -20,6 +20,75 @@ pub mod text;
 
 use pdfcraft_cos::Document;
 
+/// The deepest element nesting accepted before an XML document reaches the parser.
+///
+/// roxmltree parses by recursive descent, so its stack use grows with the nesting depth: ten
+/// thousand levels overflow the main thread's stack, and a stack overflow is `abort()`, which no
+/// `catch_unwind` can intercept. The bound therefore has to be checked before parsing, not while
+/// walking the result. Around three thousand levels still parse on the default stack, so this stays
+/// clear of the cliff while leaving far more room than the walks below, which cut off at 64 - and
+/// more than the five hundred levels `hostile_templates_fail_without_panicking` keeps parsing.
+/// `pdfcraft-xfdf` carries the same check for form data files.
+pub(crate) const MAX_XML_DEPTH: usize = 1_024;
+
+/// Element nesting depth of `text`, skipping comments, CDATA, processing instructions, the DOCTYPE
+/// and quoted attribute values. A tag that closes itself (`<draw/>`) is one level while it is read
+/// and does not stay open, so a long run of styling elements cannot accumulate into the bound. It
+/// cannot under-count a real element; a stray `<` in text is invalid XML and only makes it
+/// over-count, which errs towards refusing the document.
+pub(crate) fn xml_nesting_depth(text: &str) -> usize {
+    fn find(hay: &[u8], from: usize, needle: &[u8]) -> Option<usize> {
+        (from..hay.len()).find(|&p| hay[p..].starts_with(needle))
+    }
+    let b = text.as_bytes();
+    let (mut i, mut depth, mut max) = (0usize, 0usize, 0usize);
+    while i < b.len() {
+        if b[i] != b'<' {
+            i += 1;
+        } else if b[i..].starts_with(b"<!--") {
+            i = find(b, i + 4, b"-->").map_or(b.len(), |p| p + 3);
+        } else if b[i..].starts_with(b"<![CDATA[") {
+            i = find(b, i + 9, b"]]>").map_or(b.len(), |p| p + 3);
+        } else if b[i..].starts_with(b"<?") {
+            i = find(b, i + 2, b"?>").map_or(b.len(), |p| p + 2);
+        } else if b[i..].starts_with(b"<!") {
+            i = find(b, i + 2, b">").map_or(b.len(), |p| p + 1);
+        } else if b[i..].starts_with(b"</") {
+            depth = depth.saturating_sub(1);
+            i = find(b, i + 2, b">").map_or(b.len(), |p| p + 1);
+        } else {
+            depth += 1;
+            max = max.max(depth);
+            // Skip the rest of the start tag, over any quoted attribute value, and remember its last
+            // significant byte: a tag that ends in `/` closes itself, so it is one level deep while it
+            // is read rather than a level left open.
+            i += 1;
+            let mut quote = 0u8;
+            let mut last = 0u8;
+            while i < b.len() {
+                let c = b[i];
+                if quote != 0 {
+                    if c == quote {
+                        quote = 0;
+                    }
+                } else if c == b'"' || c == b'\'' {
+                    quote = c;
+                } else if c == b'>' {
+                    i += 1;
+                    break;
+                } else if !c.is_ascii_whitespace() {
+                    last = c;
+                }
+                i += 1;
+            }
+            if last == b'/' {
+                depth -= 1;
+            }
+        }
+    }
+    max
+}
+
 pub use data::{
     DataNode, DataOp, DataPath, DatasetsWrite, FieldData, FieldDatum, add_data_instances, build_data, data_path, iso_to_pattern, parse_datasets,
     pattern_to_iso, read_values, read_values_with, remove_data_instance, som_to_path, write_data_ops, write_data_value, write_datasets,
diff --git a/crates/xfa/src/parse.rs b/crates/xfa/src/parse.rs
index 0bf90081..2de0bb83 100644
--- a/crates/xfa/src/parse.rs
+++ b/crates/xfa/src/parse.rs
@@ -640,6 +640,13 @@ fn collect_page_roles(nodes: &[Node], out: &mut Vec<(String, PageRole)>, depth:
 
 /// Parse a template packet. Returns the template and the warnings met on the way.
 pub fn parse(xml: &str) -> Result<(Template, Vec<String>), XfaError> {
+    let depth = crate::xml_nesting_depth(xml);
+    if depth > crate::MAX_XML_DEPTH {
+        return Err(XfaError::Malformed(format!(
+            "the template nests XML elements {depth} deep, past the {} the reader accepts",
+            crate::MAX_XML_DEPTH
+        )));
+    }
     let opts = roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES };
     let doc = roxmltree::Document::parse_with_options(xml, opts).map_err(|e| XfaError::Malformed(format!("template XML: {e}")))?;
     let root = doc.root_element();
@@ -662,7 +669,91 @@ pub fn parse(xml: &str) -> Result<(Template, Vec<String>), XfaError> {
         // A page set may sit beside the root subform.
         root_sf.page_set = child(template, "pageSet").map(|ps| parse_page_set(ps, &mut warnings, 0));
     }
+    // The form packet beside the template holds the state the form was saved in.
+    let saved = root
+        .descendants()
+        .find(|n| n.is_element() && n.tag_name().name() == "form" && n.tag_name().namespace().is_some_and(|ns| ns.contains("xfa-form")));
+    if let Some(saved_root) = saved.and_then(|f| children(f, "subform").next()) {
+        if let Some(p) = saved_root.attribute("presence") {
+            root_sf.common.presence = Presence::parse(Some(p));
+        }
+        apply_saved_state(&mut root_sf.children, saved_root, 0);
+    }
     let mut page_roles = Vec::new();
     collect_page_roles(&[Node::Subform(Box::new(root_sf.clone()))], &mut page_roles, 0);
     Ok((Template { root: root_sf, page_roles }, warnings))
 }
+
+fn parse_access(a: Option<&str>) -> Option<Access> {
+    Some(match a? {
+        "readOnly" => Access::ReadOnly,
+        "protected" => Access::Protected,
+        "nonInteractive" => Access::NonInteractive,
+        "open" => Access::Open,
+        _ => return None,
+    })
+}
+
+/// Apply the saved state of a form packet (`saved`: the element matching the container whose
+/// children `nodes` are) to the template: the `presence` and `access` a script gave an object
+/// before the form was saved, which is restored on opening. Objects are matched by
+/// name and position among the same-named; of the instances of a repeating subform only the
+/// first is read, as the template has it once.
+fn apply_saved_state(nodes: &mut [Node], saved: XmlNode, depth: usize) {
+    if depth > MAX_DEPTH {
+        return;
+    }
+    let mut seen: std::collections::HashMap<&str, usize> = std::collections::HashMap::new();
+    for c in saved.children().filter(|c| c.is_element()) {
+        if !matches!(c.tag_name().name(), "subform" | "subformSet" | "area" | "field" | "draw" | "exclGroup") {
+            continue;
+        }
+        let Some(name) = c.attribute("name").filter(|n| !n.is_empty()) else { continue };
+        let nth = {
+            let k = seen.entry(name).or_insert(0);
+            *k += 1;
+            *k - 1
+        };
+        let same: Vec<usize> = nodes.iter().enumerate().filter(|(_, n)| n.common().name.as_deref() == Some(name)).map(|(i, _)| i).collect();
+        // More saved objects of the name than the template has: further instances.
+        let Some(target) = same.get(nth).copied().and_then(|i| nodes.get_mut(i)) else { continue };
+        let presence = c.attribute("presence").map(|p| Presence::parse(Some(p)));
+        match target {
+            Node::Subform(s) => {
+                if let Some(p) = presence {
+                    s.common.presence = p;
+                }
+                apply_saved_state(&mut s.children, c, depth + 1);
+            }
+            Node::Area(a) => {
+                if let Some(p) = presence {
+                    a.common.presence = p;
+                }
+                apply_saved_state(&mut a.children, c, depth + 1);
+            }
+            Node::Field(f) => {
+                if let Some(p) = presence {
+                    f.common.presence = p;
+                }
+                if let Some(a) = parse_access(c.attribute("access")) {
+                    f.access = a;
+                }
+                // A caption a script changed (a button's label, say) is saved as plain text.
+                let text = child(c, "caption").and_then(|k| child(k, "value")).and_then(|v| child(v, "text")).and_then(|t| t.text());
+                if let (Some(caption), Some(text)) = (f.caption.as_mut(), text) {
+                    caption.value = Value::Text(text.to_string());
+                }
+            }
+            Node::Draw(d) => {
+                if let Some(p) = presence {
+                    d.common.presence = p;
+                }
+            }
+            Node::ExclGroup(g) => {
+                if let Some(p) = presence {
+                    g.common.presence = p;
+                }
+            }
+        }
+    }
+}
diff --git a/crates/xfa/src/pdf.rs b/crates/xfa/src/pdf.rs
index 811ac326..44896d40 100644
--- a/crates/xfa/src/pdf.rs
+++ b/crates/xfa/src/pdf.rs
@@ -176,6 +176,63 @@ struct Emitter<'a> {
     radio_selected: HashMap<String, String>,
     field_count: usize,
     warnings: Vec<String>,
+    /// The signatures the file holds, by the SOM path of the field signed.
+    signed: HashMap<String, Signed>,
+}
+
+/// A signature field of the file that has been signed.
+struct Signed {
+    /// Its `V`: the signature dictionary (a reference, as the file has it).
+    value: Object,
+    /// Its widget's `AP`: what the signer's application drew in the box.
+    appearance: Option<Object>,
+}
+
+/// Most fields looked at for signatures.
+const MAX_FIELDS_SEARCHED: usize = 20_000;
+/// Deepest field nesting followed.
+const MAX_FIELD_DEPTH: usize = 32;
+
+/// The signed signature fields the document came with, by full name. Signing applications name
+/// a dynamic form's fields by their SOM path (`form1[0].page1[0].sign[0]`), which is how a
+/// laid-out signature box finds its signature. Fields of an earlier layout pass are not read.
+fn signed_fields(doc: &Document, catalog: &Dict) -> HashMap<String, Signed> {
+    let mut out = HashMap::new();
+    let Some(acro) = catalog.get(b"AcroForm").map(|a| doc.resolve(a)) else { return out };
+    let Some(fields) = acro.as_dict().and_then(|a| a.get(b"Fields")).map(|f| doc.resolve(f)) else { return out };
+    let mut stack: Vec<(Object, String, bool, usize)> =
+        fields.as_array().into_iter().flatten().map(|f| (f.clone(), String::new(), false, 0)).collect();
+    let mut seen = 0usize;
+    while let Some((field, prefix, parent_is_sig, depth)) = stack.pop() {
+        seen += 1;
+        if seen > MAX_FIELDS_SEARCHED {
+            break;
+        }
+        let field = doc.resolve(&field);
+        let Some(d) = field.as_dict() else { continue };
+        if d.contains(SOM_KEY) {
+            continue;
+        }
+        let name = match d.get(b"T").map(|t| doc.resolve(t)).and_then(|t| t.as_string().map(|t| t.to_text())) {
+            Some(t) if prefix.is_empty() => t,
+            Some(t) => format!("{prefix}.{t}"),
+            None => prefix,
+        };
+        let is_sig = match d.name(b"FT") {
+            Some(ft) => ft == b"Sig",
+            None => parent_is_sig,
+        };
+        let kids: Vec<Object> = d.get(b"Kids").map(|k| doc.resolve(k)).and_then(|k| k.as_array().cloned()).unwrap_or_default();
+        if is_sig && let Some(value) = d.get(b"V").filter(|v| doc.resolve(v).as_dict().is_some()) {
+            // The appearance is on the field when it is its own widget, or on its one widget.
+            let appearance = d.get(b"AP").cloned().or_else(|| kids.iter().find_map(|k| doc.resolve(k).as_dict().and_then(|k| k.get(b"AP").cloned())));
+            out.entry(name.clone()).or_insert(Signed { value: value.clone(), appearance });
+        }
+        if depth < MAX_FIELD_DEPTH {
+            stack.extend(kids.into_iter().map(|k| (k, name.clone(), is_sig, depth + 1)));
+        }
+    }
+    out
 }
 
 impl Emitter<'_> {
@@ -304,6 +361,14 @@ impl Emitter<'_> {
             }
             WidgetKind::Signature => {
                 d.set(b"FT".to_vec(), Object::name("Sig"));
+                // Signed already: the box shows the signature the file holds and is done with.
+                if let Some(signed) = self.signed.get(&w.som) {
+                    d.set(b"V".to_vec(), signed.value.clone());
+                    if let Some(ap) = &signed.appearance {
+                        d.set(b"AP".to_vec(), ap.clone());
+                    }
+                    ff |= 1;
+                }
             }
             WidgetKind::CheckBox { on, .. } => {
                 d.set(b"FT".to_vec(), Object::name("Btn"));
@@ -610,6 +675,7 @@ pub fn write_form(doc: &mut Document, form: &Form) -> Result<Written, XfaError>
     };
     // Pictures embedded by earlier passes, from the pages this pass replaces.
     let images = earlier_images(doc, pages_ref);
+    let signed = signed_fields(doc, &catalog);
     let mut em = Emitter {
         doc,
         images,
@@ -618,6 +684,7 @@ pub fn write_form(doc: &mut Document, form: &Form) -> Result<Written, XfaError>
         radio_selected: HashMap::new(),
         field_count: 0,
         warnings: Vec::new(),
+        signed,
     };
     let mut kids = Vec::new();
     for page in &form.pages {
diff --git a/crates/xfa/src/tests.rs b/crates/xfa/src/tests.rs
index a690e7f3..24260ec0 100644
--- a/crates/xfa/src/tests.rs
+++ b/crates/xfa/src/tests.rs
@@ -222,6 +222,29 @@ fn hostile_templates_fail_without_panicking() {
     assert!(!f.warnings.is_empty());
 }
 
+#[test]
+fn repeated_pictures_are_bounded_in_total_bytes() {
+    // Each laid-out picture keeps its own copy of the bytes, so one picture in a repeating
+    // subform used to multiply without bound and exhaust memory (a failed allocation aborts the
+    // app). "AAAA" base64 decodes to zero bytes; 2_097_152 groups is 6 MiB, under the 32 MiB
+    // per-picture cap. 50 instances (occur initial, clamped to MAX_INSTANCES) would be ~300 MiB,
+    // past the aggregate cap, so layout must stop with TooLarge rather than retain it all.
+    let big = "AAAA".repeat(2_097_152);
+    let tpl = format!(
+        "<template><subform layout=\"tb\"><subform layout=\"tb\"><occur initial=\"50\" max=\"-1\"/>\
+         <draw w=\"0.2in\" h=\"0.2in\"><value><image contentType=\"image/png\">{big}</image></value></draw>\
+         </subform></subform></template>"
+    );
+    assert!(matches!(layout_xml(&tpl), Err(XfaError::TooLarge(m)) if m.contains("too large")), "the repeated picture must be refused");
+
+    // A single small picture still lays out: the cap does not reject an ordinary form.
+    let small = "AAAA".repeat(8);
+    let ok = format!(
+        "<template><subform layout=\"tb\"><draw w=\"1in\" h=\"1in\"><value><image contentType=\"image/png\">{small}</image></value></draw></subform></template>"
+    );
+    assert!(layout_xml(&ok).is_ok(), "one small picture must lay out");
+}
+
 #[test]
 fn the_packets_can_be_one_stream_or_named_parts() {
     // Named parts, with the template split from the rest.
@@ -1109,3 +1132,422 @@ fn data_paths_leave_areas_out() {
     assert_eq!(path("other[0].box[0].rest[0]"), "other[0].box[0].rest[0]");
     assert_eq!(data_path(&tpl, ""), Vec::new());
 }
+
+/// A template nested thousands of elements deep must be refused. roxmltree recurses with the
+/// nesting depth, so it used to overflow the stack - and a stack overflow aborts the process,
+/// which no `catch_unwind` can intercept.
+#[test]
+fn deeply_nested_template_is_refused_instead_of_overflowing_the_stack() {
+    let mut xml = String::from(r#"<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">"#);
+    for i in 0..10_000 {
+        xml.push_str(&format!(r#"<subform name="s{i}">"#));
+    }
+    xml.push_str(&"</subform>".repeat(10_000));
+    xml.push_str("</template>");
+    assert!(matches!(crate::parse::parse(&xml), Err(crate::XfaError::Malformed(_))), "ten thousand nested subforms must be refused, not parsed");
+}
+
+/// The depth scanner skips what is not an element and cannot under-count one.
+#[test]
+fn nesting_depth_scanner_counts_what_matters() {
+    use crate::xml_nesting_depth as d;
+    assert_eq!(d(""), 0);
+    assert_eq!(d("<a><b><c/></b></a>"), 3);
+    assert_eq!(d(r#"<?xml version="1.0"?><!-- <x> --><a/>"#), 1);
+    assert_eq!(d("<a><![CDATA[<not-an-element>]]></a>"), 1);
+    assert_eq!(d(r#"<a b="<"><c/></a>"#), 2);
+    assert_eq!(d("<a/>"), 1);
+    assert_eq!(d("<a><b/></a>"), 2);
+    assert_eq!(d(&"<empty/>".repeat(2_000)), 1, "elements that close themselves must not accumulate");
+}
+
+/// A template holding thousands of self-closing elements is two levels deep, not thousands. Before
+/// the scanner knew that, a form with a lot of styling elements was refused as too deeply nested.
+#[test]
+fn many_self_closing_elements_do_not_accumulate_into_the_bound() {
+    let mut xml = String::from(r#"<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/"><subform layout="tb">"#);
+    for i in 0..2_000 {
+        xml.push_str(&format!(r#"<draw name="d{i}"/>"#));
+    }
+    xml.push_str("</subform></template>");
+    assert!(crate::parse::parse(&xml).is_ok(), "two thousand self-closing draws are two levels deep, not two thousand");
+}
+
+/// The bound must hold on a worker thread too, whose default stack (2 MiB) is a quarter of the
+/// main thread's: a template exactly at the limit parses there without overflowing.
+#[test]
+fn template_at_the_depth_limit_parses_on_a_worker_thread() {
+    let depth = crate::MAX_XML_DEPTH - 1;
+    let mut xml = String::from(r#"<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">"#);
+    for i in 0..depth {
+        xml.push_str(&format!(r#"<subform name="s{i}">"#));
+    }
+    xml.push_str(&"</subform>".repeat(depth));
+    xml.push_str("</template>");
+    let parsed = std::thread::spawn(move || crate::parse::parse(&xml).is_ok()).join();
+    assert!(matches!(parsed, Ok(true)), "a template at the limit parses on a default-stack thread");
+}
+
+/// A form of one page area (7.5in × 10in of content from 0.5in) around `body`.
+fn one_area_form(root_attrs: &str, body: &str) -> String {
+    format!(
+        r##"<?xml version="1.0" encoding="UTF-8"?>
+<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
+<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
+<subform name="form" {root_attrs}>
+ <pageSet><pageArea name="page"><contentArea x="0.5in" y="0.5in" w="7.5in" h="10in"/><medium short="8.5in" long="11in"/></pageArea></pageSet>
+{body}
+</subform>
+</template>
+</xdp:xdp>
+"##
+    )
+}
+
+/// Every field is inside the content area of its page, and the fields come in template order.
+fn assert_paginated(form: &Form, fields: usize, min_pages: usize) {
+    assert!(form.pages.len() >= min_pages, "{} pages", form.pages.len());
+    let mut names = Vec::new();
+    for (i, p) in form.pages.iter().enumerate() {
+        for w in widgets(p) {
+            assert!(
+                w.rect.y >= 36.0 - 0.01 && w.rect.bottom() <= 36.0 + 720.0 + 0.01,
+                "page {}: {} is outside the content area: {:?}",
+                i + 1,
+                w.name,
+                w.rect
+            );
+            names.push(w.som.clone());
+        }
+    }
+    assert_eq!(names.len(), fields, "{names:?}");
+    let expected: Vec<String> = (0..fields).map(|i| format!("f{i}[0]")).collect();
+    for (n, e) in names.iter().zip(&expected) {
+        assert!(n.ends_with(e), "{n} where {e} belongs: {names:?}");
+    }
+}
+
+#[test]
+fn a_positioned_subform_taller_than_a_page_continues_on_the_next_pages() {
+    // 30 fields 0.9in apart: 27in of positioned content, where a content area holds 10in.
+    let fields: String =
+        (0..30).map(|i| format!(r#"<field name="f{i}" x="0.5in" y="{}in" w="4in" h="0.4in"><ui><textEdit/></ui></field>"#, i as f64 * 0.9)).collect();
+    // As the only child of a flowed root …
+    let form = layout_xml(&one_area_form(
+        r#"layout="tb""#,
+        &format!(r#"<subform name="body"><border><fill><color value="200,200,200"/></fill></border>{fields}</subform>"#),
+    ))
+    .unwrap();
+    assert_paginated(&form, 30, 3);
+    // … its fill is cut at the breaks, a piece on every page, none past the content area.
+    for (i, p) in form.pages.iter().enumerate() {
+        let fills: Vec<&Rect> = p.items.iter().filter_map(|it| if let Item::Fill { rect, .. } = it { Some(rect) } else { None }).collect();
+        assert!(!fills.is_empty(), "page {}: no fill", i + 1);
+        for r in fills {
+            assert!(r.bottom() <= 36.0 + 720.0 + 0.01, "page {}: fill {r:?}", i + 1);
+        }
+    }
+    // … after other content on the page …
+    let form = layout_xml(&one_area_form(
+        r#"layout="tb""#,
+        &format!(r#"<draw name="head" w="4in" h="3in"><value><text>Head</text></value></draw><subform name="body">{fields}</subform>"#),
+    ))
+    .unwrap();
+    assert_paginated(&form, 30, 3);
+    assert!(!widgets(&form.pages[0]).is_empty(), "the block starts on the page the heading is on");
+    // … and as the root itself (positioned is the default layout).
+    let form = layout_xml(&one_area_form("", &fields)).unwrap();
+    assert_paginated(&form, 30, 3);
+}
+
+#[test]
+fn wrapped_and_fixed_height_blocks_taller_than_a_page_are_split_too() {
+    let fields: String = (0..60).map(|i| format!(r#"<field name="f{i}" w="3.5in" h="0.8in"><ui><textEdit/></ui></field>"#)).collect();
+    // Left-to-right wrapping: 30 lines of 0.8in.
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, &format!(r#"<subform name="body" layout="lr-tb" w="7.5in">{fields}</subform>"#))).unwrap();
+    assert_paginated(&form, 60, 3);
+    // Top-to-bottom with a fixed height the content outgrows.
+    let form =
+        layout_xml(&one_area_form(r#"layout="tb""#, &format!(r#"<subform name="body" layout="tb" w="7.5in" h="9in">{fields}</subform>"#))).unwrap();
+    assert_paginated(&form, 60, 5);
+}
+
+#[test]
+fn a_block_that_fits_a_page_is_still_moved_whole() {
+    let block = |n: usize| {
+        format!(r#"<subform name="b{n}" w="7in" h="6in"><field name="f{n}" x="0in" y="5in" w="4in" h="0.4in"><ui><textEdit/></ui></field></subform>"#)
+    };
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, &format!("{}{}{}", block(0), block(1), block(2)))).unwrap();
+    assert_eq!(form.pages.len(), 3);
+    for p in &form.pages {
+        let w = widgets(p);
+        assert_eq!(w.len(), 1);
+        assert!((w[0].rect.y - (36.0 + 360.0)).abs() < 0.01, "{:?}", w[0].rect);
+    }
+}
+
+#[test]
+fn a_field_taller_than_a_page_is_cut_through_without_looping() {
+    let body = r#"<field name="f0" w="4in" h="25in"><ui><textEdit/></ui></field><field name="f1" w="4in" h="0.4in"><ui><textEdit/></ui></field>"#;
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, body)).unwrap();
+    let all: Vec<&Widget> = form.pages.iter().flat_map(widgets).collect();
+    assert_eq!(all.len(), 2);
+    assert!(form.pages.len() <= 4, "{} pages", form.pages.len());
+}
+
+/// A form built the way Designer builds a flowed one: everything in one left-to-right wrapped
+/// body, sections of a heading over repeating rows of fields, and a text field that grows.
+fn wrapped_form(data: &str) -> String {
+    let body = r#"<subform name="body" layout="lr-tb" w="7.5in">
+  <subform name="section" layout="lr-tb" w="7.5in" minH="0.5in">
+   <draw name="heading" w="7.5in" h="0.2in"><value><text>Entries</text></value></draw>
+   <subform name="row" layout="lr-tb" w="7.5in" minH="0.5in"><occur max="-1"/>
+    <field name="what" w="3.5in" h="1in"><ui><textEdit multiLine="1"/></ui></field>
+    <field name="when" w="0.5in" h="1in"><ui><textEdit/></ui></field>
+    <field name="why" w="3.5in" h="1in"><ui><textEdit multiLine="1"/></ui></field>
+   </subform>
+  </subform>
+  <field name="notes" w="7.5in" minH="1.5in"><ui><textEdit multiLine="1"/></ui></field>
+  <field name="after" w="7.5in" h="0.3in"><ui><textEdit/></ui></field>
+ </subform>"#;
+    let form = one_area_form(r#"layout="tb""#, body);
+    let packet =
+        format!("<xfa:datasets xmlns:xfa=\"http://www.xfa.org/schema/xfa-data/1.0/\"><xfa:data>{data}</xfa:data></xfa:datasets>\n</xdp:xdp>");
+    form.replace("</xdp:xdp>", &packet)
+}
+
+#[test]
+fn repeating_rows_in_a_wrapped_container_get_the_instances_the_data_holds() {
+    let rows: String = (0..4).map(|i| format!("<row><what>what {i}</what><when>{i}</when><why>why {i}</why></row>")).collect();
+    let form = layout_xml(&wrapped_form(&format!("<form><body><section>{rows}</section><notes>n</notes></body></form>"))).unwrap();
+    let all: Vec<&Widget> = form.pages.iter().flat_map(widgets).collect();
+    let whats: Vec<(&str, Option<&str>, f64)> =
+        all.iter().filter(|w| w.som.ends_with(".what[0]")).map(|w| (w.som.as_str(), w.value.as_deref(), w.rect.y)).collect();
+    assert_eq!(whats.len(), 4, "{whats:?}");
+    for (i, (som, value, _)) in whats.iter().enumerate() {
+        assert_eq!(*som, format!("form[0].body[0].section[0].row[{i}].what[0]"));
+        assert_eq!(*value, Some(format!("what {i}").as_str()));
+    }
+    // One under another, the section growing with them: what follows comes after the last.
+    assert!(whats.windows(2).all(|p| (p[1].2 - p[0].2 - 72.0).abs() < 0.01), "{whats:?}");
+    let notes = all.iter().find(|w| w.name == "notes").unwrap();
+    assert!(notes.rect.y >= whats[3].2 + 72.0 - 0.01, "{:?} after {whats:?}", notes.rect);
+    // Without data a row is there once.
+    let form = layout_xml(&wrapped_form("<form/>")).unwrap();
+    assert_eq!(form.pages.iter().flat_map(widgets).filter(|w| w.name.starts_with("what")).count(), 1);
+}
+
+#[test]
+fn a_multi_line_field_without_a_height_grows_to_hold_its_text() {
+    let place = |data: &str| {
+        let form = layout_xml(&wrapped_form(data)).unwrap();
+        let on = |name: &str| {
+            form.pages.iter().enumerate().find_map(|(i, p)| widgets(p).into_iter().find(|w| w.name == name).map(|w| (i, w.rect))).unwrap()
+        };
+        (on("notes"), on("after"))
+    };
+    // Little text: the minimum height.
+    let ((_, notes), (_, after)) = place("<form><body><notes>Short.</notes></body></form>");
+    assert!((notes.h - 108.0).abs() < 0.01, "{notes:?}");
+    assert!((after.y - notes.bottom()).abs() < 0.01);
+    // Forty lines: the field holds them, and what follows moves down.
+    let long: String = (0..40).map(|i| format!("Line {i} of the notes.\n")).collect();
+    let ((notes_page, grown), (after_page, after)) = place(&format!("<form><body><notes>{long}</notes></body></form>"));
+    assert!(grown.h > 40.0 * 11.0 && grown.h < 720.0, "{grown:?}");
+    assert_eq!(notes_page, after_page);
+    assert!((after.y - grown.bottom()).abs() < 0.01, "{after:?} after {grown:?}");
+    // A fixed height stays what it is.
+    let fixed = wrapped_form(&format!("<form><body><notes>{long}</notes></body></form>"))
+        .replace(r#"minH="1.5in"><ui><textEdit multiLine"#, r#"h="1.5in"><ui><textEdit multiLine"#);
+    let form = layout_xml(&fixed).unwrap();
+    let notes = form.pages.iter().flat_map(widgets).find(|w| w.name == "notes").unwrap();
+    assert!((notes.rect.h - 108.0).abs() < 0.01, "{:?}", notes.rect);
+}
+
+#[test]
+fn a_page_break_keeps_a_fields_border_with_the_field() {
+    // 6in of heading, then a bordered 5in field: it doesn't fit the 10in area and moves to
+    // the next page whole, leaving no piece of its border behind.
+    let body = r#"<subform name="body" layout="lr-tb" w="7.5in">
+  <draw name="head" w="7.5in" h="6in"><value><text>Head</text></value></draw>
+  <field name="f0" w="7.5in" h="5in"><border><edge/><fill><color value="230,230,230"/></fill></border><ui><textEdit multiLine="1"/></ui></field>
+  <field name="f1" w="7.5in" h="0.4in"><ui><textEdit/></ui></field>
+ </subform>"#;
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, body)).unwrap();
+    assert_paginated(&form, 2, 2);
+    let below_head = |it: &&Item| match it {
+        Item::Fill { rect, .. } => rect.bottom() > 36.0 + 432.0 + 1.0,
+        Item::Line { from, to, .. } => from.1.max(to.1) > 36.0 + 432.0 + 1.0,
+        _ => false,
+    };
+    assert_eq!(form.pages[0].items.iter().filter(below_head).count(), 0, "{:?}", form.pages[0].items);
+    assert!(
+        form.pages[1].items.iter().any(|it| matches!(it, Item::Fill { rect, .. } if (rect.y - 36.0).abs() < 0.01 && (rect.h - 360.0).abs() < 0.01))
+    );
+}
+
+#[test]
+fn text_too_long_for_its_fixed_height_is_drawn_smaller_instead_of_over_what_follows() {
+    let words = "certification statement wording ".repeat(12);
+    let body = format!(
+        r#"<draw name="note" w="7.5in" h="0.3in"><font typeface="Arial" size="8pt"/><value><text>{words}</text></value></draw>
+ <draw name="short" w="7.5in" h="0.3in"><font typeface="Arial" size="8pt"/><value><text>Short</text></value></draw>"#
+    );
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, &body)).unwrap();
+    let spans: Vec<&crate::text::Span> = form.pages[0].items.iter().filter_map(|i| if let Item::Text(s) = i { Some(s) } else { None }).collect();
+    let (short, note): (Vec<_>, Vec<_>) = spans.into_iter().partition(|s| s.text == "Short");
+    // Three lines at 8pt need 27.6pt; the box is 21.6pt high.
+    assert!(note.iter().all(|s| s.face.size < 8.0 && s.face.size >= 5.6), "{:?}", note.iter().map(|s| s.face.size).collect::<Vec<_>>());
+    assert!(note.iter().all(|s| s.baseline <= 36.0 + 21.6 + 0.5), "{:?}", note.iter().map(|s| s.baseline).collect::<Vec<_>>());
+    assert!(note.iter().all(|s| s.x + s.face.width(&s.text) <= 36.0 + 540.0 + 0.5));
+    // Text that fits keeps its size.
+    assert!((short[0].face.size - 8.0).abs() < 1e-9);
+}
+
+#[test]
+fn a_text_field_that_outgrows_a_page_continues_on_the_next_as_text() {
+    let long: String = (0..150).map(|i| format!("Line {i} of the notes.\n")).collect();
+    let form = layout_xml(&wrapped_form(&format!("<form><body><notes>{long}</notes><after>end</after></body></form>"))).unwrap();
+    assert!(form.pages.len() >= 3, "{} pages", form.pages.len());
+    assert!(form.warnings.iter().any(|w| w.starts_with("notes: its text is longer than a page")), "{:?}", form.warnings);
+    // Every line is there, in order, inside the content area of its page; no widget holds it.
+    let mut lines = Vec::new();
+    for (i, p) in form.pages.iter().enumerate() {
+        for it in &p.items {
+            if let Item::Text(s) = it
+                && s.text.starts_with("Line ")
+            {
+                assert!(s.baseline > 36.0 && s.baseline <= 36.0 + 720.0 + 0.01, "page {}: {:?} at {}", i + 1, s.text, s.baseline);
+                lines.push(s.text.clone());
+            }
+        }
+        assert!(widgets(p).iter().all(|w| w.name != "notes"));
+    }
+    assert_eq!(lines, (0..150).map(|i| format!("Line {i} of the notes.")).collect::<Vec<_>>());
+    // What follows comes after the last line, on the last page.
+    let last = form.pages.last().unwrap();
+    let after = widgets(last).into_iter().find(|w| w.name == "after").unwrap();
+    let last_line = last.items.iter().filter_map(|it| if let Item::Text(s) = it { Some(s.baseline) } else { None }).fold(0.0, f64::max);
+    assert!(after.rect.y >= last_line - 0.01 && after.rect.bottom() <= 36.0 + 720.0 + 0.01, "{:?} after {last_line}", after.rect);
+}
+
+#[test]
+fn the_form_packet_restores_the_presence_and_access_the_form_was_saved_with() {
+    // Three rows hidden in the template; a script showed the first two before the form was
+    // saved, and locked a field.
+    let row = |n: usize, presence: &str| {
+        format!(
+            r#"<subform name="row{n}" layout="lr-tb" w="7.5in"{presence}><field name="who" w="3in" h="0.4in"><ui><textEdit/></ui></field></subform>"#
+        )
+    };
+    let body = format!(
+        r#"<subform name="body" layout="lr-tb" w="7.5in">{}{}{}{}<subform name="rep" layout="lr-tb" w="7.5in"><occur max="-1"/><field name="x" w="3in" h="0.4in"><ui><textEdit/></ui></field></subform></subform>"#,
+        row(0, ""),
+        row(1, r#" presence="hidden""#),
+        row(2, r#" presence="hidden""#),
+        row(3, r#" presence="hidden""#)
+    );
+    let template = one_area_form(r#"layout="tb""#, &body);
+    let visible = |xdp: &str| -> Vec<String> { layout_xml(xdp).unwrap().pages.iter().flat_map(widgets).map(|w| w.som.clone()).collect() };
+    assert_eq!(visible(&template), ["form[0].body[0].row0[0].who[0]", "form[0].body[0].rep[0].x[0]"]);
+    let saved = r#"<form xmlns="http://www.xfa.org/schema/xfa-form/2.8/" checksum="x"><subform name="form">
+ <instanceManager name="_body"/>
+ <subform name="body">
+  <subform name="row0"><field name="who" access="readOnly"/></subform>
+  <subform name="row1" presence="visible"><field name="who" access="readOnly"><value override="1"/></field></subform>
+  <subform name="row2" presence="visible"/>
+  <subform name="row3" presence="hidden"/>
+  <subform name="rep"><field name="x"/></subform>
+  <subform name="rep" presence="hidden"><field name="x" access="readOnly"/></subform>
+  <subform name="nowhere" presence="hidden"/>
+ </subform>
+ <pageSet><pageArea name="page"/></pageSet>
+</subform></form>
+</xdp:xdp>"#;
+    let xdp = template.replace("</xdp:xdp>", saved);
+    assert_eq!(
+        visible(&xdp),
+        ["form[0].body[0].row0[0].who[0]", "form[0].body[0].row1[0].who[0]", "form[0].body[0].row2[0].who[0]", "form[0].body[0].rep[0].x[0]"],
+        "a later instance of a repeating subform says nothing about the template's one"
+    );
+    let form = layout_xml(&xdp).unwrap();
+    let locked: Vec<bool> = form.pages.iter().flat_map(widgets).map(|w| w.read_only).collect();
+    assert_eq!(locked, [true, true, false, false]);
+}
+
+#[test]
+fn a_flowed_subform_is_as_tall_as_its_content_whatever_its_minimum_height() {
+    // A bar with a stale 3in `minH` holds one 0.2in line; the row after it follows directly.
+    let body = |bar: &str| {
+        format!(
+            r#"<subform name="body" layout="lr-tb" w="7.5in"><subform name="bar" {bar} w="7.5in" minH="3in"><draw w="7.5in" h="0.2in"><value><text>Attachments</text></value></draw></subform><field name="who" w="3in" h="0.4in"><ui><textEdit/></ui></field></subform>"#
+        )
+    };
+    let top = |bar: &str| {
+        let form = layout_xml(&one_area_form(r#"layout="tb""#, &body(bar))).unwrap();
+        let w = widgets(&form.pages[0]);
+        w[0].rect.y
+    };
+    let flowed = top(r#"layout="lr-tb""#);
+    assert!((top(r#"layout="tb""#) - flowed).abs() < 0.01);
+    // A positioned subform keeps its minimum: nothing else says how tall it is.
+    assert!((top("") - flowed - (216.0 - 14.4)).abs() < 0.01, "{} against {flowed}", top(""));
+}
+
+#[test]
+fn the_form_packet_restores_a_caption_a_script_changed() {
+    let body = r#"<subform name="body" layout="tb" w="7.5in"><field name="bar" w="2in" h="0.3in"><ui><button/></ui><caption><value><text>Show Bar</text></value></caption></field></subform>"#;
+    let template = one_area_form(r#"layout="tb""#, body);
+    let caption = |xdp: &str| match &widgets(&layout_xml(xdp).unwrap().pages[0])[0].kind {
+        WidgetKind::Button { caption } => caption.clone(),
+        other => panic!("{other:?}"),
+    };
+    assert_eq!(caption(&template), "Show Bar");
+    let saved = r#"<form xmlns="http://www.xfa.org/schema/xfa-form/2.8/"><subform name="form"><subform name="body">
+ <field name="bar"><caption><value><text>Hide Bar</text></value></caption></field>
+</subform></subform></form>
+</xdp:xdp>"#;
+    assert_eq!(caption(&template.replace("</xdp:xdp>", saved)), "Hide Bar");
+}
+
+#[test]
+fn a_text_field_without_a_border_of_its_own_has_no_box() {
+    let body = r#"<subform name="body" layout="tb" w="7.5in"><field name="plain" w="3in" h="0.4in"><ui><textEdit/></ui></field><field name="boxed" w="3in" h="0.4in"><ui><textEdit><border><edge/></border></textEdit></ui></field><field name="tick" w="3in" h="0.4in"><ui><checkButton/></ui></field></subform>"#;
+    let form = layout_xml(&one_area_form(r#"layout="tb""#, body)).unwrap();
+    let shapes: Vec<BorderShape> = widgets(&form.pages[0]).iter().map(|w| w.border.shape).collect();
+    assert_eq!(shapes, [BorderShape::None, BorderShape::Full, BorderShape::Full]);
+}
+
+#[test]
+fn a_signed_signature_box_shows_the_signature_the_file_holds() {
+    let mut doc = Document::open(Arc::new(crate::fixtures::signed_shell())).unwrap();
+    render_into(&mut doc).unwrap();
+    let catalog = doc.get(doc.root().unwrap());
+    let acro = doc.resolve(catalog.as_dict().unwrap().get(b"AcroForm").unwrap());
+    let fields = doc.resolve(acro.as_dict().unwrap().get(b"Fields").unwrap()).as_array().unwrap().clone();
+    let laid: Vec<_> = fields.iter().map(|f| doc.resolve(f)).filter(|f| f.as_dict().unwrap().contains(SOM_KEY)).collect();
+    let (signed, unsigned) = (laid[0].as_dict().unwrap(), laid[1].as_dict().unwrap());
+    // The signature dictionary and the picture are the file's own objects, not copies.
+    let value = doc.resolve(signed.get(b"V").unwrap());
+    assert_eq!(value.as_dict().unwrap().name(b"Type"), Some(&b"Sig"[..]));
+    assert!(signed.get(b"V").unwrap().as_ref().is_some());
+    let shown = doc.resolve(signed.get(b"AP").unwrap());
+    let picture = doc.resolve(shown.as_dict().unwrap().get(b"N").unwrap());
+    assert!(matches!(&*picture, Object::Stream(s) if s.dict.name(b"Subtype") == Some(&b"Form"[..])));
+    assert_eq!(signed.int(b"Ff").unwrap_or(0) & 1, 1, "a signed box is not signed again");
+    assert!(!unsigned.contains(b"V") && !unsigned.contains(b"AP"));
+}
+
+#[test]
+fn a_carriage_return_and_line_feed_are_one_line_break() {
+    let lines = |t: &str| crate::text::plain(t).paragraphs.len();
+    assert_eq!(lines("one\r\ntwo\r\nthree"), 3);
+    assert_eq!(lines("one\ntwo\rthree"), 3);
+    assert_eq!(lines("one\r\n\r\ntwo"), 3, "an empty line stays");
+    // As the data holds it: character references, which the XML parser leaves alone.
+    let form = layout_xml(&wrapped_form("<form><body><notes>one&#xD;&#xA;two&#xD;&#xA;three</notes></body></form>")).unwrap();
+    let crlf = form.pages.iter().flat_map(widgets).find(|w| w.name == "notes").unwrap().rect.h;
+    let form = layout_xml(&wrapped_form("<form><body><notes>one&#xA;two&#xA;three</notes></body></form>")).unwrap();
+    let lf = form.pages.iter().flat_map(widgets).find(|w| w.name == "notes").unwrap().rect.h;
+    assert!((crlf - lf).abs() < 0.01);
+}
diff --git a/crates/xfa/src/text.rs b/crates/xfa/src/text.rs
index ed6eb72c..6db0777c 100644
--- a/crates/xfa/src/text.rs
+++ b/crates/xfa/src/text.rs
@@ -286,10 +286,12 @@ pub fn measure_height(rich: &RichText, width: f64, para: &Para, base: &Face, emb
     layout(rich, Rect::new(0.0, 0.0, width.max(1.0), 0.0), &p, base, embed).height
 }
 
-/// Plain text as rich text (paragraphs split on line breaks).
+/// Plain text as rich text (paragraphs split on line breaks; a carriage return and line feed
+/// together are one break, as form data often holds them).
 pub fn plain(text: &str) -> RichText {
     RichText {
         paragraphs: text
+            .replace("\r\n", "\n")
             .split(['\n', '\r', '\u{2028}', '\u{2029}'])
             .map(|l| crate::model::Paragraph { runs: vec![Run { text: l.to_string(), ..Run::default() }], h_align: None })
             .collect(),
diff --git a/crates/xfdf/src/lib.rs b/crates/xfdf/src/lib.rs
index 91c3d245..4998e754 100644
--- a/crates/xfdf/src/lib.rs
+++ b/crates/xfdf/src/lib.rs
@@ -67,6 +67,92 @@ pub struct Report {
 
 // ── names ───────────────────────────────────────────────────────────────────────────────────
 
+/// Form data files are attacker-supplied. Refuse a DTD and bound the node count, exactly as the
+/// XFA template parser does (`crates/xfa/src/parse.rs`), and bound how deep a nested field tree
+/// may go: the walk below recurses once per nesting level.
+const MAX_NODES: u32 = 2_000_000;
+const MAX_DEPTH: usize = 64;
+
+/// The deepest element nesting accepted before the text reaches the XML parser.
+///
+/// roxmltree parses by recursive descent, so its stack use grows with the nesting depth: ten
+/// thousand levels overflow the main thread's stack and abort the process. A stack overflow is
+/// `abort()`, so `catch_unwind` cannot intercept it and the whole application dies - which is why
+/// the bound has to be applied before parsing, not while walking the result. Around three thousand
+/// levels still parse on the default stack, so this stays clear of the cliff while leaving far more
+/// room than the walks below, which cut off at 64.
+const MAX_XML_DEPTH: usize = 1_024;
+
+/// Element nesting depth of `text`, skipping comments, CDATA, processing instructions, the DOCTYPE
+/// and quoted attribute values. A tag that closes itself (`<field/>`) is one level while it is read
+/// and does not stay open, so a long run of them cannot accumulate into the bound. It cannot
+/// under-count a real element; a stray `<` in text is invalid XML and only makes it over-count,
+/// which errs towards refusing the file.
+fn xml_nesting_depth(text: &str) -> usize {
+    fn find(hay: &[u8], from: usize, needle: &[u8]) -> Option<usize> {
+        (from..hay.len()).find(|&p| hay[p..].starts_with(needle))
+    }
+    let b = text.as_bytes();
+    let (mut i, mut depth, mut max) = (0usize, 0usize, 0usize);
+    while i < b.len() {
+        if b[i] != b'<' {
+            i += 1;
+        } else if b[i..].starts_with(b"<!--") {
+            i = find(b, i + 4, b"-->").map_or(b.len(), |p| p + 3);
+        } else if b[i..].starts_with(b"<![CDATA[") {
+            i = find(b, i + 9, b"]]>").map_or(b.len(), |p| p + 3);
+        } else if b[i..].starts_with(b"<?") {
+            i = find(b, i + 2, b"?>").map_or(b.len(), |p| p + 2);
+        } else if b[i..].starts_with(b"<!") {
+            i = find(b, i + 2, b">").map_or(b.len(), |p| p + 1);
+        } else if b[i..].starts_with(b"</") {
+            depth = depth.saturating_sub(1);
+            i = find(b, i + 2, b">").map_or(b.len(), |p| p + 1);
+        } else {
+            depth += 1;
+            max = max.max(depth);
+            // Skip the rest of the start tag, over any quoted attribute value, and remember its last
+            // significant byte: a tag that ends in `/` closes itself, so it is one level deep while it
+            // is read rather than a level left open.
+            i += 1;
+            let mut quote = 0u8;
+            let mut last = 0u8;
+            while i < b.len() {
+                let c = b[i];
+                if quote != 0 {
+                    if c == quote {
+                        quote = 0;
+                    }
+                } else if c == b'"' || c == b'\'' {
+                    quote = c;
+                } else if c == b'>' {
+                    i += 1;
+                    break;
+                } else if !c.is_ascii_whitespace() {
+                    last = c;
+                }
+                i += 1;
+            }
+            if last == b'/' {
+                depth -= 1;
+            }
+        }
+    }
+    max
+}
+
+fn check_form_xml_depth(text: &str) -> Result<(), DataError> {
+    let depth = xml_nesting_depth(text);
+    if depth > MAX_XML_DEPTH {
+        return Err(DataError::Malformed(format!("the file nests XML elements {depth} deep, past the {MAX_XML_DEPTH} the reader accepts")));
+    }
+    Ok(())
+}
+
+fn parse_form_xml(text: &str) -> Result<roxmltree::Document<'_>, roxmltree::Error> {
+    roxmltree::Document::parse_with_options(text, roxmltree::ParsingOptions { allow_dtd: false, nodes_limit: MAX_NODES })
+}
+
 const SUBTYPES: [(&str, &str); 17] = [
     ("Text", "text"),
     ("FreeText", "freetext"),
@@ -590,7 +676,7 @@ fn annot_from_xml(node: roxmltree::Node, subtype: &str, page_ref: ObjRef) -> Opt
         .unwrap_or("print")
         .split(',')
         .filter_map(|f| FLAGS.iter().find(|(_, s)| s.eq_ignore_ascii_case(f.trim())).map(|x| x.0))
-        .sum();
+        .fold(0, |bits, flag| bits | flag);
     d.set(b"F".to_vec(), Object::Int(flags));
     if let Some(c) = node.attribute("color").and_then(parse_hex) {
         d.set(b"C".to_vec(), arr(&c));
@@ -668,7 +754,27 @@ fn annot_from_xml(node: roxmltree::Node, subtype: &str, page_ref: ObjRef) -> Opt
 
 /// Put an annotation dictionary on a page, replacing one with the same `/NM`. Returns its
 /// reference.
-fn place(doc: &mut Document, page_ref: ObjRef, d: Dict) -> Result<ObjRef, DataError> {
+/// `/F` bits an imported file may not set on a redaction mark: Invisible, Hidden, NoView — so a
+/// mark it brings in is always drawn for the user to review before content is removed.
+const REDACT_UNSEEN: i64 = 1 | 2 | 32;
+/// `/F` Locked (ISO 32000-2 Table 167): the user protected this annotation from change.
+const LOCKED: i64 = 128;
+
+/// An existing annotation an import must never replace, move or unlock: one the user locked, or a
+/// redaction mark (replacing it would drop the region the user marked to remove).
+fn import_protected(x: &Dict) -> bool {
+    x.int(b"F").unwrap_or(0) & LOCKED != 0 || x.name(b"Subtype") == Some(b"Redact".as_slice())
+}
+
+fn place(doc: &mut Document, page_ref: ObjRef, mut d: Dict) -> Result<ObjRef, DataError> {
+    // A redaction mark the import carries is always made visible: clear any Invisible/Hidden/NoView
+    // flag so it cannot remove content the user never sees.
+    if d.name(b"Subtype") == Some(b"Redact".as_slice()) {
+        let f = d.int(b"F").unwrap_or(0);
+        if f & REDACT_UNSEEN != 0 {
+            d.set(b"F".to_vec(), Object::Int(f & !REDACT_UNSEEN));
+        }
+    }
     let nm = d.get(b"NM").and_then(|n| n.as_string().map(|s| s.to_text()));
     let annots: Vec<Object> = doc
         .get(page_ref)
@@ -679,15 +785,24 @@ fn place(doc: &mut Document, page_ref: ObjRef, d: Dict) -> Result<ObjRef, DataEr
         .unwrap_or_default();
     let mut kept = Vec::new();
     let mut removed: Vec<ObjRef> = Vec::new();
+    // Never let a same-name import replace a locked comment or a redaction mark: keep it, and add
+    // the imported dict beside it under no name of its own.
+    let mut clash = false;
     for a in annots {
-        let same = nm.is_some()
-            && a.as_ref().and_then(|r| doc.get(r).as_dict().and_then(|x| x.get(b"NM").and_then(|n| n.as_string().map(|s| s.to_text())))) == nm;
-        if same {
+        let existing = a.as_ref().and_then(|r| doc.get(r).as_dict().cloned());
+        let same = nm.is_some() && existing.as_ref().and_then(|x| x.get(b"NM").and_then(|n| n.as_string().map(|s| s.to_text()))) == nm;
+        if same && existing.as_ref().is_some_and(import_protected) {
+            clash = true;
+            kept.push(a);
+        } else if same {
             removed.extend(a.as_ref());
         } else {
             kept.push(a);
         }
     }
+    if clash {
+        d.remove(b"NM");
+    }
     // The replaced note's pop-up goes with it; otherwise it stays on the page pointing at a note that is no longer there.
     kept.retain(|a| {
         let Some(x) = a.as_ref().map(|r| doc.get(r)).and_then(|o| o.as_dict().cloned()) else { return true };
@@ -702,7 +817,8 @@ fn place(doc: &mut Document, page_ref: ObjRef, d: Dict) -> Result<ObjRef, DataEr
 }
 
 fn import_xfdf(doc: &mut Document, text: &str) -> Result<Report, DataError> {
-    let xml = roxmltree::Document::parse(text).map_err(|e| DataError::Malformed(e.to_string()))?;
+    check_form_xml_depth(text)?;
+    let xml = parse_form_xml(text).map_err(|e| DataError::Malformed(e.to_string()))?;
     let root = xml.root_element();
     if root.tag_name().name() != "xfdf" {
         return Err(DataError::UnknownFormat);
@@ -754,7 +870,7 @@ fn import_xfdf(doc: &mut Document, text: &str) -> Result<Report, DataError> {
     // Fields.
     if let Some(fields) = root.children().find(|c| c.has_tag_name("fields")) {
         let mut values = Vec::new();
-        walk_xfdf(fields, "", &mut values);
+        walk_xfdf(fields, "", &mut values, 0)?;
         apply_values(doc, &values, &mut report);
     }
     Ok(report)
@@ -787,7 +903,10 @@ fn deep(src: &Document, o: &Object, depth: usize) -> Object {
     }
 }
 
-fn walk_xfdf(node: roxmltree::Node, prefix: &str, out: &mut Vec<(String, Vec<String>)>) {
+fn walk_xfdf(node: roxmltree::Node, prefix: &str, out: &mut Vec<(String, Vec<String>)>, depth: usize) -> Result<(), DataError> {
+    if depth > MAX_DEPTH {
+        return Err(DataError::Malformed(format!("XFDF fields nest more than {MAX_DEPTH} deep")));
+    }
     for f in node.children().filter(|c| c.has_tag_name("field")) {
         let Some(name) = f.attribute("name") else { continue };
         let full = if prefix.is_empty() { name.to_string() } else { format!("{prefix}.{name}") };
@@ -795,8 +914,9 @@ fn walk_xfdf(node: roxmltree::Node, prefix: &str, out: &mut Vec<(String, Vec<Str
         if !vals.is_empty() {
             out.push((full.clone(), vals));
         }
-        walk_xfdf(f, &full, out);
+        walk_xfdf(f, &full, out, depth + 1)?;
     }
+    Ok(())
 }
 
 fn walk_fdf(fdf: &Document, list: &[Object], prefix: &str, out: &mut Vec<(String, Vec<String>)>, depth: usize) {
@@ -857,14 +977,15 @@ pub fn data_values(bytes: &[u8]) -> Result<Vec<(String, Vec<String>)>, DataError
     }
     let text = String::from_utf8_lossy(bytes);
     let t = text.trim_start_matches('\u{feff}').trim_start();
-    let xml = roxmltree::Document::parse(t).map_err(|_| DataError::UnknownFormat)?;
+    check_form_xml_depth(t)?;
+    let xml = parse_form_xml(t).map_err(|_| DataError::UnknownFormat)?;
     let root = xml.root_element();
     if root.tag_name().name() != "xfdf" {
         return Err(DataError::UnknownFormat);
     }
     let mut values = Vec::new();
     if let Some(fields) = root.children().find(|c| c.has_tag_name("fields")) {
-        walk_xfdf(fields, "", &mut values);
+        walk_xfdf(fields, "", &mut values, 0)?;
     }
     Ok(values)
 }
@@ -944,7 +1065,8 @@ fn import_table(doc: &mut Document, text: &str) -> Result<Report, DataError> {
     let mut report = Report::default();
     let t = text.trim_start_matches('\u{feff}');
     let values: Vec<(String, Vec<String>)> = if t.trim_start().starts_with('<') {
-        let xml = roxmltree::Document::parse(t).map_err(|e| DataError::Malformed(e.to_string()))?;
+        check_form_xml_depth(t)?;
+        let xml = parse_form_xml(t).map_err(|e| DataError::Malformed(e.to_string()))?;
         xml.root_element()
             .children()
             .filter(|c| c.is_element())
diff --git a/crates/xfdf/src/tests.rs b/crates/xfdf/src/tests.rs
index 33b3a5a8..31e7f5c3 100644
--- a/crates/xfdf/src/tests.rs
+++ b/crates/xfdf/src/tests.rs
@@ -36,6 +36,52 @@ fn blank() -> Document {
     Document::open(Arc::new(write_full(&doc, &SaveOptions::default()).unwrap())).unwrap()
 }
 
+/// A deeply nested field tree is refused with an error. The walk used to recurse once per level
+/// with nothing bounding it, so a small file overflowed the stack - and a stack overflow aborts
+/// the process, which no `catch_unwind` can intercept.
+#[test]
+fn deeply_nested_fields_are_refused_instead_of_overflowing_the_stack() {
+    let mut xml = String::from(r#"<?xml version="1.0"?><xfdf xmlns="http://ns.adobe.com/xfdf/"><fields>"#);
+    for i in 0..10_000 {
+        xml.push_str(&format!(r#"<field name="f{i}">"#));
+    }
+    xml.push_str("<value>v</value>");
+    for _ in 0..10_000 {
+        xml.push_str("</field>");
+    }
+    xml.push_str("</fields></xfdf>");
+    assert!(matches!(data_values(xml.as_bytes()), Err(DataError::Malformed(_))), "ten thousand nested fields must be refused, not walked");
+}
+
+/// Nesting inside the limit still reads, and the dotted field name is built as before.
+#[test]
+fn nested_fields_within_the_limit_still_read() {
+    let mut xml = String::from(r#"<?xml version="1.0"?><xfdf xmlns="http://ns.adobe.com/xfdf/"><fields>"#);
+    for i in 0..16 {
+        xml.push_str(&format!(r#"<field name="f{i}">"#));
+    }
+    xml.push_str("<value>deep</value>");
+    for _ in 0..16 {
+        xml.push_str("</field>");
+    }
+    xml.push_str("</fields></xfdf>");
+    let Ok(values) = data_values(xml.as_bytes()) else { panic!("sixteen levels must still read") };
+    assert_eq!(values.len(), 1);
+    assert_eq!(values[0].0, "f0.f1.f2.f3.f4.f5.f6.f7.f8.f9.f10.f11.f12.f13.f14.f15");
+    assert_eq!(values[0].1, vec!["deep".to_string()]);
+}
+
+/// The scanner counts a tag that closes itself as one level while it is read, not as a level left
+/// open, so a flat file with thousands of them stays shallow and is not refused.
+#[test]
+fn self_closing_elements_do_not_accumulate_in_the_depth() {
+    use crate::xml_nesting_depth as d;
+    assert_eq!(d("<a/>"), 1);
+    assert_eq!(d("<a><b/></a>"), 2);
+    assert_eq!(d(&"<empty/>".repeat(2_000)), 1);
+    assert_eq!(d(&format!("<fields>{}</fields>", r#"<field name="a"/>"#.repeat(2_000))), 2);
+}
+
 /// The blank document with comments and values.
 fn filled() -> Document {
     let mut doc = blank();
@@ -353,6 +399,58 @@ fn reimporting_a_note_replaces_its_popup() {
     assert!(refs.contains(&parent), "the pop-up belongs to a note that is still on the page");
 }
 
+#[test]
+fn imported_redact_marks_cannot_replace_a_locked_mark_or_hide_themselves() {
+    let mut doc = blank();
+    let page = pdfcraft_model::pages(&doc)[0].obj;
+    // A locked redaction mark the user placed, with a known /NM.
+    let mut mark = Dict::new();
+    mark.set(b"Type".to_vec(), Object::name("Annot"));
+    mark.set(b"Subtype".to_vec(), Object::name("Redact"));
+    mark.set(b"NM".to_vec(), PdfString::text("mark1"));
+    mark.set(b"Rect".to_vec(), Object::Array(vec![60.into(), 660.into(), 560.into(), 678.into()]));
+    mark.set(b"F".to_vec(), Object::Int(128)); // Locked
+    let mark_ref = doc.add(Object::Dict(mark));
+    let mut annots =
+        doc.get(page).as_dict().and_then(|p| p.get(b"Annots").cloned()).and_then(|a| doc.resolve(&a).as_array().cloned()).unwrap_or_default();
+    annots.push(Object::Ref(mark_ref));
+    doc.update_dict(page, |p| p.set(b"Annots".to_vec(), Object::Array(annots))).unwrap();
+
+    // A reviewer's XFDF: shrink the locked mark to a 1×1 corner by reusing its /NM, and add a
+    // redaction mark imported as Hidden that would remove other content unseen.
+    let xfdf = concat!(
+        r#"<xfdf xmlns="http://ns.adobe.com/xfdf/"><annots>"#,
+        r#"<redact page="0" name="mark1" rect="0,0,1,1" title="Reviewer"/>"#,
+        r#"<redact page="0" name="ghost" rect="60,600,560,620" flags="hidden" title="Reviewer"/>"#,
+        r#"</annots></xfdf>"#,
+    );
+    import(&mut doc, xfdf.as_bytes()).unwrap();
+
+    let refs: Vec<ObjRef> = doc
+        .get(page)
+        .as_dict()
+        .and_then(|p| p.get(b"Annots").cloned())
+        .and_then(|a| doc.resolve(&a).as_array().cloned())
+        .unwrap_or_default()
+        .iter()
+        .filter_map(|a| a.as_ref())
+        .collect();
+    // The locked mark is still there, unchanged (same object, same geometry, still its /NM).
+    assert!(refs.contains(&mark_ref), "the locked redaction mark was replaced");
+    let locked = doc.get(mark_ref).as_dict().cloned().unwrap();
+    assert_eq!(nums_of(&doc, locked.get(b"Rect")), vec![60.0, 660.0, 560.0, 678.0], "the locked mark's geometry was changed");
+    assert_eq!(locked.get(b"NM").and_then(|n| n.as_string().map(|s| s.to_text())).as_deref(), Some("mark1"));
+    assert_eq!(locked.int(b"F"), Some(128), "the locked mark lost its Locked flag");
+    // Every redaction mark on the page is visible (none Invisible/Hidden/NoView): the import's two
+    // marks were added beside the protected one, both drawable for review.
+    let redacts: Vec<Dict> =
+        refs.iter().map(|r| doc.get(*r).as_dict().cloned().unwrap()).filter(|d| d.name(b"Subtype") == Some(b"Redact".as_slice())).collect();
+    assert_eq!(redacts.len(), 3, "the imported marks should be added, not merged away");
+    for d in &redacts {
+        assert_eq!(d.int(b"F").unwrap_or(0) & (1 | 2 | 32), 0, "a redaction mark is hidden from review: {d:?}");
+    }
+}
+
 /// The `/Vertices` of every annotation on the document's pages, by subtype.
 fn vertices(doc: &Document) -> Vec<(String, Vec<f64>)> {
     let mut out = Vec::new();
@@ -445,3 +543,56 @@ fn xfdf_keeps_callout_leader_inset_and_ending() {
     assert_eq!(want.1.len(), 6, "{want:?}");
     assert_eq!(callout_keys(&dst), want, "{xfdf}");
 }
+
+/// Run `f` on a thread with a small stack, as a deep recursion would overflow it.
+fn on_small_stack<T: Send + 'static>(f: impl FnOnce() -> T + Send + 'static) -> T {
+    std::thread::Builder::new().stack_size(256 << 10).spawn(f).unwrap().join().unwrap()
+}
+
+#[test]
+fn deeply_nested_xml_is_refused_before_parsing() {
+    // A file nested far deeper than any stack holds used to overflow roxmltree's recursive
+    // parser, which aborts the process. It must be refused without recursing.
+    let deep = |root: &str| format!("<{root}>{}{}</{root}>", "<a>".repeat(100_000), "</a>".repeat(100_000));
+    let xfdf = deep("xfdf");
+    let xml = deep("fields");
+    let (imported, table, values) = on_small_stack(move || {
+        let mut doc = blank();
+        (import(&mut doc, xfdf.as_bytes()), import(&mut doc, xml.as_bytes()), data_values(xfdf.as_bytes()))
+    });
+    for r in [imported.map(|_| ()), table.map(|_| ()), values.map(|_| ())] {
+        assert!(matches!(&r, Err(DataError::Malformed(m)) if m.contains("deep")), "{r:?}");
+    }
+}
+
+#[test]
+fn wide_or_commented_xml_is_not_mistaken_for_deep() {
+    // Thousands of siblings, self-closing tags, `>` in attribute values, and tags inside
+    // comments, CDATA and processing instructions add no depth.
+    let mut x = String::from("<?xml version=\"1.0\"?><!-- <a><a><a> --><xfdf><fields>");
+    for i in 0..5_000 {
+        x.push_str(&format!("<field name=\"f{i} > g\"><value>v</value></field><empty/><![CDATA[<b><b>]]><?pi <c> ?>"));
+    }
+    x.push_str("</fields></xfdf>");
+    assert_eq!(check_form_xml_depth(&x), Ok(()));
+    let nested = |n: usize| format!("{}{}", "<a>".repeat(n), "</a>".repeat(n));
+    assert_eq!(check_form_xml_depth(&nested(MAX_XML_DEPTH)), Ok(()));
+    assert!(check_form_xml_depth(&nested(MAX_XML_DEPTH + 1)).is_err());
+}
+
+#[test]
+fn duplicate_xfdf_annotation_flags_do_not_turn_on_unrelated_bits() {
+    // Flags are a set of bit masks, not additive integers. A repeated "print" flag
+    // must not carry into "nozoom", nor repeated "readonly" into "locked".
+    for (flags, expected) in [("print, PRINT, nozoom", 12), ("readonly,readonly", 64), ("print,print,print", 4)] {
+        let xfdf = format!(
+            r#"<xfdf xmlns="http://ns.adobe.com/xfdf/"><annots><square page="0" rect="10,10,50,50" name="flags" flags="{flags}" /></annots></xfdf>"#
+        );
+        let mut doc = blank();
+        assert_eq!(import(&mut doc, xfdf.as_bytes()).unwrap().comments, 1);
+        let page = pdfcraft_model::pages(&doc)[0].obj;
+        let annotations = doc.get(page).as_dict().and_then(|p| p.get(b"Annots")).map(|a| doc.resolve(a)).and_then(|a| a.as_array().cloned()).unwrap();
+        let square = annotations.iter().filter_map(|a| doc.resolve(a).as_dict().cloned()).find(|d| d.name(b"Subtype") == Some(b"Square")).unwrap();
+        assert_eq!(square.get(b"F").and_then(Object::as_int), Some(expected), "flags={flags}");
+    }
+}
diff --git a/docs/architecture.md b/docs/architecture.md
index 4e047c10..a226cc8d 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -1,6 +1,6 @@
 # PdfCraft architecture
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (shared print spooler; Windows CI enabled) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (shared print spooler; Windows CI passes) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How PdfCraft is built today. The design rationale and the planned crates live in
 `plan/architecture.md` and `plan/adr/` (local-only); this file describes what is on `main`. Each
diff --git a/docs/development.md b/docs/development.md
index 168197ab..53531189 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -3,9 +3,50 @@
 Working instructions for agents and contributors are in `AGENTS.md` and `CLAUDE.md`. This page
 collects what the desktop app reads from its environment and where it writes its diagnostics.
 
+## Low-disk Cargo profile
+
+When local build storage is constrained, select the opt-in `low-disk` profile explicitly:
+
+```sh
+cargo build --profile low-disk -p pdfcraft-cli
+cargo test --profile low-disk -p pdfcraft-cos --lib
+```
+
+The profile inherits the normal development settings, including debug assertions and overflow
+checks. It uses line-table-only debug information for workspace code, which keeps file and line
+numbers in backtraces but omits local-variable and parameter details, and it disables incremental
+compilation for this profile only. Ordinary `cargo build`, `cargo test`, and release builds keep
+their existing profiles.
+
+Cargo stores custom-profile artifacts separately under `target/low-disk`. Switching between the
+normal and low-disk profiles can therefore leave both sets of artifacts on disk. To remove only
+the low-disk artifacts, run `cargo clean --profile low-disk`.
+
 The UI crate and complete desktop/web builds require Rust 1.95 or later, matching the pinned
 `craft-ui` dependency. The workspace's core-crate minimum is unchanged.
 
+## Interface appearance
+
+Display theme saves System, Light or Dark separately from the palette currently drawn. New
+installations still default to Light. System follows native appearance events on macOS and
+Windows. The native window keeps its inherited appearance in every mode; both egui style branches
+use the selected application palette, so desktop changes cannot override a manual choice.
+
+On Linux the native app starts an XDG Settings portal subscription when System is first selected.
+It reads `org.freedesktop.appearance` / `color-scheme`, where numeric `1` requests Dark, `2` requests
+Light, and `0` means no preference. When that states no preference or is missing, it falls back to
+`org.gnome.desktop.interface` / `color-scheme` (`prefer-dark`, `prefer-light`, `default`), which
+XFCE's portal answers instead of the freedesktop namespace; KDE answers only the freedesktop one. The subscription is installed before the initial read. Initial
+results and later `SettingChanged` signals wake an idle window. There is no periodic desktop
+polling, and signals received in a manual mode update the cache without requesting frames.
+
+System falls back to Light if no appearance is available, including an absent portal, an
+unsupported appearance backend, no preference, an unknown value or a failed connection. This
+does not rewrite the saved System choice. The watcher cancels when its window closes; it does not
+reconnect after a session-bus disconnection. Headless UI contexts use their supplied egui input and
+do not contact a desktop session bus. Page and document colours retain their existing behavior.
+
+
 ## Logs
 
 The desktop app writes its `log` records to standard error and to `logs/pdfcraft.log` in its
@@ -58,7 +99,11 @@ panic, as upstream: an error in a later reconfigure (resizing, a lost surface);
 during that first configure (wgpu reports it only to a callback, so the first frame panics, after
 the app has started); and a window shown at zero size, which is first configured on resize. If
 OpenGL can't start either, PdfCraft exits with both errors in the log. The fallback is logged at
-`error`, with the wgpu error. `PDFCRAFT_RENDERER` skips it or chooses OpenGL from the start.
+`error`, with the wgpu error. Renderer resource creation now uses the same scopes and returns
+`WgpuError::CreateRenderer` before the app is created, so a rejected `egui_pipeline` can also
+reach this retry instead of the uncaptured-error panic handler. This does not fix the failing
+driver's shader compilation, and explicit `PDFCRAFT_RENDERER=wgpu` still disables the retry.
+`PDFCRAFT_RENDERER` skips it or chooses OpenGL from the start.
 
 ## Environment variables
 
@@ -67,7 +112,7 @@ OpenGL can't start either, PdfCraft exits with both errors in the log. The fallb
 | `RUST_LOG` | Log levels for standard error and the log file (see [Logs](#logs)) |
 | `RUST_BACKTRACE` | `1` adds a backtrace to the report of an internal error |
 | `XDG_DATA_HOME` | Linux/FreeBSD: base of the settings folder (`pdfcraft/`), the log folder and crash recovery |
-| `WGPU_POWER_PREF` | GPU choice; by default PdfCraft draws on the GPU that drives the primary display (Windows) or the built-in panel (Linux), else the low-power (integrated) GPU. The log says which one was chosen |
+| `WGPU_POWER_PREF` | GPU choice; by default PdfCraft draws on the GPU the Wayland compositor draws with (it says so through linux-dmabuf feedback), else the GPU that drives the primary display (Windows) or the built-in panel (Linux), else the low-power (integrated) GPU. The log says which one was chosen |
 | `WGPU_BACKEND` | Graphics backend; by default Windows uses Direct3D 12, falling back to OpenGL |
 | `PDFCRAFT_RENDERER` | `gl` starts with OpenGL (glow) and never loads wgpu; `wgpu` reports a wgpu failure instead of retrying with OpenGL; unset, wgpu is retried with OpenGL when it can't start (see [Renderer fallback](#renderer-fallback)) |
 | `CRAFT_FONTS_DIR` | Build time: a [craft-fonts](https://github.com/storytold/craft-fonts) checkout to embed (Japanese fonts) |
diff --git a/docs/editing-images.md b/docs/editing-images.md
index 86a01c72..fde18518 100644
--- a/docs/editing-images.md
+++ b/docs/editing-images.md
@@ -3,7 +3,9 @@
 In **Edit a PDF → Edit text and images**, click a figure to select it. Drag the selected
 figure to move it, drag a corner to resize it proportionally, or press Delete to remove
 that placement. The context menu also rotates or flips it. Changes support undo and
-survive saving/reopening.
+survive saving/reopening. An image painted inside its own rectangular clip
+(`q … re W n … cm Do Q`, as PowerPoint exports it) moves and resizes together with that
+clip; a clip shared with other content stays where it is.
 
 PDF figures are not always bitmap images. Imported diagrams often use a **Form XObject**,
 which packages text, vector paths, and nested images into one object. PdfCraft selects
diff --git a/docs/file-format-parity.md b/docs/file-format-parity.md
index 4fc21f59..5871ea97 100644
--- a/docs/file-format-parity.md
+++ b/docs/file-format-parity.md
@@ -1,6 +1,6 @@
 # File format parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first format matrix; Acrobat's formats from its bundle) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (encrypted output opens in Acrobat, #774; XFDF fixes #807, #809, #819) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 Every format Acrobat Pro reads or writes, and PdfCraft's support for it. Acrobat's list comes from
 its bundle's `Info.plist` `CFBundleDocumentTypes` (what it opens) and its public documentation
@@ -22,7 +22,7 @@ features total).
 |---|---|---|---|---|
 | PDF 1.0–1.7, ISO 32000-1 | R W | R W | high for reading and unencrypted writing | 958-file pdf.js corpus open/edit/save; `qpdf --check` on saved outputs; `xtask check` baselines |
 | PDF 2.0 (ISO 32000-2) | R W | R W (2.0-only features ignored but preserved) | good | No UTF-8 strings, `/AF`, DPart, namespaces ([pdf-spec-parity.md](pdf-spec-parity.md)) |
-| Encrypted PDF (standard security R2–R6) | R W | R W | **reading high; writing fails in Acrobat and Reader** | `crates/crypt`, `crates/cos` tests; all 7 corpus encrypted files open; **#774** |
+| Encrypted PDF (standard security R2–R6) | R W | R W | reading high; writing opens in Acrobat DC since #836 (#774; AES-256 and RC4-128 checked by hand, no automated interop suite) | `crates/crypt`, `crates/cos` tests (`the_catalog_of_an_encrypted_document_stays_outside_object_streams`); all 7 corpus encrypted files open |
 | Certificate-encrypted PDF (public-key handler) | R W | none (clear message) | none | `core.unsupported-handlers` |
 | Linearized PDF (Fast Web View) | R W | R (as normal PDF); no W | none for W | `core.linearization` planned |
 | Damaged PDF | R (repair) | R (repair, logged) | high | `core.repair-broken-files`, nightly fuzzing |
@@ -35,7 +35,7 @@ features total).
 
 | Format | Acrobat | PdfCraft | Fidelity | Tests and evidence |
 |---|---|---|---|---|
-| FDF (`.fdf`) comments and form data | R W | R W | good | `crates/xfdf`; bugs #807, #809, #819 in comment exchange |
+| FDF (`.fdf`) comments and form data | R W | R W | good | `crates/xfdf`; comment-exchange fixes for popups, polygon vertices and callouts (#807, #809, #819) |
 | XFDF (`.xfdf`, ISO 19444-1) | R W | R W | good | as above |
 | XML form data | R W | R W | good | `form.data-xml-csv-txt` |
 | XDP (`.xdp`, XFA data package) | R | none | none | Acrobat opens `.xdp` as a document type |
@@ -109,4 +109,5 @@ features total).
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-11 | minor | Encrypted PDF row: written files open in Acrobat DC (#774, fixed by #836). FDF row: #807, #809 and #819 fixed |
 | 2026-10-10 | major | Created from Acrobat 26.002.21931's `CFBundleDocumentTypes`, Acrobat's public Create/Export documentation, and PdfCraft's code and checklist |
diff --git a/docs/gaps.md b/docs/gaps.md
index 262e4c7d..1c4ad963 100644
--- a/docs/gaps.md
+++ b/docs/gaps.md
@@ -1,6 +1,7 @@
 # Where PdfCraft falls short of Acrobat Pro
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** minor (alpha markers removed after the gate was re-judged: no gap blocks alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** patch (gap 2: hayro patch counts after the native-gradient backport) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (gap 1 closed by #836; fixed issues removed from gaps 3, 6 and 16) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 Every known shortfall, one entry each, ranked by what it costs users. This is the work list: agents
 choose from the top unless the owner says otherwise, and prefer these over new P2/P3 checklist
@@ -8,8 +9,9 @@ features. The numbers behind it are in [target-app-parity.md](target-app-parity.
 detail is in `parity/acrobat-features.toml` (`cargo xtask parity --partial` lists what each partial
 feature lacks).
 
-No gap blocks the [alpha gate](roadmap.md#alpha-gate); gaps 1 and 8 hold the convert-and-share
-workflow's partial sub-cases and are the first beta items.
+No gap blocks the [alpha gate](roadmap.md#alpha-gate); gap 8 holds the convert-and-share
+workflow's partial sub-cases and is the first beta item. Gap numbers are kept when a gap closes, so
+references elsewhere stay valid (gap 1, encrypted output Acrobat rejected, closed with #836).
 
 Hours are Opus 5.5 agent wall-clock hours. "Doc" names the parity document the gap belongs to.
 When a gap closes, delete its entry, note it in the [ROADMAP.md](../ROADMAP.md) progress log and
@@ -19,7 +21,6 @@ update the numbers.
 
 | # | Gap | Kind | Hours | Doc |
 |---|---|---|---|---|
-| 1 | Encrypted files we write don't open in Acrobat | file format | 8–15 | [file-format-parity.md](file-format-parity.md) |
 | 2 | Rendering is borrowed and its fidelity unmeasured | feature, spec | 110–190 | [pdf-spec-parity.md](pdf-spec-parity.md) |
 | 3 | Editing existing text is fragile on real files | feature | 100–180 | [target-app-parity.md](target-app-parity.md) |
 | 4 | No printing on the web | feature, platform | 15–30 | [hardware-parity.md](hardware-parity.md) |
@@ -46,28 +47,12 @@ update the numbers.
 
 ## The gaps
 
-### 1. Encrypted files we write don't open in Acrobat
-
-- **Missing:** interoperable encryption output. A document protected with a password in PdfCraft
-  opens in PdfCraft, SumatraPDF, PDF24 and LibreOffice, but Adobe Reader, Acrobat and PDF-XChange
-  report it as damaged.
-- **Evidence:** [#774](https://github.com/storytold/pdfcraft/issues/774) (2026-10-10, confirmed by a
-  second user). Our encryption tests round-trip through our own reader and `qpdf --check`, which
-  is more lenient than Acrobat.
-- **Impact:** blocking. Passwords are the most common reason to touch security; a file a recipient
-  can't open is data loss in practice. Partial sub-case of the convert-and-share gate row (unencrypted sharing works), so not an alpha blocker; the first beta item.
-- **Fix:** find the divergence (likely `/Encrypt` dictionary or R6 `/Perms`/`/OE`/`/UE` details, or
-  a string/stream encrypted that must not be), then add an interop suite that opens every kind of
-  output we write in other readers (pdf.js, MuPDF and Poppler as oracle processes; Acrobat by hand
-  on the owner's Mac).
-- **Estimate:** 8–15 h. **Doc:** [file-format-parity.md](file-format-parity.md).
-
 ### 2. Rendering is borrowed and its fidelity unmeasured
 
 - **Missing:** our own renderer (M2: `model` crate, font engine, DisplayList devices, ADR-0004), or
   an owner decision to adopt another engine; and any measurement of rendering against Acrobat.
-- **Evidence:** pages are drawn by vendored `hayro` 0.7 with 22 local patches to `hayro-interpret`,
-  9 to `hayro`, 3 to `hayro-jbig2` and 13 to `hayro-syntax` (`vendor/README.md`); `lopdf` still
+- **Evidence:** pages are drawn by vendored `hayro` 0.7 with 23 local patches to `hayro-interpret`,
+  10 to `hayro`, 3 to `hayro-jbig2` and 13 to `hayro-syntax` (`vendor/README.md`); `lopdf` still
   backs document inspection. All 7 rendering P0 features are `partial`. User reports: TikZ pattern
   fills drawn wrong ([#794](https://github.com/storytold/pdfcraft/issues/794)), blurry text at
   1080p/1440p ([#730](https://github.com/storytold/pdfcraft/issues/730)), fixed zoom sizes differ
@@ -90,7 +75,8 @@ update the numbers.
   `edit.rtl-cjk-editing`, `edit.rotated-text-editing`, `edit.keep-tags-on-edit`,
   `edit.vector-edit`, `edit.edit-object-tool` are planned. Users:
   [#766](https://github.com/storytold/pdfcraft/issues/766) (editing Arabic text),
-  [#844](https://github.com/storytold/pdfcraft/issues/844) (can't move several elements),
+  [#844](https://github.com/storytold/pdfcraft/issues/844) (several elements now move together on
+  one page, not across pages),
   [#787](https://github.com/storytold/pdfcraft/issues/787) (move images between pages),
   [#791](https://github.com/storytold/pdfcraft/issues/791).
 - **Impact:** "Edit PDF" is one of Acrobat Pro's top reasons to buy. Substituting Helvetica changes
@@ -123,14 +109,12 @@ update the numbers.
 
 ### 6. Open-issue backlog of wrong results in shipped features
 
-- **Missing:** fixes for ≈ 25 filed reports of features marked `shipped` that give wrong results,
+- **Missing:** fixes for the ≈ 13 of ≈ 25 filed reports of features marked `shipped` that give wrong results still open,
   plus triage of ≈ 220 other open issues.
-- **Evidence:** 245 open issues on 2026-10-10, e.g. XFDF exchange loses polygon vertices and turns
-  callouts into text boxes (#809, #819), page deletion leaves null destinations (#817, #821),
-  automatic URL linking panics on Unicode text (#816), autosave skips new unsaved PDFs (#815),
-  saving ignores typing in an open paragraph (#811), automation reports success after replacing an
-  earlier result (#799, #800), Shift-Cmd-G goes forward (#810).
-- **Impact:** every one is a user who lost trust. #816 is a crash, which outranks feature work
+- **Evidence:** 245 open issues on 2026-10-10. The first batch of `fix(...)` reports was fixed by
+  2026-10-10 (#799, #800, #807, #809, #810, #811, #815, #816, #817, #818, #819, #821); the rest of
+  the backlog is untriaged.
+- **Impact:** every one is a user who lost trust. Crash reports outrank feature work
   (`AGENTS.md` §4).
 - **Estimate:** 45–80 h (≈ 0.2–0.4 h per issue). **Doc:** this file.
 
@@ -198,7 +182,9 @@ update the numbers.
 ### 12. No measured fidelity harness against Acrobat
 
 - **Missing:** side-by-side comparison of rendering, text extraction, form calculation and
-  signature validation against Acrobat on synthetic fixtures.
+  signature validation against Acrobat on synthetic fixtures; an interop suite that opens every
+  kind of output we write (encrypted ones above all, after #774) in pdf.js, MuPDF and Poppler as
+  oracle processes.
 - **Evidence:** none exists; only text extraction has an oracle (word-F1 0.98 against `pdftotext`).
   Acrobat captures must stay local in `plan/acrobat/` (clean-room, `AGENTS.md` §1.1).
 - **Impact:** until it exists, every quality number here is a judgement.
@@ -235,10 +221,9 @@ update the numbers.
 
 ### 16. UI precision gaps
 
-- **Missing:** moving several selected objects together (#844), nudging with arrow keys, single-key tool accelerators,
+- **Missing:** moving several selected objects across pages (same-page moves shipped, #844), nudging with arrow keys, single-key tool accelerators,
   rulers, grids and guides, loupe and dynamic zoom, multiple windows and split view, comment
-  pop-ups that can be moved, connector lines, customisable quick tools, column text selection
-  (#740); shortcut display and touchpad scrolling bugs (#746, #759, #721), macOS window controls
+  pop-ups that can be moved, connector lines, customisable quick tools; shortcut display and tool-mode bugs (#746, #721), macOS window controls
   (#789).
 - **Estimate:** 30–60 h. **Doc:** [ui-parity.md](ui-parity.md).
 
@@ -302,6 +287,8 @@ update the numbers.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-11 | patch | Gap 2: 23 hayro-interpret and 10 hayro patches after axial and radial shadings became native gradients (backport of hayro 0.8) |
+| 2026-10-11 | minor | Closed gap 1 (#774, fixed by #836; numbers kept, its interop suite moved to gap 12); gap 6 lists the fixed #799–#821 batch; gap 3 and 16 updated for #844 (same-page move), #740 (column select) and #759 (1:1 touchpad scrolling) |
 | 2026-10-10 | minor | Removed the alpha markers: with the cross-app gate rule, gaps 1 and 8 are partial sub-cases, not blockers; stage alpha |
 | 2026-10-10 | minor | Marked the alpha blockers (gap 1 and the Office part of gap 8) after the core-workflow gate put the stage at pre-alpha |
 | 2026-10-10 | major | Created. Ranked 24 gaps from the 2026-10-10 re-measure, the open GitHub issues and the former ROADMAP.md §Where we're lacking and where we're going (renderer, hardening, fidelity, editing, Pro workflows, 1.0 polish), which this file replaces |
diff --git a/docs/hardware-parity.md b/docs/hardware-parity.md
index 5c74648d..764553ab 100644
--- a/docs/hardware-parity.md
+++ b/docs/hardware-parity.md
@@ -1,6 +1,6 @@
 # Hardware and platform parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (shared print spooler; Windows CI enabled) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (shared craft-print spooler with passing Windows CI; Windows printers row and 1:1 touchpad scrolling, #756, #759) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 Each hardware feature Acrobat Pro uses, per platform, ours against Acrobat's. Acrobat runs on macOS
 and Windows (plus a limited web viewer/editor in Document Cloud); PdfCraft runs on macOS, Windows,
@@ -17,10 +17,10 @@ printing are counted in their feature areas). **Platforms ≈ 70% ready, 15–30
 | Multi-threaded rendering | yes | yes (render pool, tiles, watchdog) | yes | yes | single thread | `view.render-priority` |
 | HiDPI / Retina | yes | yes | yes, per-monitor DPI v2 (#324, #725) | yes | yes | text blurry at 1080p/1440p (#730) |
 | Multiple monitors | yes, multiple windows | one window | one window; surfaces fit the GPU limit (#577) | one window | n/a | `view.multiple-windows` planned |
-| Printers | all, PostScript, printer properties | CUPS via craft-print | Windows PDF raster spooler via craft-print | CUPS via craft-print | **none** | `crates/print/README.md` |
+| Printers | all, PostScript, printer properties | CUPS via craft-print | Windows PDF raster spooler via craft-print (#756, PR #847) | CUPS via craft-print | **none** | `crates/print/README.md` |
 | Scanners (TWAIN, WIA, ICA) | yes | none | none | none (SANE) | n/a | `ocr.scanner-acquire` planned |
 | Smart cards and USB tokens | yes (PKCS #11, CryptoTokenKit, CNG) | Keychain identities (software keys) | CNG store keys, with PIN prompts for cards (#742) | none (PKCS #11 planned) | none | `sign.pkcs11` planned |
-| Pen and touch | Touch mode, pen ink, Windows Ink | trackpad pinch zoom; ink from pointer, no pressure | ink from pointer, no pressure or touch mode | as macOS | pointer | touchpad scrolling not 1:1 (#759) |
+| Pen and touch | Touch mode, pen ink, Windows Ink | trackpad pinch zoom; ink from pointer, no pressure | ink from pointer, no pressure or touch mode | as macOS | pointer | touchpad scrolling 1:1 (#759, PR #868) |
 | Keyboard input methods (IME) | yes | yes; Japanese and Korean IME fixes patched into winit | yes (Microsoft Korean cursor fix) | X11 and Wayland IME fixes | browser | `vendor/README.md` winit patches 2–10 |
 | Screen readers | VoiceOver, NVDA, JAWS | AccessKit labels (partial) | AccessKit (partial) | AccessKit (partial) | partial | `a11y.app-screen-reader` partial |
 | Text to speech (Read Out Loud) | yes | none | none | none | none | `a11y.read-aloud` planned |
@@ -43,3 +43,4 @@ printing are counted in their feature areas). **Platforms ≈ 70% ready, 15–30
 | 2026-10-10 | major | Created from the code, `vendor/README.md`, `.github/workflows/release.yml`, the print crate's README and user issues |
 | 2026-10-10 | minor | Windows printing shipped (#756): the Windows row's gap is closed; the web row keeps "printing" |
 | 2026-10-11 | minor | Shared craft-print spooler; Windows preserves PDF sheet size/orientation and uses corrected duplex binding edges. Physical output remains a hardware check. |
+| 2026-10-11 | minor | The Printers row's Windows cell still said none: now the Windows spooler (#756, PR #847). Touchpad scrolling 1:1 (#759, PR #868) |
diff --git a/docs/localization.md b/docs/localization.md
index 31fec64c..456c0824 100644
--- a/docs/localization.md
+++ b/docs/localization.md
@@ -16,9 +16,11 @@ The value is `auto` or a language code (`en`, `ja`, `zh-hans`, `zh-hant`, `ru`,
 
 Dialogs, panels, menus, notices and history labels go through the catalog (`tl!`). Japanese, Traditional Chinese, Simplified Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese and Arabic translate them (about 2,000–2,140 entries each); Czech covers the menus so far. Untranslated labels use English. Error details that come from the engine or the operating system are shown as they are, inside a translated frame ("操作「…」に失敗しました: …"). The command palette matches the translated label, the English label and the command id. Vertical Japanese PDF rendering is an existing viewer feature; this change does not add vertical text editing. Per-language coverage, script support and what each language still needs are in [localization-parity.md](localization-parity.md).
 
+Whole sentences that the layers below word — what the accessibility checker found, what the PDF/A verifier reports, what a signature's details say, what is wrong with the pages to print, what an edit is called in the history — are translated too, because those layers hand the sentence over apart from the document's own words. See [Sentences the engine words](#sentences-the-engine-words).
+
 The Ukrainian catalog has 2,047 entries, written from the meaning of the English labels using Ukrainian computing vocabulary. Commands use infinitives; fixed-count messages use count-neutral wording. Plural-aware messages use the three [CLDR Ukrainian integer forms](https://www.unicode.org/cldr/charts/48/supplemental/language_plural_rules.html#uk): `1 сторінка`, `2 сторінки`, `5 сторінок`; 11–14 take the third form, while 21 and 22 return to the first and second. Calendar dates use genitive month names (`9 жовтня 2026`), while headings use standalone names (`Жовтень 2026`). Home recommendation cards grow to fit translated text; the toolbar search hint truncates before the shortcut, with the full label available on hover.
 
-Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish, French, Hungarian and Italian need only the bundled Latin faces (tested in `tests/fonts.rs`). Hungarian uses the same one/other plural rule as English: 1 is singular, and every other count — including 0 — is the other form. After a numeral the noun stays singular (`1 oldal`, `2 oldal`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
+Japanese interface text uses BIZ UDPGothic from [craft-fonts](https://github.com/storytold/craft-fonts), an optional build input that every release includes (`CRAFT_FONTS_DIR`; see the README). A build made without it has no Japanese face, so Japanese labels show replacement boxes. Chinese is drawn with the same craft-fonts CJK faces (in Simplified Chinese the `Hans` faces come first, so a line never mixes faces with different baselines), so a character none of them has shows a replacement box (and every Chinese character does in a build without craft-fonts). Until craft-fonts has an allowed `Hans` face, the desktop app draws a Chinese interface with a Chinese face already installed on the machine (Microsoft YaHei or JhengHei on Windows, PingFang, Hiragino Sans GB or STHeiti on macOS, WenQuanYi or Droid Sans Fallback on Linux; never Noto CJK or Source Han), placed before the Japanese faces so a line keeps one face (#826). The web build has no installed fonts to fall back on. Russian, Bulgarian, Czech, Brazilian Portuguese, German, Spanish, French, Hungarian and Italian need only the bundled Latin faces (tested in `tests/fonts.rs`). Hungarian uses the same one/other plural rule as English: 1 is singular, and every other count — including 0 — is the other form. After a numeral the noun stays singular (`1 oldal`, `2 oldal`). Telugu is drawn with a craft-fonts `Telu` face (Noto Sans Telugu, kept in the web build too), whose conjuncts egui shapes; a build without one shows Telugu labels as replacement boxes, and the release-pinned craft-fonts input has no Telugu face yet.
 
 The Brazilian Portuguese catalog has 2,000 entries: the ~1,826-entry gist André Cardoso posted in [#288](https://github.com/storytold/pdfcraft/issues/288), the labels added since, and a review of the existing wording. Portuguese, like French, treats 0 and 1 as singular (`1 página`, `2 páginas`).
 
@@ -37,7 +39,7 @@ What Arabic does not have yet:
 
 These need bidirectional support in the text layout itself, not in the catalog.
 
-Arabic glyphs come from the craft-fonts `Arab` face (Noto Sans Arabic, kept in the web build too). A build without craft-fonts shows Arabic as replacement boxes on the web; on desktop it falls back to one installed font (below). The craft-fonts revision pinned for CI and releases (`.github/workflows/`) has the Arabic face. That revision also holds Noto Sans CJK SC, which `crates/fonts/build.rs` never embeds: `AGENTS.md` §1.1 bars it, so Chinese still has no face of its own.
+Arabic glyphs come from the craft-fonts `Arab` face (Noto Sans Arabic, kept in the web build too). A build without craft-fonts shows Arabic as replacement boxes on the web; on desktop it falls back to one installed font (below). The craft-fonts revision pinned for CI and releases (`.github/workflows/`) has the Arabic face. That revision also holds Noto Sans CJK SC, which `crates/fonts/build.rs` never embeds: `AGENTS.md` §1.1 bars it, so Chinese still has no embedded face of its own (desktop builds fall back to an installed Chinese face, above).
 
 File names and document titles in Arabic or Hebrew are drawn with a craft-fonts `Arab` face when the build input has one; on desktop, a character no embedded face has is drawn with one font already installed on the machine (`PDFCRAFT_SYSTEM_FONTS=0` turns this off). The tab strip, the recent-files list and Properties show such names in display order; other places (bookmarks, comments, search results) have the glyphs but may order mixed-direction text wrongly.
 
@@ -56,6 +58,18 @@ PdfCraft uses the same system as PhotoCraft (`crates/ui-egui/src/i18n/`):
 - Catalogs are assets: each `.tsv` has an `ATTRIBUTION.toml` entry with `kind = "translation"` and its SHA-256, checked by `cargo xtask assets`.
 - Translations are clean-room: write them from the meaning of the English text, never from another product's string tables.
 
+## Sentences the engine words
+
+Some sentences are not the interface's own. The accessibility checker, the PDF/A verifier, the signature reader, the page-range parser and the edit history all word their own findings, and matching that wording in the UI with a `tl!` literal would break silently whenever the engine changed it. So those layers hand the wording over instead, apart from the document's own words:
+
+- Each of them has a `WORDINGS` constant listing every sentence it can say, as `&'static str` with holes in it (`{n}`, `{p}`, `{}`). The sentence is written once, in the layer that means it.
+- `said(&words)` says one of them: the layer looks its own wording up through the closure it is given, then fills the holes with the document's values — a page number, a font name, what the person typed — in one pass, so a value containing `{n}` is inserted as written.
+- The UI passes `&crate::i18n::words`, which is a catalog lookup, so the sentence reads in the interface language. `in_english` is the same thing in English, and a wording with no entry comes back as it stands, which is the English — a catalog missing one shows an English sentence rather than a gap.
+- The lists are `a11y::{WORDINGS, REPORT_WORDS}`, `preflight::WORDINGS`, `sign::pdf::{WORDINGS, kind::ALL}`, `print::WORDINGS` and the engine's `{EDIT_LABELS, BATCH_LABELS}`. `a11y::report_html` takes a language tag and a `words` closure, so a saved report reads the way the panel read, down to its `lang` attribute.
+- `spanish_covers_what_the_engine_says` requires an entry for every wording in those lists, and `spanish_keeps_the_holes_in_what_the_engine_says` requires each translation to keep the same holes, so the catalog cannot fall behind the engine without a test saying so. Other languages are free to add the entries when they are translated; until then those sentences show in English as before.
+
+Error details that come from the operating system, and faults rather than mistakes (a file that cannot be read, a lock that was poisoned), still carry their own text and are shown as they are.
+
 ## Adding a language
 
 1. Copy the header of `ja.tsv` into `xx.tsv` and translate entries.
diff --git a/docs/mcp.md b/docs/mcp.md
index 5465c5b9..830a6c31 100644
--- a/docs/mcp.md
+++ b/docs/mcp.md
@@ -4,6 +4,10 @@ Start explicitly with `pdfcraft-cli mcp [--root DIR] [--compact]`. The server us
 stdin/stdout, opens no port, and stops on EOF. `--root` confines all reads and writes, including
 commands invoked through the common tools. Logs stay on stderr.
 
+Supply `--root` at most once, followed by a nonempty directory path. Missing operands,
+repeated roots and another long option in place of the directory are refused before any
+script is read or server is started. Prefix a directory name beginning with `--` with `./`.
+
 | Tool | Arguments |
 |---|---|
 | `command_list` | `doc?`, `filter?`, `enabled_only?`; returns `{commands: [...]}` with mapped tool schemas |
diff --git a/docs/pdf-spec-parity.md b/docs/pdf-spec-parity.md
index 6c74039f..4f833aeb 100644
--- a/docs/pdf-spec-parity.md
+++ b/docs/pdf-spec-parity.md
@@ -1,6 +1,6 @@
 # PDF specification and standards parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first spec-coverage checklist) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (§7.6.4: written encrypted files open in Acrobat, #774) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How much of ISO 32000-2 (PDF 2.0) and the PDF subset standards PdfCraft implements, set against
 what Acrobat Pro implements. This is PdfCraft's equivalent of a "geometry" or "codec" checklist:
@@ -23,7 +23,7 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 | §7.4 | Stream filters: Flate, LZW, ASCII85, ASCIIHex, RunLength, predictors | full | **own** | `crates/filters` |
 | §7.4 | Image filters: DCT, JPX, JBIG2, CCITTFax | full | **borrowed** (decode only) | `core.image-filters` partial; own codecs M1.1/M1.2; no JBIG2/CCITT encoding (Optimizer) |
 | §7.5.8 | Linearization | R W | R only | `core.linearization` planned |
-| §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; **written files rejected by Acrobat (#774)** |
+| §7.6.4 | Standard security handler R2–R6 (RC4 40/128, AES-128, AES-256), crypt filters, `/EncryptMetadata`, SASLprep | full | **own**, read and write | `crates/crypt`; written files open in Acrobat DC since #836 (#774: Acrobat needs the catalog outside object streams) |
 | §7.6.5 | Public-key security handler | full | none | `core.open-public-key`, `protect.certificate-encryption` planned |
 | §7.6.2 | Unencrypted signature `/Contents` | yes | yes | signing encrypted documents (#753) |
 | §7.9.2 | Text strings incl. PDF 2.0 UTF-8 | full | PDFDocEncoding and UTF-16; UTF-8 none | `core.pdf20-utf8-strings` planned |
@@ -129,4 +129,5 @@ are borrowed; PDF 2.0 additions and most subset standards are missing. **150–2
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-11 | minor | §7.6.4: encrypted files we write open in Acrobat (#774, fixed by #836) |
 | 2026-10-10 | major | Created from the code, `vendor/README.md` and `parity/acrobat-features.toml`, against ISO 32000-2 and Acrobat Pro 26.002.21931's documented capabilities |
diff --git a/docs/roadmap.md b/docs/roadmap.md
index aed24a3d..fc8cf785 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -1,6 +1,12 @@
 # PdfCraft roadmap: milestones and what's next
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** minor (localized shortcut labels, #496; alpha gate added; convert-and-share re-judged with the cross-app rule → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (architectural paper controls from #599; M6: respect existing form-font encodings; retain source fonts on appearance fallback; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (direct Organize overview and page actions; localized shortcut labels, #496; alpha gate added; convert-and-share re-judged with the cross-app rule → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (closed issues synced: #774, #756, #817–#821, #809, #819, #816, #844; earlier: localized shortcut labels, #496; alpha gate added; convert-and-share re-judged with the cross-app rule → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (M6: respect existing form-font encodings; retain source fonts on appearance fallback; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (M6: keep accepted form values when Tab reopens the same field before Save; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (M13: reject malformed CLI --root options before dispatch; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (Traditional Chinese accessibility semantics and Taiwan form/table terminology; estimates unchanged) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 Forward-looking: the milestones, the current focus and what comes next. The parity numbers behind
 it are in [target-app-parity.md](target-app-parity.md), the ranked work list in [gaps.md](gaps.md),
@@ -22,14 +28,14 @@ exchange with Acrobat users or a missing sub-case is `partial, not blocking` (a
 | Core workflow | Works end to end? | Evidence | Hours to pass |
 |---|---|---|---|
 | View, search and print | yes | Render, find, select, panels, tiles; 500-page scrolling test; Print with CUPS on macOS/Linux and the Windows spooler (web printing missing, a beta item). Rendering borrowed from `hayro` | 0 |
-| Organize, combine and split pages | yes | `organize.*` P0s shipped with tests; links, fields, layers and bookmarks carried over; open fixes #817, #821 are edge cases | 0 |
-| Comment and review | yes | Every markup type with appearances, replies, status, XFDF/FDF; comments saved in the PDF reopen in other readers. XFDF fidelity bugs #809, #819 | 0 |
+| Organize, combine and split pages | yes | `organize.*` P0s shipped with tests; links, fields, layers and bookmarks carried over; page deletion drops dangling destinations and the opening action (#817, #821) | 0 |
+| Comment and review | yes | Every markup type with appearances, replies, status, XFDF/FDF; comments saved in the PDF reopen in other readers; XFDF keeps polygon vertices and callouts (#809, #819) | 0 |
 | Fill and sign forms | yes | All AcroForm field types, Acrobat's AF functions, Fill & Sign, PAdES signatures validated with `pdfsig`/OpenSSL | 0 |
-| Edit text and images | partial, not blocking | Editing a paragraph of Latin text works (embedded font reused, else Helvetica substituted, rewrapped); added text and images stay editable. Fails for CJK/RTL (#766), can't move several objects (#844); a beta item (gap 3) | 0 (beta: 100–180) |
-| Convert and share (Office ↔ PDF, password protection) | partial, not blocking | Unencrypted PDFs we save open in Acrobat and other readers (958-file corpus round trip, `qpdf --check`); export to Word, RTF, HTML, text and images works, lossily (#773: an invoice's layout lost in Word); Create PDF works from images, text, the clipboard and many files at once. Missing sub-cases: password-protected output that Acrobat and Reader accept (#774; the file opens in PdfCraft, SumatraPDF, PDF24 and LibreOffice), an in-app Create PDF from Office (Office on macOS saves PDF itself), Excel/PowerPoint export. All beta items (gaps 1, 8) | 0 (beta: 40–70 for #774, Office→PDF and a layout-keeping Word export) |
+| Edit text and images | partial, not blocking | Editing a paragraph of Latin text works (embedded font reused, else Helvetica substituted, rewrapped); added text and images stay editable. Several objects on one page move together (#844), not across pages. Fails for CJK/RTL (#766); a beta item (gap 3) | 0 (beta: 100–180) |
+| Convert and share (Office ↔ PDF, password protection) | partial, not blocking | PDFs we save open in Acrobat and other readers (958-file corpus round trip, `qpdf --check`), password-protected ones too since #836 (#774: Acrobat DC opens AES-256 and RC4-128 output); export to Word, RTF, HTML, text and images works, lossily (#773: an invoice's layout lost in Word); Create PDF works from images, text, the clipboard and many files at once. Missing sub-cases: an in-app Create PDF from Office (Office on macOS saves PDF itself), Excel/PowerPoint export. Beta items (gap 8) | 0 (beta: 32–55 for Office→PDF and a layout-keeping Word export) |
 
 **Result: alpha.** Every core workflow can be completed on macOS; two are lossy or missing sub-cases
-(editing CJK/RTL text; encrypted output for Acrobat users, Office→PDF, Word layout), which are the
+(editing CJK/RTL text; Office→PDF, Word layout), which are the
 first beta items. Ready for real work, ≈ 49%, is inside the alpha band. (A first application of the
 gate the same day judged convert and share as blocking and put PdfCraft at pre-alpha; re-judged with
 the shared rule, encryption and Office→PDF are sub-cases and Word export is lossy, not absent.)
@@ -38,10 +44,10 @@ the shared rule, encryption and Office→PDF are sub-cases and Word export is lo
 
 In order. Each item names its entry in [gaps.md](gaps.md).
 
-1. **Convert and share:** encrypted output that Acrobat opens (gap 1, #774, small and the most
-   damaging), then Create PDF from Office and a Word export that keeps layout (gap 8, #773).
-2. **Fix the crash and wrong-result reports** filed against shipped features (gap 6), starting with
-   the panic in #816.
+1. **Convert and share:** Create PDF from Office and a Word export that keeps layout (gap 8, #773).
+   Encrypted output that Acrobat opens shipped with #836 (#774).
+2. **Fix the crash and wrong-result reports** filed against shipped features (gap 6). The first
+   batch (#799–#821, including the panic in #816) is fixed.
 3. **A Chinese UI face in releases** (gap 5, #826).
 4. **A fidelity harness against Acrobat, then the renderer decision** (gaps 12 and 2). Owner
    decision needed: our own M2 devices, or #841's proposal as the bridge.
@@ -67,26 +73,33 @@ total matches the parity estimate.
 | M0 | Skeleton: workspace, xtask gates, CI | 15–30 | 98% | 1–2 | GitHub workflow, `deny.toml` (licence audit of every dependency), parity checklist (826 features, `xtask parity`) done. Missing: remaining crate stubs, testkit/oracle crates |
 | M1 | COS: filters, crypt, parser, xref, writer | 120–200 | 80% | 20–40 | Done:<br>- filters and crypt: every standard-security revision R2–R6 (RC4, AES-128/256), SASLprep, permissions, creating encryption;<br>- cos: parse and repair (including invalid xref object-number ranges), decoded-stream limits including unfiltered data, decrypt on load, re-encrypt on save, incremental and full writing.<br>Corpus: open/edit/save passes on 958 files, and all 7 password-protected files open.<br>Full saves now pack objects into compressed object streams. Fuzzing runs nightly (`xtask fuzz`). Missing: ≥ 250 tests, own image codecs |
 | M2 | Model, render, text | 200–350 | 15% | 130–230 | hayro bootstrap renderer (vendored patches); inspector predictor scratch is bounded by available input, and JPX sample rescaling handles 1–32 bits safely. Text extraction reaches word-F1 0.98 against pdftotext. Missing: model crate, fonts, DisplayList, renderer independent of hayro. Inspector page-label traversal and output are resource-bounded, with physical-number fallback warnings |
-| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; late browser startup downloads preserve the current document and Save target (#171). |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). |
+| M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Organize opens directly into the page overview, with checkbox selection and per-page rotate/delete controls; Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web |
+| M3 | Viewer app (native + web) | 80–150 | 90% | 10–20 | Acrobat-style shell, find, select, panels, tiles, web build, UI control channel for agents (opt-in). Missing: 60 fps test on a 500-page document, snapshot tests of every panel<br>Done since: fit visible, document title in the window; Linux middle-button scrolling; shared three-state theme preferences in the toolbar, View menu and control channel; numeric Linux portal events and idle wakeups completing #881, with native appearance inheritance retained (#446); late browser startup downloads preserve the current document and Save target (#171). Renderer-creation errors return to the existing OpenGL startup fallback; a real-GPU regression covers errors and device reuse. The underlying x86 DX12 shader compiler failure remains unresolved; see `windows-renderer-startup.md`. |
 | M4 | Engine, history, save, organize | 100–180 | 95% | 8–15 | Done:<br>- command registry (menus, shortcuts and palette all use it);<br>- undo/redo; incremental, atomic and encrypted saves;<br>- autosave and crash recovery;<br>- organize, combine, extract, split and insert-from-file, with identical fonts and images stored once;<br>- CLI `edit/combine/extract/split`.<br>Done since: Combine files in its own tab (sortable, resizable columns; folders; early warnings; unlocking protected files), bookmark editing, page labels (Number pages), CLI `run`, Set Page Boxes, Crop tool, Duplicate pages, Ctrl+A / Cmd+A to select all pages in Organize, Replace pages, bookmarks from tagged headings. Missing: page transitions, recovery on the web |
 | M5 | Comments (all annotation types, XFDF) | 120–200 | 88% | 12–25 | Done: notes, highlight/underline/strikeout/squiggly, text boxes, ink, lines, arrows, rectangles, ovals, stamps (dynamic, Sign Here, Standard Business), with appearance streams; replies, status, checkmarks, locking, move/resize/restyle/delete; properties dialog; panel filter and sort; hide all; summaries (comments only); XFDF/FDF import and export; flatten; Fill & Sign; agent tools.<br>Done since: polygons, connected lines, clouds, callouts, inserted text, colour and checkmark filters; image signature pointer previews, selection handles and live image movement/resizing with proportional corners and independent edge handles. Missing: custom stamps, replace-text proposals, summary layouts with the page |
 | M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA |
+| M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), watermark print/screen visibility and repeat |
+| M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Existing simple field-font encodings and Differences are respected when generating appearances; an unencodable value uses a separate Helvetica appearance font without changing the source font. Synthetic reopen regressions cover punctuation, subset fallback and multiline text. Exact font metrics/layout and broader Unicode fallback remain incomplete. |
+| M6 | Forms + JavaScript | 160–320 | 50% | 40–75 | Done: filling all field types with regenerated appearances; Prepare a form (every field type, multi-select/shared properties, move/resize/delete, Field Properties General/Appearance/Position/Options/Format/Validate/Calculate); Acrobat's AF format/keystroke/validate/calculate functions and simplified field notation run natively in Acrobat's event order; tab order; push-button actions; flatten; agent tools. Form data exchange (FDF, XFDF, XML, CSV, text) done.<br>Done since: JavaScript engine (boa, sandboxed) running custom keystroke/validate/calculate/format and button scripts, document JavaScripts, console. Missing: Actions tab, wider object model (annotations, layers, dialogs), XFA<br>Done since: Tab and Shift-Tab wrapping to the same field or another widget of that field refresh the newly opened editor from the accepted value before Save. Synthetic UI regressions cover both directions, same-frame Save, validation refusal and undo/redo. |
 | M7 | Content editing (text, images, header/footer, watermark) | 250–500 | 20% | 100–180 | Done: header & footer, watermarks, backgrounds, Bates; added text and images that stay editable (move, resize, format, rotate, flip, crop, replace); links (Link tool, Link Properties, create from URLs, remove all). Missing: editing existing text and images in place (the longest pole), image/PDF watermarks |
 | M8 | Security + redaction | 100–180 | 68% | 15–30 | Done: opening protected documents, permissions, Protect Using Password, Remove security; redaction (mark text/areas/pages, Search & Redact with patterns, apply removing glyphs, image pixels, vectors, XObject content, annotations and fields, verification, full rewrite on save); Remove hidden information and Sanitize.<br>Done since: redaction codes (U.S. FOIA and Privacy Act sets as overlay text, in Redaction properties and `redact_mark`). Missing: certificate security, custom redaction code sets and pattern locales, DCT re-encoding |
 | M9 | Signatures (PAdES, validation) | 160–280 | 60% | 40–70 | Done: new `sign` crate (DER, X.509, CMS, PKCS #12 on RustCrypto; aws-lc-rs for RSA private keys); PAdES B-B signing (visible, invisible, existing fields, certification with DocMDP); validation with trust store and changes-after-signing classification; self-signed digital IDs; Signatures panel, message bar, sign dialogs; agent tools. Checked with pdfsig and OpenSSL.<br>Done since: macOS Keychain and Windows Current User Personal store signing (software-backed CNG keys), certificate viewer, signed documents protected from rewrites. Missing: timestamps (B-T), LTV (DSS, OCSP, CRL), FieldMDP, smart cards, PKCS #11 |
-| M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; Create PDF from multiple files (PDFs, images and text, edited as pages in the grid). Missing: OCR languages beyond Latin, editable-text OCR output, Office export/import, web printing |
+| M10 | OCR, create, export, print | 200–350 | 33% | 120–215 | Done: create from blank/text/PNG/JPEG/TIFF (multi-page)/GIF/BMP; export PNG/JPEG/TIFF and text; Print (Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, the CUPS and Windows spoolers, print-ready PDF).<br>Done since: embedded/72/custom DPI choices for image imports; export all images; OCR (searchable image for pages, ranges and multiple files); single-sided cut-and-stack imposition with cut marks, through Print and doc_print; architectural/ANSI/large ISO sheet presets, Match page at 100% and PDF-scale preview (#599 follow-up); Create PDF from multiple files (PDFs, images and text, edited as pages in the grid). Missing: OCR languages beyond Latin, editable-text OCR output, Office export/import, web printing |
 | M11 | Optimize, preflight, PDF/A/X/UA, print production | 200–350 | 18% | 80–140 | Done: new `optimize` crate: Reduce File Size and the PDF Optimizer (images measured where drawn, bicubic downsampling, JPEG/ZIP recompression only when smaller, discard objects and user data, Flate clean-up, resource merging, object streams). Missing: fonts and transparency panels, space audit, preflight, PDF/A/X/UA |
 | M12 | Accessibility, compare, measure, search, XFA | 200–380 | 30% | 90–160 | Done: new `a11y` crate with the Accessibility Checker (all 32 rules, report, Fix/Skip/Explain, options dialog and results panel, agent tools).<br>Done since: 2D distance, perimeter and area measurements with persistent viewport calibration, snapping, live information and CSV export. Missing: autotag, Tags/Order/Content panels, Reading Order tool, alt-text workflow, compare, geospatial/3D measurement, search index, XFA |
-| M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
+| M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers<br>Done since: CLI run and MCP reject missing, empty, repeated and option-valued --root arguments before any tool/script execution or MCP initialization. A single-hyphen directory name remains valid; synthetic CLI regressions preserve a would-be overwritten file. |
 | M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese and Arabic (logical-order catalog put into display order; layout not yet mirrored); Czech covers the menus. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation |
+| M13 | Automation (MCP, Action Wizard, CLI) + AI providers | 60–120 | 45% | 25–45 | Done: MCP resources (document info, text, page images); headless tool table (123 tools incl. signing, optimizing, initial view, links, stamps, data exchange, comment review, forms authoring and scripts, redaction, sanitize, print, add content), opt-in MCP server over stdio, CLI `run`/`tools` (closed stdout pipes exit cleanly), UI control channel with drag. Missing: Action Wizard, AI providers |
+| M14 | 1.0 polish: performance, localization, installers | 120–250 | 15% | 80–150 | Done: PhotoCraft's translation system (`i18n/`: TSV catalogs, `tl!`, command-id and plural entries, system-language detection, strict catalog tests); every dialog, panel and notice goes through `tl!`. Catalogs of ≈ 2,000–2,140 entries for Japanese, Simplified and Traditional Chinese, Russian, Bulgarian, German, Spanish, French, Telugu, Hungarian, Ukrainian, Italian, Brazilian Portuguese and Arabic (logical-order catalog put into display order; layout not yet mirrored); Czech covers the menus. Signed and notarized macOS builds, signed Windows installers (x64, x86, ARM64), AppImage, deb, rpm, Flatpak and FreeBSD packages. #307 (bounded large-PDF memory): shared resource indexes and parser metadata, lazy inspection, bounded caches; a 9,156-page file inspects in ≈ 1.8 s at ≈ 500 MiB instead of exceeding 10 GiB. Shortcut display uses localized modifier/key names across menus, toolbar, palette, Help and tooltips (#496). Traditional Chinese accessibility statuses, rule semantics and Taiwan form/table terms have catalog regressions. Missing: a right-to-left layout, a Chinese UI face in releases, Hindi/Indonesian/Korean/Vietnamese, file-backed input and global memory budgets, performance budgets, keyboard-only operation |
 | | **Total** | **2,085–3,840** | **≈ 49% ready** | **≈ 770–1,400** | Area view of the same work: [target-app-parity.md](target-app-parity.md#by-feature-area) |
 
 ## Upcoming milestones, ranked
 
 | Rank | Next milestone | Closes | Estimate (h) |
 |---|---|---|---|
-| 0 | Convert and share: encrypted output opens in Acrobat, Create PDF from Office, Word export keeps layout | gap 1, part of gap 8 | 40–70 |
-| 1 | Backlog and platform: crash and wrong-result reports fixed, Windows printing, Chinese UI face | gaps 4, 5, 6 | 65–120 |
+| 0 | Convert and share: Create PDF from Office, Word export keeps layout | part of gap 8 | 32–55 |
+| 1 | Backlog and platform: crash and wrong-result reports fixed, web printing, Chinese UI face | gaps 4, 5, 6 | 65–120 |
 | 2 | Fidelity harness and renderer decision (M2) | gaps 2, 12 | 110–190 |
 | 3 | Editing existing content (M7) | gap 3 | 100–180 |
 | 4 | Pro conversion: OCR languages and clean-up, Office export/import (M10) | gaps 7, 8 | 95–175 |
@@ -111,7 +124,8 @@ M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and st
 - Real-world signature chains, revocation and tokens.
 - The rendering long tail: Type 3 fonts, broken fonts, shadings, blend modes.
 - Correctness of PDF/A, PDF/X and PDF/UA conversion.
-- Interoperability: files other readers (above all Acrobat) reject, as in #774.
+- Interoperability: files other readers (above all Acrobat) reject, as in #774 (fixed by #836; no
+  automated interop suite yet).
 - OCR and AI quality limited by what openly licensed models exist.
 - CPU rendering performance on the web.
 - Hostile input: every fuzz run so far has found new crashes or hangs.
@@ -121,7 +135,14 @@ M2 (renderer), M7 (content editing), M10 (OCR and Office), M11 (Preflight and st
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-11 | minor | M4: direct Organize overview, checkbox selection and individual page actions. Estimates unchanged. |
+| 2026-10-11 | minor | Synced with closed issues: encrypted output opens in Acrobat (#774, #836), so gap 1 left rank 0 and convert and share (32–55 h, the gap's 8–15 h removed); organize, XFDF and multi-object move fixes (#817, #821, #809, #819, #844); the #816 panic and the #799–#821 batch fixed; rank 1 names web printing (Windows shipped, #756). Stage and readiness numbers not re-measured |
+| 2026-10-11 | minor | M6: respect existing form-font encodings; retain source fonts on appearance fallback. Estimates unchanged. |
+| 2026-10-11 | minor | M6: keep accepted form values when Tab reopens the same field before Save. Estimates unchanged. |
+| 2026-10-11 | minor | M13: reject malformed CLI --root options before dispatch. Estimates unchanged. |
+| 2026-10-11 | minor | M14: Traditional Chinese accessibility statuses, script-rule meaning and Taiwan form/table terminology; added a missing table-row explanation and catalog regressions. Estimates unchanged. |
 | 2026-10-10 | minor | M14: localized shortcut key names (#496), including runtime switching and native layout checks. Estimates unchanged. |
+| 2026-10-10 | minor | M3 records the System appearance completion after #881; estimates unchanged |
 | 2026-10-10 | minor | Re-judged convert and share with the cross-app gate rule (only a workflow that can't be completed at all blocks): partial, not blocking → stage alpha |
 | 2026-10-10 | minor | Added the alpha gate (six core workflows; convert and share fails → pre-alpha, 40–70 h to alpha) and rank 0 in the upcoming milestones |
 | 2026-10-10 | major | Created from ROADMAP.md §Milestones, §Critical path, §Risks and §Where we're lacking. Merged the duplicated M1, M2, M3 and M14 rows, re-measured Done and Remaining, added Current focus and the ranked upcoming milestones |
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 2c46958a..2716fc06 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -1,6 +1,6 @@
 # PdfCraft parity with Adobe Acrobat Pro
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** minor (readiness table with hours per audience; full number restated as the standard's additive weighted sum, 47% → 49%; earlier: second look: cross-cutting double count removed, mainstream-practitioner number added, core-workflow gate applied → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (closed issues synced, scores not re-judged: #774, #756, #740, #759, #799–#821, #825, #844; earlier: readiness table with hours per audience; full number restated as the standard's additive weighted sum, 47% → 49%; earlier: second look: cross-cutting double count removed, mainstream-practitioner number added, core-workflow gate applied → alpha) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 The authoritative assessment of how close PdfCraft is to Acrobat Pro. [ROADMAP.md](../ROADMAP.md)
 summarizes it; [gaps.md](gaps.md) lists every shortfall one by one; the deep-dive checklists are
@@ -33,16 +33,16 @@ Approved Trust List) are out of scope: 23 such features are tracked as `na` in
 | Audience | Ready | Opus 5.5 agent-hours to ≈ 95% | Work that dominates |
 |---|---|---|---|
 | Full Acrobat Pro (ready for real work) | ≈ 49% | ≈ 780–1,400 h (≈ 300–550 h wall clock with 3–5 agents; 60–70% parallelizes) | Own renderer and fidelity harness, editing existing content, OCR and Office conversion, Preflight and PDF/A/X/UA, accessibility tagging, signatures for institutions |
-| Mainstream practitioner | ≈ 55% | ≈ 500–900 h (≈ 200–400 h wall clock; ≈ 60% parallelizes) | Rendering fidelity, editing existing text (CJK, RTL, subsets), conversion (Word layout, Excel, PowerPoint, Office→PDF), OCR languages, Windows printing, the bug backlog |
-| Essentials user | ≈ 66% | ≈ 180–330 h (≈ 90–180 h wall clock; ≈ 50% parallelizes) | Rendering fidelity on everyday files, Windows printing, launch and GPU stability, encrypted output Acrobat opens (#774), simple text fixes, Word export layout, Chinese UI glyphs |
+| Mainstream practitioner | ≈ 55% | ≈ 500–900 h (≈ 200–400 h wall clock; ≈ 60% parallelizes) | Rendering fidelity, editing existing text (CJK, RTL, subsets), conversion (Word layout, Excel, PowerPoint, Office→PDF), OCR languages, the bug backlog |
+| Essentials user | ≈ 66% | ≈ 180–330 h (≈ 90–180 h wall clock; ≈ 50% parallelizes) | Rendering fidelity on everyday files, launch and GPU stability, simple text fixes, Word export layout, Chinese UI glyphs |
 
 Hours are calibrated as in [Effort and calibration](#effort-and-calibration) (≈ 1k kept lines per agent-hour for new features, 3–10× slower for hardening and fidelity). The audiences are nested subsets, so essentials ≤ mainstream ≤ full.
 
 The gap between the numbers is the story of this release: most of what an Acrobat user reaches
 for *exists*, but much of it is shallower than Acrobat's, rendering is still borrowed, quality has
 never been measured side by side with Acrobat, and the first public releases (0.4.0, 0.5.0) drew
-245 open issues in two days, including one that makes our encrypted files unreadable in Acrobat
-([#774](https://github.com/storytold/pdfcraft/issues/774)).
+245 open issues in two days, including one that made our encrypted files unreadable in Acrobat
+([#774](https://github.com/storytold/pdfcraft/issues/774), fixed by #836).
 
 ## How this was measured
 
@@ -127,7 +127,7 @@ workflows, exchange edge cases and everything outside the mainstream slice are e
 |---|---|---|---|
 | Open the PDFs people send and read them (render, zoom, scroll, page through) | 20% | 80% | Repair of damaged files, 958-file corpus; rendering borrowed but broadly right (#794 is a TikZ pattern) |
 | Find, select and copy text | 8% | 85% | Find, options, results list; word-F1 0.98 |
-| Print | 8% | 55% | Good on macOS and Linux; nothing on Windows, where most such users are (#756) |
+| Print | 8% | 55% | Good on macOS and Linux; Windows prints since #847 (#756), not yet re-scored |
 | Highlight, sticky notes, text comments | 12% | 85% | All markup types, replies, properties |
 | Fill in forms | 10% | 85% | Every AcroForm field type, Acrobat's formatting and calculations |
 | Fill & Sign: typed, drawn or image signature | 10% | 85% | Fill & Sign tools; flatten on save |
@@ -136,12 +136,12 @@ workflows, exchange edge cases and everything outside the mainstream slice are e
 | Fix a typo in existing text | 5% | 40% | Latin paragraphs only; font may be substituted |
 | Export to Word or images | 5% | 45% | Images good; Word loses layout (#773) |
 | Reduce file size | 3% | 75% | Reduce File Size, Optimizer |
-| Protect with a password | 3% | 30% | Works in PdfCraft; Acrobat and Reader reject the file (#774) |
+| Protect with a password | 3% | 30% | Works in PdfCraft; Acrobat DC opens the output since #836 (#774), not yet re-scored |
 | Undo, save, autosave | 2% | 90% | Undo after save, atomic saves, crash recovery |
 
 Weighted depth: **≈ 75%**. Discounts an essentials user hits: launch and stability (54 issues about
 installing, launching, GPU and windows; OpenGL fallback) −5 points; discoverability and clarity
-(an Acrobat-like shell with Home and All tools, but tool-mode friction such as #825 and #721) −2;
+(an Acrobat-like shell with Home and All tools, but tool-mode friction such as #721; #825 is fixed) −2;
 opening what people send (Chinese UI glyph boxes #826, CJK documents #758) −2.
 **Essentials user ≈ 66%** (60–70%).
 
@@ -177,13 +177,13 @@ features total and are shown for orientation; the others add to it.
 | Dimension | Ready | Weight | Remaining (h) | Counted | Evidence | Doc |
 |---|---|---|---|---|---|---|
 | Features (14 areas) | ≈ 49% depth; 67% breadth | 40% | 610–1,100 | base | Area table below | this file |
-| UI/UX fidelity | ≈ 55% | 10% | 30–60 | additional | Acrobat-style shell, All tools, Home, command palette; missing single-key accelerators, rulers/guides, multiple windows, popups; user reports #739, #744, #746, #759, #789, #844 | [ui-parity.md](ui-parity.md) |
-| File formats and conversion | ≈ 40% | 12% | 120–220 | within features | PDF read/write strong but encrypted output fails in Acrobat (#774); export Word is layout-poor (#773); no Excel/PowerPoint export, no Office/HTML/PostScript import | [file-format-parity.md](file-format-parity.md) |
+| UI/UX fidelity | ≈ 55% | 10% | 30–60 | additional | Acrobat-style shell, All tools, Home, command palette; missing single-key accelerators, rulers/guides, multiple windows, popups; user reports #739, #744, #746, #789 (#759 and #844 fixed) | [ui-parity.md](ui-parity.md) |
+| File formats and conversion | ≈ 40% | 12% | 120–220 | within features | PDF read/write strong, encrypted output included (#774 fixed); export Word is layout-poor (#773); no Excel/PowerPoint export, no Office/HTML/PostScript import | [file-format-parity.md](file-format-parity.md) |
 | PDF specification and standards | ≈ 60% | 8% | 150–260 | within features | ISO 32000 syntax, encryption, annotations and AcroForm strong; rendering and fonts borrowed from `hayro`; PDF 2.0 extras, linearization, public-key security absent; PDF/A partial, PDF/X/UA none | [pdf-spec-parity.md](pdf-spec-parity.md) |
-| Hardware | ≈ 35% | 4% | 25–50 | additional | Page raster is CPU only (Acrobat has GPU rendering); Windows CNG and macOS Keychain keys sign, no PKCS #11; no scanners; Windows has no printing (#756) | [hardware-parity.md](hardware-parity.md) |
+| Hardware | ≈ 35% | 4% | 25–50 | additional | Page raster is CPU only (Acrobat has GPU rendering); Windows CNG and macOS Keychain keys sign, no PKCS #11; no scanners; no printing on the web (Windows shipped, #756) | [hardware-parity.md](hardware-parity.md) |
 | Localization | ≈ 59% over the 12 key languages | 5% | 35–60 | additional | 15 catalogs, 13 at 94–100%; Chinese UI shows tofu in releases (#826, #688); Arabic not mirrored; no Hindi, Indonesian, Korean, Vietnamese | [localization-parity.md](localization-parity.md) |
 | Performance | ≈ 40% | 6% | 25–45 | additional | 500-page smooth scrolling and large-file memory work (#307) done; no performance budgets (`misc.performance-budgets`), no lazy loading of GB files; blurry text at 1080p/1440p (#730) | [gaps.md](gaps.md) |
-| Stability | ≈ 50% | 8% | 45–80 | additional | Never-crash rules and nightly fuzzing; 245 open issues, many of them `fix(...)` reports of wrong results in shipped features (#799–#821) | [gaps.md](gaps.md) |
+| Stability | ≈ 50% | 8% | 45–80 | additional | Never-crash rules and nightly fuzzing; 245 open issues on 2026-10-10, many of them `fix(...)` reports of wrong results in shipped features (the #799–#821 batch is fixed) | [gaps.md](gaps.md) |
 | Platforms | ≈ 70% | 5% | 15–30 | additional | macOS (signed, notarized), Windows x64/x86/ARM64 (signed), Linux (AppImage, deb, rpm, Flatpak), FreeBSD, web (WASM). Acrobat has no Linux, FreeBSD or full web editor; we lack Windows and web printing, web OCR and web recovery | [hardware-parity.md](hardware-parity.md) |
 | Ecosystem and plug-ins | ≈ 30% | 1% | 10–20 | within features | No plug-in SDK or folder-level JavaScript; Action Wizard partial. Agent automation (CLI, MCP, UI control channel) has no Acrobat equivalent | [gaps.md](gaps.md) |
 | AI features | ≈ 0% (in scope) | 1% | 20–40 | within features | Acrobat's AI Assistant is cloud-only (out of scope). Local, opt-in provider interface (`misc.ai-provider`) not started | [gaps.md](gaps.md) |
@@ -196,15 +196,15 @@ full parity in that area.
 
 | Area | Features | Shipped | Partial | Breadth | Ready | Remaining (h) | What's strong / what's missing |
 |---|---|---|---|---|---|---|---|
-| A Core model and fidelity | 56 | 42 | 2 | 76.8% | 70% | 25–45 | Parser, repair, R2–R6 encryption, incremental and atomic saves, undo, autosave, crash recovery, revisions. Missing: encrypted output that Acrobat opens (#774), lazy loading of GB files, linearization, PDF 2.0 extras, Arlington validation, public-key security, own image codecs |
+| A Core model and fidelity | 56 | 42 | 2 | 76.8% | 70% | 25–45 | Parser, repair, R2–R6 encryption, incremental and atomic saves, undo, autosave, crash recovery, revisions. Encrypted output opens in Acrobat (#774). Missing: lazy loading of GB files, linearization, PDF 2.0 extras, Arlington validation, public-key security, own image codecs |
 | B View and navigation | 92 | 52 | 11 | 62.5% | 55% | 110–190 | Shell, layouts, zoom, find, panels, tiles, web build, 500-page scrolling. **Pages are drawn by the vendored `hayro`** (22 + 9 local patches): all 7 rendering P0s are partial. Missing: own renderer or a decided replacement (#841), multiple windows, split view, rulers/guides, loupe, reflow, search across files |
-| C Content editing | 61 | 29 | 7 | 53.3% | 30% | 100–180 | Edit existing paragraphs (font reused or Helvetica substituted, rewrapped), added text and images stay editable, header/footer, watermarks, backgrounds, Bates, links. Missing: robust editing of real-world text (subset fonts, CJK, RTL #766, rotated), lists, vector/object editing, arrange/align, spell check, multi-select move (#844) |
-| D Organize pages | 76 | 45 | 3 | 61.2% | 70% | 12–25 | Organize grid, insert/extract/replace/split/combine with links, fields, layers and bookmarks carried over; page labels, boxes, bookmarks from structure. Missing: transitions, attachments editing, portfolios, struct-tree merge, field-name conflicts; open fixes #817, #818, #821 |
-| E Comments and review | 65 | 46 | 9 | 77.7% | 70% | 12–25 | Every markup type with appearances, replies, status, filters, stamps (custom, dynamic), XFDF/FDF, summaries, flatten, 2D measuring. Missing: rich-text runs, popup windows, summary layouts with pages, per-type hiding; XFDF fidelity bugs #807, #809, #819 |
+| C Content editing | 61 | 29 | 7 | 53.3% | 30% | 100–180 | Edit existing paragraphs (font reused or Helvetica substituted, rewrapped), added text and images stay editable, header/footer, watermarks, backgrounds, Bates, links. Missing: robust editing of real-world text (subset fonts, CJK, RTL #766, rotated), lists, vector/object editing, arrange/align, spell check, multi-select move across pages (same-page shipped, #844) |
+| D Organize pages | 76 | 45 | 3 | 61.2% | 70% | 12–25 | Organize grid, insert/extract/replace/split/combine with links, fields, layers and bookmarks carried over; page labels, boxes, bookmarks from structure. Missing: transitions, attachments editing, portfolios, struct-tree merge, field-name conflicts (destination and annotation fixes #817, #818, #821 shipped) |
+| E Comments and review | 65 | 46 | 9 | 77.7% | 70% | 12–25 | Every markup type with appearances, replies, status, filters, stamps (custom, dynamic), XFDF/FDF, summaries, flatten, 2D measuring. Missing: rich-text runs, popup windows, summary layouts with pages, per-type hiding (XFDF fidelity fixes #807, #809, #819 shipped) |
 | F Forms and JavaScript | 79 | 58 | 8 | 78.5% | 65% | 40–75 | Fill and author every AcroForm field type, Acrobat's AF functions in Acrobat's event order, sandboxed JavaScript (boa), data exchange, Fill & Sign; XFA static/dynamic layout, FormCalc and XFA data (partial). Missing: wider JavaScript object model, document actions, submit, debugger, barcode fields, XFA flattening and full dynamic fidelity |
 | G Protect, redact, sanitize | 41 | 23 | 2 | 58.5% | 55% | 15–30 | Passwords and permissions, Remove security, redaction that removes glyphs, pixels, vectors, annotations and tags, with verification; word lists, patterns, FOIA/Privacy Act codes; sanitize. Missing: certificate security, pattern locales, custom code sets, partial-word redaction, folder redaction, protected view |
 | H Digital signatures | 45 | 23 | 10 | 62.2% | 45% | 40–70 | PAdES B-B signing and validation (PKCS #12, macOS Keychain, Windows store with PIN prompts), certification, encrypted documents, certificate usage checks; B-T, LTV, OCSP/CRL with caller-supplied evidence. Missing: PKCS #11 and smart cards outside Windows, timestamp-server preferences, online revocation fetching, FieldMDP and field locking, OS trust store, EU Trusted Lists, compare signed version |
-| I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images, MRC compression, scanners |
+| I Scan and OCR | 26 | 5 | 2 | 23.1% | 15% | 40–75 | Searchable image (ocrs, Latin script without accents) on pages, ranges and many files. Missing: every other language (#744 Dutch; accents, CJK, Cyrillic, Arabic), editable-text output, deskew, rotation, despeckle, camera images beyond straightening (found or placed corners): orientation, clean-up, MRC compression, scanners |
 | J Create and export | 34 | 12 | 3 | 39.7% | 25% | 55–100 | Create from images, multipage TIFF, text, clipboard, blank, many files at once; export PNG/JPEG/TIFF, text, RTF; Word and HTML partial. Missing: Office/HTML/web/PostScript to PDF, Excel and PowerPoint export, Word layout fidelity (#773), SVG/XML/EPS/PS/JPEG 2000 export, accessible text |
 | K Optimize and standards | 58 | 15 | 10 | 34.5% | 20% | 65–115 | Reduce File Size and the Optimizer (images, discards, clean-up, space audit); PDF/A-2b/3b verify and convert (partial). Missing: Preflight (profiles, fixups, reports), PDF/A-1/4 and a/u levels, PDF/X, PDF/UA, PDF/E, PDF/VT, transparency flattening, font unembedding, monochrome JBIG2/CCITT |
 | L Print | 39 | 15 | 1 | 39.7% | 35% | 30–55 | Acrobat's sizing, n-up, booklet, poster, comments & forms, preview, print-ready PDF, CUPS on macOS/Linux and the Windows spooler (#756). Missing: **printing on the web**, print as image, PostScript, all print-production tools (output preview, separations, ink manager, printer marks, colour conversion) |
@@ -226,8 +226,8 @@ with evidence when next touched.
 six everyday workflows can be completed end to end on macOS. Under the gate rule shared by all the
 Crafting Apps, a workflow blocks only when a typical user can't complete it at all; lossy exchange
 or a missing sub-case is a beta item. **Converting and sharing** is therefore partial, not
-blocking: unencrypted PDFs we save open everywhere and export to Word, RTF, HTML, text and images
-works, but password-protected output is rejected by Acrobat and Reader (#774), there is no in-app
+blocking: PDFs we save open everywhere, password-protected ones included since #836 (#774), and
+export to Word, RTF, HTML, text and images works, but there is no in-app
 Create PDF from Office, and Word export loses layout (#773). The gate table, with evidence, is in
 [roadmap.md](roadmap.md#alpha-gate). (Earlier the same day this row was judged blocking and the
 stage set to pre-alpha; see the revision history.)
@@ -239,14 +239,14 @@ stage set to pre-alpha; see the revision history.)
 | Comment and review | yes |
 | Fill and sign forms | yes |
 | Edit text and images | partial, not blocking (Latin text with embedded or standard fonts) |
-| Convert and share (Office ↔ PDF, password protection) | partial, not blocking (encryption interop #774, Office→PDF and Word layout #773 are beta items) |
+| Convert and share (Office ↔ PDF, password protection) | partial, not blocking (Office→PDF and Word layout #773 are beta items; encryption interop #774 fixed) |
 
 **To reach beta** (≈ 75% ready, no blocking gap in PDF interchange), ≈ 26 points and
 **≈ 400–700 agent-hours**:
 
 | Beta requirement | Hours |
 |---|---|
-| Encrypted output opens in Acrobat and Reader (#774), with an interop suite that opens our outputs in other readers | 8–15 |
+| An interop suite that opens our outputs in other readers (encrypted output already opens in Acrobat, #774, #836; hours not re-estimated) | 8–15 |
 | Rendering: a fidelity harness against Acrobat captures (local, clean-room) and fixing what it finds; settle the renderer (own M2 devices, or #841's proposal); Chinese UI faces in releases | 80–140 |
 | Editing existing text robust on real files: subset fonts, CJK, RTL, rotated text | 70–120 |
 | Printing on Windows and the web | 15–30 |
@@ -292,6 +292,7 @@ licensed OCR or AI model.
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-11 | minor | Synced with closed issues: encrypted output opens in Acrobat (#774, #836), Windows prints (#756, #847), column select (#740), 1:1 touchpad scrolling (#759), same-page multi-object move (#844), #825 and the #799–#821 fix batch. Text only: scores, readiness and hours not re-judged |
 | 2026-10-10 | minor | Readiness table: hours to ≈ 95% per audience (full 780–1,400, mainstream 500–900, essentials 180–330). Full number restated as the standard's additive weighted sum over dimensions with written weights: 47% → 49%. Method aligned with the standard, no new evidence |
 | 2026-10-10 | minor | Added the essentials-user score (≈ 66%): weighted depth of 13 everyday features, discounted for launch, discoverability and opening others' files |
 | 2026-10-10 | minor | Consistency check across apps: re-judged the convert-and-share gate row with the shared rule (blocking only when the workflow can't be completed at all; lossy exchange and missing sub-cases are beta items). Encrypted output (#774) and Office→PDF are sub-cases, Word export is lossy not absent → partial, not blocking; stage pre-alpha → **alpha**. Numbers unchanged |
diff --git a/docs/ui-parity.md b/docs/ui-parity.md
index 403f490d..a7bac6fd 100644
--- a/docs/ui-parity.md
+++ b/docs/ui-parity.md
@@ -1,6 +1,6 @@
 # UI and interaction parity
 
-> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-10 · **Change:** major (first UI/UX checklist) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
+> **Last reviewed:** 2026-10-10 · **Last updated:** 2026-10-11 · **Change:** minor (column select #740, multi-object move #844, Shift-⌘-G #810 fixed) · **Target:** Adobe Acrobat Pro (Acrobat DC, continuous track 26.002.21931, macOS)
 
 How PdfCraft's tools, panels, shortcuts and feel compare with Acrobat Pro's current interface (the
 2023+ "new Acrobat": All tools pane on the left, quick-action toolbar, Home view). Behaviour is
@@ -45,8 +45,8 @@ No dump of Acrobat's menu tree has been diffed against the registry yet (gap 24)
 | Fixed zoom percentages match Acrobat's physical size | yes | differ (#739, documented in #736) | gap |
 | Dynamic zoom, loupe, pan-and-zoom window | yes | no | planned |
 | Hand tool, middle-button pan, autoscroll | yes | hand tool; Linux autoscroll | partial |
-| Text selection, column select | yes, Alt-drag columns | reading-order selection; no column mode (#740) | partial |
-| Select and move several objects at once | yes | no (#844) | gap |
+| Text selection, column select | yes, Alt-drag columns | reading-order selection; Alt/Option-drag or Edit ▸ Column select (#740) | shipped |
+| Select and move several objects at once | yes | on one page: Shift/Ctrl/⌘-click and marquee, one undo step (#844); not across pages, no group resize | partial |
 | Object handles: corners keep proportion, edges free | yes | yes for added images and signatures | shipped |
 | Arrange, align and distribute page objects | yes | fields only | partial |
 | Rulers, grids, snap to grid, guides | yes | no | planned |
@@ -65,7 +65,7 @@ No dump of Acrobat's menu tree has been diffed against the registry yet (gap 24)
 | Platform shortcuts for registered commands | yes | yes; ⌘ on macOS, Ctrl elsewhere (#695) | shipped; find bar still shows ⌘ on Windows (#746) |
 | Keyboard shortcuts reference | yes | yes | shipped |
 | Full keyboard operation of the app | yes | no | planned (`a11y.keyboard-only`, P0) |
-| Shift-⌘-G finds previous | yes | goes forward (#810) | bug |
+| Shift-⌘-G finds previous | yes | yes (#810 fixed) | shipped |
 
 ## Dialogs and preferences
 
@@ -81,4 +81,5 @@ No dump of Acrobat's menu tree has been diffed against the registry yet (gap 24)
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-11 | minor | Column select shipped (#740, PR #765); several objects move together on one page (#844, PR #907); Shift-⌘-G goes back (#810, PR #835) |
 | 2026-10-10 | major | Created from the command registry, automation tools, the View area of the checklist and open UI issues |
diff --git a/docs/windows-renderer-startup.md b/docs/windows-renderer-startup.md
new file mode 100644
index 00000000..db20cfa6
--- /dev/null
+++ b/docs/windows-renderer-startup.md
@@ -0,0 +1,89 @@
+# Windows renderer startup errors and the OpenGL fallback
+
+## Reproduced failure
+
+On one Windows 11 Pro build 26200 host, the official PdfCraft 0.6.0 x86 installation and
+portable EXE both exited with code 101 before displaying a usable window. Their EXE SHA-256
+matched: `3a3a9ba75ec9f8ecc25863e9138fac57e17f359a5de5add486efedd83e0fcf8f`.
+The host has an NVIDIA GeForce RTX 3050 Laptop GPU, driver `32.0.16.1088`, and an AMD iGPU.
+
+Launch the official x86 EXE with `PDFCRAFT_RENDERER` and `WGPU_BACKEND` unset on that host:
+
+```text
+drawing on NVIDIA GeForce RTX 3050 Laptop GPU (DiscreteGpu, Dx12)
+Shader translation error for stage ShaderStages(VERTEX | FRAGMENT): 参数错误。 (0x80070057)
+Handling wgpu errors as fatal by default
+wgpu error: Validation Error
+Caused by:
+  In Device::create_render_pipeline, label = 'egui_pipeline'
+    Internal error in ShaderStages(VERTEX | FRAGMENT) shader: 参数错误。 (0x80070057)
+```
+
+The process reaches GPU initialization and then panics. A GUI-subsystem EXE has no console
+to display this message during a desktop double-click. The official x64 0.6.0 EXE selected
+the same NVIDIA/DX12 adapter and displayed a synthetic two-page PDF. This is a single-host
+comparison; it does not establish a defect in all x86 builds or in a particular driver.
+Issue #326 describes a similar symptom without enough diagnostics to establish the same cause.
+
+## Error propagation
+
+There are two layers: DX12 shader compilation fails, then an unscoped error in `Renderer::new`
+reaches wgpu's default fatal handler. The latter prevents the existing OpenGL startup fallback
+from running: it needs an `eframe::Error::Wgpu`, not a panic.
+
+`RenderState::create` reuses the existing `winit::catch_errors` around renderer creation and
+returns `WgpuError::CreateRenderer`. Auto startup can then retry with Glow before the app is
+created. Explicit renderer choices retain their meaning; the non-winit constructor is unchanged.
+This recovers from initialization failure; it does not repair DX12 shader compilation.
+
+## Regression and actual-use validation
+
+`pipeline_creation_error_is_returned_and_device_remains_usable` invokes the real constructor
+on a real device with sample counts `[3, 1, 3, 1]`. Three is invalid; each error must return,
+and each subsequent valid initialization must succeed. The unguarded constructor panicked
+with code 101. This deterministic validation error tests propagation and device reuse,
+not the underlying host-specific shader compiler defect.
+
+```powershell
+$env:PDFCRAFT_TEST_REQUIRE_GPU = '1'
+$env:WGPU_BACKEND = 'vulkan'
+cargo test --locked -p pdfcraft pipeline_creation_error_is_returned_and_device_remains_usable -- --nocapture
+```
+
+An ordinary run reports an unavailable GPU branch as skipped. `PDFCRAFT_TEST_REQUIRE_GPU`
+makes that condition fail. Run actual startup acceptance separately with both renderer
+variables unset, so the compatibility setting cannot hide the original failure.
+
+The prior local 0.6.0 integration was exercised as a native x86 GUI EXE on the affected host.
+It still recorded `0x80070057`, then `Starting with OpenGL instead` and `renderer: OpenGL (glow)`.
+The UI and synthetic PDF contents displayed. A filename containing Chinese, spaces, `&`,
+parentheses and `#`, page changes, 150% zoom, repeated opens and a nonexistent-file error
+were exercised. The modified x64 app still used DX12 and displayed the PDF. After installing
+the tested EXE and removing the forced-GL user setting, the user confirmed the original
+desktop shortcut and two ordinary PDF double-clicks worked. That local integration also
+included the separately credited Chinese font fix from #426; font changes are outside this PR.
+
+The startup-only contribution was then applied to main at
+`bbbe60015c571ebfc39708ee07777b89e267122a` and rebuilt as a native x86 GUI EXE (PE `0x014c`,
+subsystem `2`). With both renderer variables unset it reproduced the same DX12 error, returned
+it, started OpenGL, and displayed the synthetic PDF. Page 2, 150% zoom, another file open and a
+nonexistent-file error were exercised without page errors or losing the open documents.
+This second run does not include the Chinese product fix and is not counted as font acceptance.
+
+On this contribution branch, workspace tests reported 2,132 passed and 7 declared ignored.
+The required-adapter GPU regression, fmt, all-target workspace Clippy with warnings denied,
+assets, layering (34 crates) and WASM compilation (30 crates) passed. Browser runtime was
+not tested. Initial shared-cache checks hit an existing JBIG2 timeout and an outdated WASM
+shading interface; rebuilding differing vendored dependencies cleared both without decoder
+or shading code changes. Keep build directories separate between historical worktrees.
+
+## Independent Windows test-fixture correction
+
+The `hostile_args` fixture now records whether its planted symbolic link was created. This
+non-elevated host returned OS error 1314; the old test nevertheless tried the nonexistent
+link and reported false confinement leaks. The link path is tested only when the fixture
+exists, and creation failure is explicitly reported. All other traversal and absolute-path
+attempts remain. A skipped link case is not evidence that symbolic-link confinement passed.
+
+No system fonts, screenshots, private PDFs, control tokens or application binaries are included.
+Other GPU drivers and non-Windows runtime behavior remain unverified.
diff --git a/packaging/linux/ai.storyteller.pdfcraft.desktop b/packaging/linux/ai.storyteller.pdfcraft.desktop
index f7928d62..1e091ba0 100644
--- a/packaging/linux/ai.storyteller.pdfcraft.desktop
+++ b/packaging/linux/ai.storyteller.pdfcraft.desktop
@@ -8,7 +8,7 @@ TryExec=pdfcraft
 Icon=ai.storyteller.pdfcraft
 Terminal=false
 StartupNotify=true
-StartupWMClass=pdfcraft
+StartupWMClass=ai.storyteller.pdfcraft
 Categories=Office;Viewer;
 Keywords=pdf;viewer;editor;annotate;sign;forms;merge;split;
 MimeType=application/pdf;
diff --git a/packaging/macos/Info.plist.in b/packaging/macos/Info.plist.in
index fad9c97e..cfc7d2d0 100644
--- a/packaging/macos/Info.plist.in
+++ b/packaging/macos/Info.plist.in
@@ -59,6 +59,8 @@
       <string>Editor</string>
       <key>LSHandlerRank</key>
       <string>Alternate</string>
+      <key>CFBundleTypeIconFile</key>
+      <string>PdfCraft</string>
       <key>LSItemContentTypes</key>
       <array><string>com.adobe.pdf</string></array>
       <key>CFBundleTypeExtensions</key>
diff --git a/parity/acrobat-features.toml b/parity/acrobat-features.toml
index 62590cbe..dcdb569b 100644
--- a/parity/acrobat-features.toml
+++ b/parity/acrobat-features.toml
@@ -188,10 +188,10 @@ area = "A"
 tier = "P0"
 milestone = "M1"
 status = "shipped"
-commands = []
+commands = ["protect.unlock"]
 tools = ["doc_open"]
-evidence = ["crates/engine/src/tests.rs::restricted_documents_refuse_changes_unless_opened_by_the_owner", "crates/engine/src/tests.rs::owner_password_of_older_revisions_opens_the_viewer_too", "crates/crypt/src/tests.rs::owner_authentication_recovers_the_user_password"]
-notes = ""
+evidence = ["crates/engine/src/tests.rs::restricted_documents_refuse_changes_unless_opened_by_the_owner", "crates/engine/src/tests.rs::owner_password_of_older_revisions_opens_the_viewer_too", "crates/crypt/src/tests.rs::owner_authentication_recovers_the_user_password", "crates/engine/src/tests.rs::the_permissions_password_unlocks_an_open_document", "crates/ui-egui/tests/editing.rs::the_security_notice_unlocks_with_the_permissions_password", "crates/ui-egui/tests/editing.rs::remove_security_asks_for_the_permissions_password_first"]
+notes = "at open (the password prompt takes either password), or after opening a restricted file that needed no password (#995, #1077): Unlock… on the security notice and in Properties ▸ Security, and changing security asks for it first. Not yet: an automation tool to unlock an open document (reopen with doc_open and the password instead)"
 
 [[feature]]
 id = "core.permissions-enforced"
@@ -625,6 +625,18 @@ tools = []
 evidence = ["crates/ui-egui/tests/viewer.rs::revert_after_confirming", "crates/engine/src/tests.rs::revert_goes_back_to_the_saved_version"]
 notes = "with confirmation; clears undo, as Acrobat"
 
+[[feature]]
+id = "core.reload-changed-files"
+title = "Reload a document when its file changes on disk"
+area = "A"
+tier = "P2"
+milestone = "M4"
+status = "shipped"
+commands = []
+tools = []
+evidence = ["crates/engine/src/tests.rs::reload_reads_the_new_file_into_the_same_document", "crates/ui-egui/tests/reload.rs::a_rebuilt_file_reloads_in_place_keeping_the_page_and_zoom", "crates/ui-egui/tests/reload.rs::a_half_written_file_waits_until_the_pdf_is_whole", "crates/ui-egui/tests/reload.rs::saving_does_not_reload_or_lose_undo", "crates/ui-egui/tests/reload.rs::unsaved_changes_are_kept_until_reload_is_chosen", "crates/ui-egui/tests/reload.rs::a_deleted_file_leaves_the_document_open", "crates/ui-egui/tests/reload.rs::nothing_reloads_with_the_preference_off", "crates/ui-egui/tests/reload.rs::a_shorter_new_version_drops_what_pointed_into_the_old_one"]
+notes = "Desktop, on by default (Preferences ▸ Documents and view, #431), for LaTeX/Typst builds: a worker thread checks each open file's metadata every 250 ms and reads a change once it has settled and ends in %%EOF; a clean document reloads in place (same tab, page, zoom, scroll; old page images stay until new ones are drawn), one with unsaved changes gets a Reload notice; PdfCraft's own saves never reload. Measured on Windows: one check 11 µs per file, reload of a 417-page 0.9 MB pdflatex file 16 ms. Not yet: OS change notifications (polling adds up to 250 ms), the web build; a reload clears undo history, like Revert."
+
 [[feature]]
 id = "core.signed-save-policy"
 title = "Force incremental saves for signed documents"
@@ -828,7 +840,7 @@ area = "B"
 tier = "P0"
 milestone = "M3"
 status = "shipped"
-commands = ["view.layout.continuous"]
+commands = ["view.continuous"]
 tools = []
 evidence = ["crates/ui-egui/tests/view.rs::continuous_layout_stacks_pages_vertically", "crates/ui-egui/tests/view.rs::page_display_commands_switch_layouts", "crates/ui-egui/tests/view.rs::default_page_display_is_used_for_new_documents", "crates/ui-egui/src/canvas.rs::fit_page_and_height_hold_still_while_mixed_page_sizes_scroll_past"]
 notes = "the default for PDFs that don't ask for a layout (Preferences ▸ Default page display); pages stack with no snapping. Fit page and Fit height fit the largest page, so the zoom holds still across mixed page sizes"
@@ -1478,7 +1490,7 @@ milestone = "M3"
 status = "shipped"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/ui.rs::drag_selects_text_and_copy_returns_it", "crates/ui-egui/tests/ui.rs::selection_works_in_every_view_rotation", "crates/ui-egui/tests/text_select.rs::quick_clicks_select_a_word_then_the_line_then_the_page", "crates/ui-egui/tests/text_select.rs::quick_clicks_with_the_highlighter_mark_only_the_word", "crates/ui-egui/tests/text_select.rs::shift_click_extends_the_selection_from_its_anchor"]
+evidence = ["crates/ui-egui/tests/ui.rs::drag_selects_text_and_copy_returns_it", "crates/ui-egui/tests/ui.rs::selection_works_in_every_view_rotation", "crates/ui-egui/tests/ui_group/text_select.rs::quick_clicks_select_a_word_then_the_line_then_the_page", "crates/ui-egui/tests/ui_group/text_select.rs::quick_clicks_with_the_highlighter_mark_only_the_word", "crates/ui-egui/tests/ui_group/text_select.rs::shift_click_extends_the_selection_from_its_anchor"]
 notes = "Drag to select; ⇧-click extends the selection to the click, keeping its anchor (same page only); with the Select tool, quick clicks select a word (two), the line (three) or all the text on the page (four). The markup and Redact tools mark a double-clicked word and stop there. Missing: selection across pages (dragging or ⇧-clicking onto another page), paragraph selection, and ⌘A across the whole document (it selects the current page)."
 
 [[feature]]
@@ -1490,7 +1502,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["edit.column_select"]
 tools = ["text_extract"]
-evidence = ["crates/render/src/text.rs::a_column_selection_takes_one_table_column", "crates/render/src/text.rs::a_column_selection_across_columns_reads_row_by_row", "crates/render/src/text.rs::right_to_left_rows_read_right_to_left", "crates/render/src/text.rs::vertical_lines_keep_reading_order", "crates/ui-egui/tests/column_select.rs::alt_drag_selects_only_the_text_inside_the_rectangle", "crates/ui-egui/tests/column_select.rs::the_column_select_tool_needs_no_modifier", "crates/ui-egui/tests/column_select.rs::alt_drag_with_the_highlighter_marks_only_the_column", "crates/automation/tests/automation.rs::text_extract_with_a_rect_takes_one_column"]
+evidence = ["crates/render/src/text.rs::a_column_selection_takes_one_table_column", "crates/render/src/text.rs::a_column_selection_across_columns_reads_row_by_row", "crates/render/src/text.rs::right_to_left_rows_read_right_to_left", "crates/render/src/text.rs::vertical_lines_keep_reading_order", "crates/ui-egui/tests/ui_group/column_select.rs::alt_drag_selects_only_the_text_inside_the_rectangle", "crates/ui-egui/tests/ui_group/column_select.rs::the_column_select_tool_needs_no_modifier", "crates/ui-egui/tests/ui_group/column_select.rs::alt_drag_with_the_highlighter_marks_only_the_column", "crates/automation/tests/automation.rs::text_extract_with_a_rect_takes_one_column"]
 notes = "Issue #740. Holding Alt (Option on macOS) when a drag starts selects only the text inside the rectangle drawn, with the Select tool, the text markup tools and Redact (with Highlight and Redact the drag must start on text, since off text they draw an area box). Edit ▸ Column select does the same with a plain drag. A glyph counts when its centre is inside. Copy gives one row per visual line, top to bottom; pieces side by side (table cells) are separated by a tab, right to left in right-to-left rows; vertical text keeps reading order. text_extract takes the same rectangle as rect. Platforms: on Linux desktops whose window manager moves windows with Alt-drag (Xfce, Cinnamon and MATE by default; KDE Plasma 5 and other setups with Alt as the window modifier; GNOME and Plasma 6 use Super) the drag never reaches PdfCraft, so use Edit ▸ Column select or change that setting. On Windows, releasing Alt does not open a system menu (the window has no native menu). The web build has the same Linux caveat in the browser. Checked by hand on Linux (Fedora) with the Column select tool; Alt/Option-drag, and macOS and Windows generally, rest on the kittest tests. Missing: selection across pages, ⇧-click extending a column, a default shortcut, and a check of Acrobat's own copied-text format (not observed)."
 
 [[feature]]
@@ -1610,7 +1622,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.theme", "view.theme.light", "view.theme.dark"]
 tools = []
-evidence = ["crates/ui-egui/tests/theme.rs::toolbar_and_view_menu_share_three_state_preferences", "crates/ui-egui/src/theme.rs::text_is_readable_on_every_surface"]
+evidence = ["crates/ui-egui/tests/ui_group/theme.rs::toolbar_and_view_menu_share_three_state_preferences", "crates/ui-egui/src/theme.rs::text_is_readable_on_every_surface"]
 notes = "Toolbar and Display theme share three choices and a preference setter; manual choices exit system mode. Every text colour meets WCAG AA (4.5:1) on every surface in both themes; glyphs are pixel-aligned for sharper text at 100–150 % scaling."
 
 [[feature]]
@@ -1622,7 +1634,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["view.theme.system"]
 tools = []
-evidence = ["crates/ui-egui/tests/theme.rs::toolbar_and_view_menu_share_three_state_preferences", "crates/ui-egui/tests/theme.rs::saved_preferences_restore_with_legacy_light_dark_settings", "crates/ui-egui/tests/control.rs::theme_commands_and_options_report_preference_and_effective_colours"]
+evidence = ["crates/ui-egui/tests/ui_group/theme.rs::toolbar_and_view_menu_share_three_state_preferences", "crates/ui-egui/tests/ui_group/theme.rs::saved_preferences_restore_with_legacy_light_dark_settings", "crates/ui-egui/tests/control.rs::theme_commands_and_options_report_preference_and_effective_colours"]
 notes = "Toolbar, Display theme and --theme system share a persisted System preference that follows OS changes without losing the selected mode; ui.state reports preference and resolved colours separately."
 
 [[feature]]
@@ -1718,7 +1730,7 @@ milestone = "M3"
 status = "partial"
 commands = ["help.check_updates"]
 tools = []
-evidence = ["crates/ui-egui/tests/updates.rs::a_newer_release_is_offered_for_download", "crates/ui-egui/tests/updates.rs::nothing_is_asked_until_the_user_checks", "apps/pdfcraft/src/updates.rs::answers_are_read_and_only_our_release_pages_are_offered"]
+evidence = ["crates/ui-egui/tests/ui_group/updates.rs::a_newer_release_is_offered_for_download", "crates/ui-egui/tests/ui_group/updates.rs::nothing_is_asked_until_the_user_checks", "apps/pdfcraft/src/updates.rs::answers_are_read_and_only_our_release_pages_are_offered"]
 notes = "asks GitHub Releases on request and offers the release page. By the owner's decision there is no check at start and no in-place install (Acrobat has both)"
 
 [[feature]]
@@ -2166,7 +2178,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.link"]
 tools = ["link_add"]
-evidence = ["crates/ui-egui/tests/pdf_links.rs::drawing_editing_and_deleting_links", "crates/automation/tests/automation.rs::links_through_tools", "crates/annot/src/tests.rs::links_are_added_edited_listed_and_removed"]
+evidence = ["crates/ui-egui/tests/ui_group/pdf_links.rs::drawing_editing_and_deleting_links", "crates/automation/tests/automation.rs::links_through_tools", "crates/annot/src/tests.rs::links_are_added_edited_listed_and_removed"]
 notes = "drag a rectangle; go to a page or open a web page"
 
 [[feature]]
@@ -2178,7 +2190,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.link"]
 tools = ["link_edit"]
-evidence = ["crates/ui-egui/tests/pdf_links.rs::drawing_editing_and_deleting_links", "crates/automation/tests/automation.rs::links_through_tools", "crates/annot/src/tests.rs::links_are_added_edited_listed_and_removed"]
+evidence = ["crates/ui-egui/tests/ui_group/pdf_links.rs::drawing_editing_and_deleting_links", "crates/automation/tests/automation.rs::links_through_tools", "crates/annot/src/tests.rs::links_are_added_edited_listed_and_removed"]
 notes = "visible/invisible rectangle, highlight, thickness, solid/dashed/underline, colour; action"
 
 [[feature]]
@@ -2214,7 +2226,7 @@ milestone = "M7"
 status = "partial"
 commands = ["edit.link"]
 tools = ["link_add"]
-evidence = ["crates/annot/src/tests.rs::links_are_added_edited_listed_and_removed", "crates/ui-egui/tests/pdf_links.rs::drawing_editing_and_deleting_links"]
+evidence = ["crates/annot/src/tests.rs::links_are_added_edited_listed_and_removed", "crates/ui-egui/tests/ui_group/pdf_links.rs::drawing_editing_and_deleting_links"]
 notes = "go to a page (Fit view); named destinations and zoom pending"
 
 [[feature]]
@@ -2262,7 +2274,7 @@ milestone = "M12"
 status = "partial"
 commands = []
 tools = []
-evidence = ["crates/ui-egui/tests/layer_actions.rs::links_set_layer_visibility", "crates/ui-egui/tests/layer_actions.rs::push_buttons_set_layer_visibility", "crates/engine/src/tests.rs::set_layer_actions_change_what_renders", "crates/engine/src/tests.rs::set_layer_actions_toggle_in_order_and_keep_radio_groups", "crates/render/src/inspect.rs::links_read_set_layer_actions", "crates/forms/src/tests.rs::push_buttons_read_set_layer_actions"]
+evidence = ["crates/ui-egui/tests/ui_group/layer_actions.rs::links_set_layer_visibility", "crates/ui-egui/tests/ui_group/layer_actions.rs::push_buttons_set_layer_visibility", "crates/engine/src/tests.rs::set_layer_actions_change_what_renders", "crates/engine/src/tests.rs::set_layer_actions_toggle_in_order_and_keep_radio_groups", "crates/render/src/inspect.rs::links_read_set_layer_actions", "crates/forms/src/tests.rs::push_buttons_read_set_layer_actions"]
 notes = "Links and push buttons run it: ON, OFF and Toggle in order, by optional content group, and with /PreserveRB (the default) a layer turned on turns off the rest of its /RBGroups group. Like the Layers panel it changes the view, not the document (no undo step, not saved). Not yet: creating the action (Link Properties, a field's Actions), bookmarks and other triggers, /Next chains, JavaScript ocg.state, and the Layers panel keeping radio-button groups itself."
 
 [[feature]]
@@ -2334,7 +2346,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.header_footer"]
 tools = ["doc_header_footer"]
-evidence = ["crates/ui-egui/tests/marks.rs::header_and_footer_dialog_inserts_tokens_and_applies_to_a_subset", "crates/edit/src/tests.rs::header_and_footer_are_drawn_in_display_space_and_wrap_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove"]
+evidence = ["crates/ui-egui/tests/ui_group/marks.rs::header_and_footer_dialog_inserts_tokens_and_applies_to_a_subset", "crates/edit/src/tests.rs::header_and_footer_are_drawn_in_display_space_and_wrap_the_original_content", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove"]
 notes = "Helvetica only (no font choice yet); drawn in display space on rotated pages; artifact-tagged"
 
 [[feature]]
@@ -2346,7 +2358,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.header_footer.update", "edit.header_footer.remove"]
 tools = ["doc_header_footer", "doc_remove_marks"]
-evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/ui-egui/tests/marks.rs::header_and_footer_dialog_inserts_tokens_and_applies_to_a_subset"]
+evidence = ["crates/edit/src/tests.rs::replace_and_remove_restore_the_original_content", "crates/ui-egui/tests/ui_group/marks.rs::header_and_footer_dialog_inserts_tokens_and_applies_to_a_subset"]
 notes = "recognises PdfCraft marks; Acrobat-made headers are not detected yet"
 
 [[feature]]
@@ -2370,7 +2382,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.header_footer"]
 tools = ["doc_header_footer"]
-evidence = ["crates/ui-egui/src/marks_ui.rs::page_ranges_with_subsets", "crates/ui-egui/tests/marks.rs::header_and_footer_dialog_inserts_tokens_and_applies_to_a_subset"]
+evidence = ["crates/ui-egui/src/marks_ui.rs::page_ranges_with_subsets", "crates/ui-egui/tests/ui_group/marks.rs::header_and_footer_dialog_inserts_tokens_and_applies_to_a_subset"]
 notes = "all / from–to, all / even / odd"
 
 [[feature]]
@@ -2394,7 +2406,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.watermark"]
 tools = ["doc_watermark"]
-evidence = ["crates/edit/src/tests.rs::watermarks_rotate_fade_and_can_go_behind", "crates/ui-egui/tests/marks.rs::watermark_and_background_dialogs", "crates/automation/tests/automation.rs::headers_watermarks_and_backgrounds_through_tools"]
+evidence = ["crates/edit/src/tests.rs::watermarks_rotate_fade_and_can_go_behind", "crates/ui-egui/tests/ui_group/marks.rs::watermark_and_background_dialogs", "crates/automation/tests/automation.rs::headers_watermarks_and_backgrounds_through_tools"]
 notes = "Helvetica; fit-to-page or a size"
 
 [[feature]]
@@ -2430,8 +2442,8 @@ milestone = "M7"
 status = "partial"
 commands = ["edit.watermark"]
 tools = ["doc_watermark"]
-evidence = ["crates/edit/src/tests.rs::watermarks_rotate_fade_and_can_go_behind"]
-notes = "rotation, opacity, behind/on top; no position offsets, scale or print/screen-only variants in the UI yet"
+evidence = ["crates/edit/src/tests.rs::watermarks_rotate_fade_and_can_go_behind", "crates/edit/src/tests.rs::watermark_offset_moves_the_centre_right_and_up", "crates/edit/src/tests.rs::a_watermark_offset_that_is_not_finite_is_refused", "crates/automation/tests/automation.rs::watermarks_move_from_the_page_centre_through_tools", "crates/ui-egui/src/marks_ui.rs::the_watermark_edit_carries_the_offset"]
+notes = "rotation, opacity, behind/on top, and a horizontal/vertical offset from the page centre in points (dialog and offset_x/offset_y); no offset from the page edge or in page units, and no print/screen-only variants yet"
 
 [[feature]]
 id = "edit.background-add"
@@ -2442,7 +2454,7 @@ milestone = "M7"
 status = "shipped"
 commands = ["edit.background"]
 tools = ["doc_background"]
-evidence = ["crates/ui-egui/tests/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright"]
+evidence = ["crates/ui-egui/tests/ui_group/marks.rs::watermark_and_background_dialogs", "crates/engine/src/tests.rs::headers_footers_watermarks_and_backgrounds_show_update_and_remove", "crates/engine/src/tests.rs::backgrounds_and_watermarks_from_files", "crates/ui-egui/tests/ui_group/marks.rs::backgrounds_and_watermarks_from_a_file", "crates/organize/src/tests.rs::a_page_becomes_a_form_xobject_upright"]
 notes = "colour, or a picture from a file (an image or a page of a PDF) scaled relative to the page"
 
 [[feature]]
@@ -2566,8 +2578,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.organize"]
 tools = []
-evidence = ["crates/ui-egui/tests/editing.rs::shift_click_selects_a_range_and_moves_it"]
-notes = ""
+evidence = ["crates/ui-egui/tests/editing.rs::shift_click_selects_a_range_and_moves_it", "crates/ui-egui/tests/editing.rs::organize_tool_opens_the_overview_directly_and_can_be_reentered", "crates/ui-egui/tests/control.rs::organize_overview_is_reachable_through_the_control_channel"]
+notes = "Opening the Organize pages tool enters the overview directly. Hovered, focused and selected pages expose individual rotate/delete actions; the toolbar acts on the selection."
 
 [[feature]]
 id = "organize.multi-select-pages"
@@ -2579,7 +2591,7 @@ status = "shipped"
 commands = ["page.organize"]
 tools = []
 evidence = ["crates/ui-egui/tests/editing.rs::command_click_toggles_and_rotation_applies_to_selection", "crates/ui-egui/tests/editing.rs::shift_click_selects_a_range_and_moves_it", "crates/ui-egui/tests/editing.rs::organize_select_all_shortcut_preserves_current_page_and_sets_range_anchor", "crates/ui-egui/tests/control.rs::select_all_key_selects_every_page_in_organize"]
-notes = "Ctrl+A / ⌘A selects every page in the Organize grid, preserving the current page; text inputs and dialogs keep their own keyboard input."
+notes = "Ctrl+A / ⌘A selects every page in the Organize grid, preserving the current page; text inputs and dialogs keep their own keyboard input. Page checkboxes also toggle selection without modifiers (organize_checkboxes_toggle_multiple_pages_without_modifiers)."
 
 [[feature]]
 id = "organize.rotate-pages"
@@ -2590,7 +2602,7 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.rotate", "page.rotate_ccw"]
 tools = ["page_rotate"]
-evidence = ["crates/organize/src/tests.rs::rotate_uses_inherited_rotation_and_round_trips", "crates/ui-egui/tests/editing.rs::command_click_toggles_and_rotation_applies_to_selection"]
+evidence = ["crates/organize/src/tests.rs::rotate_uses_inherited_rotation_and_round_trips", "crates/ui-egui/tests/editing.rs::command_click_toggles_and_rotation_applies_to_selection", "crates/ui-egui/tests/editing.rs::organize_page_actions_rotate_only_the_named_page_and_undo", "crates/ui-egui/tests/editing.rs::organize_local_actions_respect_document_permissions"]
 notes = ""
 
 [[feature]]
@@ -2770,7 +2782,7 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.duplicate"]
 tools = ["page_duplicate"]
-evidence = ["crates/ui-egui/tests/pageboxes.rs::duplicate_pages_copies_the_current_page", "crates/organize/src/tests.rs::duplicate_pages_inserts_copies_after_the_last"]
+evidence = ["crates/ui-egui/tests/ui_group/pageboxes.rs::duplicate_pages_copies_the_current_page", "crates/organize/src/tests.rs::duplicate_pages_inserts_copies_after_the_last"]
 notes = "copies share fonts and images with the originals"
 
 [[feature]]
@@ -2914,8 +2926,8 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.combine"]
 tools = ["doc_combine"]
-evidence = ["crates/organize/src/tests.rs::combine_concatenates_with_a_bookmark_per_file", "crates/ui-egui/tests/editing.rs::combining_files_opens_a_new_unsaved_tab", "crates/ui-egui/tests/editing.rs::combine_files_opens_in_its_own_tab", "crates/ui-egui/tests/editing.rs::combine_lists_size_and_warns_before_combining", "crates/ui-egui/tests/editing.rs::a_password_protected_file_is_unlocked_with_its_password_and_combined", "crates/ui-egui/tests/editing.rs::a_folder_adds_its_pdfs_in_order_and_optionally_its_subfolders", "crates/ui-egui/tests/ui.rs::pdfs_dropped_on_the_combine_tab_join_its_list", "crates/automation/tests/automation.rs::combine_extract_and_split", "crates/automation/tests/automation.rs::combine_opens_protected_files_with_their_passwords", "crates/organize/src/tests.rs::combine_keeps_pdfx_when_every_source_agrees", "crates/organize/src/tests.rs::combine_claims_no_pdfx_when_the_sources_disagree"]
-notes = "Combine files is its own tab: a table of the files (name, pages, size, modified, warnings) with column sorting, resizing and moving; files, folders (with subfolders) and open documents can be added, or dropped on the tab. Problems show before Combine (password, security settings that withhold page assembly, bad page ranges, duplicates); protected files are unlocked with their open or permissions password (also doc_combine passwords). The result is never encrypted, and is not yet offered for protection in the same step. A PDF/X result (output intent, GTS_PDFXVersion, Trapped, XMP pdfxid) only when every source declares the same version and output intent (#263). When they differ the result claims none, and nothing reports that yet; Acrobat behaviour not observed."
+evidence = ["crates/organize/src/tests.rs::combine_concatenates_with_a_bookmark_per_file", "crates/ui-egui/tests/editing.rs::combining_files_opens_a_new_unsaved_tab", "crates/ui-egui/tests/editing.rs::combine_files_opens_in_its_own_tab", "crates/ui-egui/tests/editing.rs::combine_lists_size_and_warns_before_combining", "crates/ui-egui/tests/editing.rs::a_password_protected_file_is_unlocked_with_its_password_and_combined", "crates/ui-egui/tests/editing.rs::a_folder_adds_its_pdfs_images_and_text_in_order_and_optionally_its_subfolders", "crates/ui-egui/tests/editing.rs::images_and_text_files_join_the_combine_list_as_pdfs", "crates/ui-egui/tests/editing.rs::files_that_cannot_be_read_are_listed_and_left_out_once_the_user_agrees", "crates/ui-egui/tests/ui.rs::pdfs_dropped_on_the_combine_tab_join_its_list", "crates/automation/tests/automation.rs::combine_extract_and_split", "crates/automation/tests/automation.rs::combine_opens_protected_files_with_their_passwords", "crates/automation/tests/automation.rs::combine_takes_images_and_text_files", "crates/engine/src/tests.rs::files_for_combine_are_made_into_pdfs_and_pdfs_pass_through", "crates/organize/src/tests.rs::combine_keeps_pdfx_when_every_source_agrees", "crates/organize/src/tests.rs::combine_claims_no_pdfx_when_the_sources_disagree"]
+notes = "Combine files is its own tab: a table of the files (name, pages, size, modified, warnings) with column sorting, resizing and moving; files, folders (with subfolders) and open documents can be added, or dropped on the tab. Images (PNG, JPEG, TIFF, GIF, BMP, JPEG 2000) and .txt files become PDFs as they are added (#569; also in doc_combine). A file that can't be read stays in the list with why, and Combine asks before leaving it out; Office documents, HTML and other formats are not converted yet. Problems show before Combine (password, security settings that withhold page assembly, bad page ranges, duplicates); protected files are unlocked with their open or permissions password (also doc_combine passwords). The result is never encrypted, and is not yet offered for protection in the same step. A PDF/X result (output intent, GTS_PDFXVersion, Trapped, XMP pdfxid) only when every source declares the same version and output intent (#263). When they differ the result claims none, and nothing reports that yet; Acrobat behaviour not observed."
 
 [[feature]]
 id = "organize.combine-bookmarks"
@@ -3094,7 +3106,7 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.boxes"]
 tools = ["page_set_box"]
-evidence = ["crates/ui-egui/tests/pageboxes.rs::set_page_boxes_dialog_applies_margins_to_the_chosen_pages", "crates/organize/src/tests.rs::page_boxes_default_inherit_and_set"]
+evidence = ["crates/ui-egui/tests/ui_group/pageboxes.rs::set_page_boxes_dialog_applies_margins_to_the_chosen_pages", "crates/organize/src/tests.rs::page_boxes_default_inherit_and_set"]
 notes = "crop/trim/bleed/art/media, margins in pt/in/mm, page ranges, preview; no Remove white margins yet"
 
 [[feature]]
@@ -3106,7 +3118,7 @@ milestone = "M4"
 status = "shipped"
 commands = ["page.crop"]
 tools = ["page_set_box"]
-evidence = ["crates/ui-egui/tests/pageboxes.rs::the_crop_tool_crops_to_the_dragged_rectangle_then_returns_to_select"]
+evidence = ["crates/ui-egui/tests/ui_group/pageboxes.rs::the_crop_tool_crops_to_the_dragged_rectangle_then_returns_to_select"]
 notes = "drag to crop; double-click opens Set Page Boxes"
 
 [[feature]]
@@ -3854,7 +3866,7 @@ milestone = "M5"
 status = "shipped"
 commands = []
 tools = ["comment_add"]
-evidence = ["crates/ui-egui/tests/comments.rs::dragging_over_text_with_the_highlighter_highlights_it", "crates/ui-egui/tests/identity.rs::the_identity_name_signs_new_comments_and_is_remembered"]
+evidence = ["crates/ui-egui/tests/comments.rs::dragging_over_text_with_the_highlighter_highlights_it", "crates/ui-egui/tests/ui_group/identity.rs::the_identity_name_signs_new_comments_and_is_remembered"]
 notes = "Preferences ▸ Identity: the name on new comments (default the login name, as Acrobat), remembered across restarts"
 
 [[feature]]
@@ -4326,7 +4338,7 @@ milestone = "M3"
 status = "shipped"
 commands = ["form.fields"]
 tools = ["doc_info"]
-evidence = ["crates/ui-egui/tests/view.rs::field_list_jumps_to_a_fields_page", "crates/render/src/inspect.rs::fields_listed_only_on_the_pages_are_listed", "crates/ui-egui/tests/bulk_fields.rs::fields_panel_selects_multiple_fields_and_opens_their_shared_properties", "crates/ui-egui/tests/bulk_fields.rs::double_clicking_a_field_in_the_panel_opens_its_individual_properties"]
+evidence = ["crates/ui-egui/tests/view.rs::field_list_jumps_to_a_fields_page", "crates/render/src/inspect.rs::fields_listed_only_on_the_pages_are_listed", "crates/ui-egui/tests/ui_group/bulk_fields.rs::fields_panel_selects_multiple_fields_and_opens_their_shared_properties", "crates/ui-egui/tests/ui_group/bulk_fields.rs::double_clicking_a_field_in_the_panel_opens_its_individual_properties"]
 notes = "list with jump-to-field; in Prepare a form, Shift/Ctrl/Command-click selects several fields and Properties edits their shared properties; double-click opens field properties; fields a file lists only as page widgets (empty /Fields) are adopted too"
 
 [[feature]]
@@ -4686,7 +4698,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.prepare"]
 tools = ["form_add_field", "form_set_props", "form_delete_field"]
-evidence = ["crates/ui-egui/tests/prepare.rs::placing_moving_editing_and_deleting_a_field", "crates/ui-egui/tests/prepare.rs::deleting_several_selected_fields_and_detecting_fields_from_the_panel", "crates/engine/src/tests.rs::preparing_a_form_adds_renames_and_deletes_fields", "crates/ui-egui/tests/bulk_fields.rs::shared_properties_preserve_mixed_values_and_undo_the_whole_change", "crates/ui-egui/tests/bulk_fields.rs::select_all_in_prepare_a_form_selects_only_the_current_pages_fields", "crates/ui-egui/tests/bulk_fields.rs::dragging_an_empty_page_area_selects_fields_without_moving_them"]
+evidence = ["crates/ui-egui/tests/prepare.rs::placing_moving_editing_and_deleting_a_field", "crates/ui-egui/tests/prepare.rs::deleting_several_selected_fields_and_detecting_fields_from_the_panel", "crates/engine/src/tests.rs::preparing_a_form_adds_renames_and_deletes_fields", "crates/ui-egui/tests/ui_group/bulk_fields.rs::shared_properties_preserve_mixed_values_and_undo_the_whole_change", "crates/ui-egui/tests/ui_group/bulk_fields.rs::select_all_in_prepare_a_form_selects_only_the_current_pages_fields", "crates/ui-egui/tests/ui_group/bulk_fields.rs::dragging_an_empty_page_area_selects_fields_without_moving_them"]
 notes = "fields shown with blue fill and name tags; select, move, resize by corners, Delete (every selected field, one undo step); field tools return to Select after one field. Shared General, Appearance and applicable Options edits are atomic and opt-in; Ctrl/Command+A selects the current page, rectangle and panel selection are supported. Names, positions, choices/defaults and script tabs remain individual GUI edits"
 
 [[feature]]
@@ -4830,7 +4842,7 @@ milestone = "M6"
 status = "shipped"
 commands = ["form.field.properties"]
 tools = ["form_set_props"]
-evidence = ["crates/forms/src/tests.rs::properties_rename_and_delete", "crates/ui-egui/tests/prepare.rs::placing_moving_editing_and_deleting_a_field", "crates/automation/tests/automation.rs::preparing_a_form_through_tools", "crates/ui-egui/tests/bulk_fields.rs::locked_field_refuses_the_entire_batch_and_keeps_the_draft_for_correction", "crates/ui-egui/tests/bulk_fields.rs::visiting_shared_property_tabs_without_changes_does_not_dirty_the_document"]
+evidence = ["crates/forms/src/tests.rs::properties_rename_and_delete", "crates/ui-egui/tests/prepare.rs::placing_moving_editing_and_deleting_a_field", "crates/automation/tests/automation.rs::preparing_a_form_through_tools", "crates/ui-egui/tests/ui_group/bulk_fields.rs::locked_field_refuses_the_entire_batch_and_keeps_the_draft_for_correction", "crates/ui-egui/tests/ui_group/bulk_fields.rs::visiting_shared_property_tabs_without_changes_does_not_dirty_the_document"]
 notes = "name, tooltip, read only, required, locked; shared tooltip/flags are opt-in, mixed values preserved, failures keep the draft and roll back the batch (visibility pending)"
 
 [[feature]]
@@ -5154,7 +5166,7 @@ milestone = "M12"
 status = "partial"
 commands = ["file.open"]
 tools = ["doc_open", "form_fill"]
-evidence = ["crates/engine/src/tests.rs::static_xfa_forms_take_their_values_from_the_datasets_and_write_them_back", "crates/ui-egui/tests/xfa.rs::a_static_xfa_form_is_filled_from_its_data_and_says_so", "crates/xfa/src/tests.rs::static_forms_read_their_values_from_the_datasets", "crates/xfa/src/tests.rs::writing_values_keeps_the_data_no_field_binds_to", "crates/xfa/src/tests.rs::utf16_packets_are_read_and_written_back_as_utf16", "crates/engine/src/tests.rs::xfa_data_no_field_binds_to_survives_an_edit_and_save"]
+evidence = ["crates/engine/src/tests.rs::static_xfa_forms_take_their_values_from_the_datasets_and_write_them_back", "crates/ui-egui/tests/ui_group/xfa.rs::a_static_xfa_form_is_filled_from_its_data_and_says_so", "crates/xfa/src/tests.rs::static_forms_read_their_values_from_the_datasets", "crates/xfa/src/tests.rs::writing_values_keeps_the_data_no_field_binds_to", "crates/xfa/src/tests.rs::utf16_packets_are_read_and_written_back_as_utf16", "crates/engine/src/tests.rs::xfa_data_no_field_binds_to_survives_an_edit_and_save"]
 notes = "the AcroForm fields are shown and filled as in any form; on open their values come from the XFA datasets (what another viewer saved) by the fields' Designer names (recorded as a document warning), and every edit merges the values back into the datasets, keeping data no field binds to, so Acrobat shows the same values; values that can't be written are warnings. Missing: no template semantics (no scripts, calculations or hidden subforms), explicit bind refs are not followed (#60)"
 
 [[feature]]
@@ -5166,7 +5178,7 @@ milestone = "M12"
 status = "partial"
 commands = ["file.open"]
 tools = ["doc_open", "doc_info", "form_fields", "form_fill", "js_run"]
-evidence = ["crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/automation/tests/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save", "crates/xfa/src/tests.rs::repeating_subforms_inside_positioned_content_get_their_instances", "crates/engine/src/tests.rs::xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them"]
+evidence = ["crates/xfa/src/tests.rs::layout_places_captions_fields_and_sizes_containers_to_their_content", "crates/xfa/src/tests.rs::tables_break_across_pages_and_repeat_their_header_row", "crates/xfa/src/tests.rs::rendering_into_the_pdf_replaces_the_placeholder_page_and_adds_fields", "crates/engine/src/tests.rs::dynamic_xfa_forms_are_laid_out_on_open_filled_and_saved_incrementally", "crates/automation/tests/automation.rs::dynamic_xfa_forms_open_render_fill_and_save_through_tools", "crates/ui-egui/tests/ui_group/xfa.rs::a_dynamic_xfa_form_is_laid_out_and_filled", "crates/xfa/src/tests.rs::nested_width_less_subforms_lay_out_in_polynomial_time", "crates/js/src/tests.rs::instance_managers_add_remove_and_count", "crates/xfa/src/tests.rs::the_form_tree_carries_values_presence_instances_and_the_events", "crates/engine/src/tests.rs::xfa_scripts_initialize_calculate_validate_toggle_and_add_rows", "crates/automation/tests/automation.rs::xfa_scripts_run_for_buttons_and_field_changes_through_tools", "crates/ui-egui/tests/ui_group/xfa.rs::xfa_buttons_run_their_scripts_in_the_app", "crates/engine/src/tests.rs::hostile_xfa_open_scripts_are_merged_capped_kept_from_printing_and_noted", "crates/engine/src/tests.rs::runaway_xfa_calculations_at_open_end_quickly_with_a_report", "crates/xfa/src/tests.rs::the_live_form_of_nested_repeating_subforms_stops_at_its_node_budget", "crates/xfa/src/tests.rs::data_ops_of_one_event_are_one_datasets_rewrite", "crates/xfa/src/tests.rs::choice_lists_signatures_passwords_and_pictures_become_fields_and_images", "crates/xfa/src/tests.rs::choice_values_come_from_the_data_as_saved_values_and_several_for_lists", "crates/xfa/src/tests.rs::pictures_are_sized_from_their_headers_and_hostile_ones_are_refused_unallocated", "crates/engine/src/tests.rs::xfa_choice_lists_signature_and_picture_fields_open_fill_script_and_save", "crates/xfa/src/tests.rs::repeating_subforms_inside_positioned_content_get_their_instances", "crates/engine/src/tests.rs::xfa_rows_in_areas_are_laid_out_read_calculated_and_written_where_adobe_binds_them"]
 notes = "laid out from the template on open by the xfa crate (positioned, tb, lr-tb, table/row, page masters, breaks, repeated header rows, captions, rich text, JPEG/PNG/GIF images) into real pages and AcroForm fields (text, password, date with AFDate formats, check boxes, radio groups, drop-downs and list boxes with shown/saved item pairs and multi-select, signature fields, image fields showing their picture (pictures decoded once per document, at most 20 million pixels, and reused across re-layouts), buttons with reset/print/save/URL), filled from the datasets packet (including rows another viewer added), saved as an incremental revision with the values merged into the datasets so Adobe's viewers show them; doc_info reports xfa_layout. XFA JavaScript and FormCalc (form.xfa-formcalc) run in the js crate's XFA object model (xfa.form, SOM resolution, rawValue, presence, access, instance managers, xfa.host, xfa.layout, xfa.event): initialize and calculate on open, exit, validate and calculate after a field changes, click for buttons (through js_run and the app), with rows added and removed, subforms shown and hidden, and the form laid out again, all as one undo step and kept in the file. Hostile scripts are bounded per event (merged and capped effects, messages and console lines, lower loop limits and a time budget on open and calculate, one datasets rewrite per event, print/save/links/focus from clicks only, a runaway script abandoned and the form's scripts turned off) and what open-time scripts changed is noted. Missing: loops inside nested calls are only stopped by abandoning their thread, and script memory is not capped; the change event per keystroke; xfa.template, connections and data descriptions; a hidden instance of a repeating subform hides them all; choosing a new picture for an image field; barcodes are drawn as their text, not bars; keep rules; metrics are approximate and Acrobat fidelity is eyeballed on real forms, not measured (#60)"
 
 [[feature]]
@@ -5250,8 +5262,8 @@ milestone = "M5"
 status = "shipped"
 commands = ["sign.fill.signature", "sign.fill.initials", "sign.fill.signature.change", "sign.fill.initials.change", "sign.fill.signature.remove", "sign.fill.initials.remove"]
 tools = ["fill_sign_add", "comment_edit", "comment_image_preview"]
-evidence = ["crates/ui-egui/tests/fill_sign.rs::drawn_signatures_resize_from_their_corners", "crates/ui-egui/tests/fill_sign.rs::drawn_and_typed_signatures_stay_upright_on_rotated_pages", "crates/automation/tests/automation.rs::typed_signatures_stay_upright_on_rotated_pages", "crates/ui-egui/tests/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/comments.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save", "crates/ui-egui/tests/fill_sign.rs::fill_and_sign_tools_pick_up_placed_marks_to_move_and_resize_them", "crates/ui-egui/tests/fill_sign.rs::select_tool_picks_up_a_signature_over_a_form_field"]
-notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn or imported from local PNG/JPEG images; all three are placed upright and anchored as displayed on pages with /Rotate (#299); saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; while a Fill & Sign tool is active, marks already placed are picked up as with Select (hover shows the move cursor, a click selects, a drag moves, the selected mark's handles resize) and the tool places only away from them; embedded image signatures resize and move live, hiding the frame during movement and restoring it on release; corner handles preserve the original aspect ratio of the embedded image with the opposite corner anchored, while edge midpoint handles stretch width or height independently; cached background layers preserve page content and alpha, including reopened/encrypted documents; Escape cancels a gesture without committing; stamps resize through selection handles or comment_edit with their original appearance; native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 4 megapixels and 4096 pixels per side"
+evidence = ["crates/ui-egui/tests/fill_sign.rs::drawn_signatures_resize_from_their_corners", "crates/ui-egui/tests/fill_sign.rs::drawn_and_typed_signatures_stay_upright_on_rotated_pages", "crates/automation/tests/automation.rs::typed_signatures_stay_upright_on_rotated_pages", "crates/ui-egui/tests/fill_sign.rs::image_signature_corners_restore_original_aspect_after_edge_resize_and_reopen", "crates/ui-egui/src/comments.rs::proportional_corners_keep_the_opposite_anchor_and_edges_stretch_one_axis", "crates/ui-egui/tests/fill_sign.rs::image_signature_live_resize_and_move_preserve_background_and_hide_moving_handles", "crates/ui-egui/tests/fill_sign.rs::embedded_image_signature_live_gestures_follow_document_and_view_rotation", "crates/automation/tests/automation.rs::image_signature_preview_layers_are_read_only_and_survive_encrypted_save", "crates/engine/src/signature_image.rs::embedded_signature_preview_preserves_alpha_without_editing_the_document", "crates/engine/src/signature_image.rs::oversized_embedded_signature_preview_is_rejected_before_decoding", "crates/ui-egui/tests/fill_sign.rs::image_signature_preview_follows_pointer_at_page_size_with_zoom_and_rotation", "crates/ui-egui/tests/fill_sign.rs::image_signature_placement_selects_resize_handles_and_requires_reselecting_to_repeat", "crates/ui-egui/tests/fill_sign.rs::typed_signatures_and_initials", "crates/ui-egui/tests/fill_sign.rs::signing_draws_a_signature_once_and_places_it", "crates/ui-egui/tests/fill_sign.rs::changing_saved_signatures_and_initials_preserves_placed_marks", "crates/ui-egui/tests/fill_sign.rs::changing_drawn_signatures_can_be_cancelled_or_switched_to_type", "crates/ui-egui/tests/fill_sign.rs::saved_signature_cards_remove_and_add_without_changing_the_document", "crates/ui-egui/tests/fill_sign.rs::long_typed_names_fit_the_placed_signature_and_keep_every_outline", "crates/ui-egui/src/fill_sign.rs::long_signature_previews_have_clear_margins", "crates/ui-egui/tests/control.rs::saved_signature_can_be_changed_through_the_control_channel", "crates/fonts/src/script.rs::a_name_becomes_outlines", "crates/fonts/src/script.rs::long_names_keep_every_glyph_with_bounded_outline_work", "crates/automation/tests/automation.rs::fill_and_sign_through_tools", "crates/ui-egui/tests/fill_sign.rs::image_signatures_and_initials_can_be_imported_placed_and_remembered", "crates/ui-egui/tests/fill_sign.rs::image_import_cancel_clear_and_errors_preserve_saved_signatures", "crates/engine/src/signature_image.rs::image_signatures_preserve_alpha_and_fit_the_signature_box", "crates/engine/src/signature_image.rs::invalid_and_oversized_signature_images_are_rejected", "crates/engine/src/signature_image.rs::large_signature_images_are_scaled_down", "crates/engine/src/signature_image.rs::jpeg_signatures_are_normalized_to_png", "crates/engine/src/signature_image.rs::jpeg_signature_orientation_is_applied_before_preview_and_embedding", "crates/engine/src/signature_image.rs::very_wide_image_signatures_keep_the_requested_rectangle", "crates/automation/tests/automation.rs::image_signatures_through_tools_preserve_transparency_and_survive_save", "crates/ui-egui/tests/fill_sign.rs::fill_and_sign_tools_pick_up_placed_marks_to_move_and_resize_them", "crates/ui-egui/tests/fill_sign.rs::select_tool_picks_up_a_signature_over_a_form_field"]
+notes = "signature and initials, typed (Dancing Script outlines as filled paths, no font embedded), drawn or imported from local PNG/JPEG images; all three are placed upright and anchored as displayed on pages with /Rotate (#299); saved in settings with preview cards and add/change/remove controls; changes leave placed annotations untouched; images preserve alpha, aspect ratio and EXIF orientation, fit within 150 pt by 32 pt (24 pt for initials), and are normalized without source paths or metadata; image previews follow the pointer at placement size with zoom and rotation; signatures/initials place once then select the new annotation; while a Fill & Sign tool is active, marks already placed are picked up as with Select (hover shows the move cursor, a click selects, a drag moves, the selected mark's handles resize) and the tool places only away from them; embedded image signatures resize and move live, hiding the frame during movement and restoring it on release; corner handles preserve the original aspect ratio of the embedded image with the opposite corner anchored, while edge midpoint handles stretch width or height independently; cached background layers preserve page content and alpha, including reopened/encrypted documents; Escape cancels a gesture without committing; stamps resize through selection handles or comment_edit with their original appearance; native and web asynchronous pickers; fill_sign_add accepts path instead of text; image imports capped at 4 MiB, 32 megapixels and 8192 pixels per side, larger than 4 megapixels or 4096 pixels per side scaled down to fit (#1075)"
 
 [[feature]]
 id = "form.fill-sign-flatten"
@@ -5326,7 +5338,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["protect.password"]
 tools = ["doc_protect"]
-evidence = ["crates/ui-egui/tests/protect.rs::protecting_for_viewing_requires_matching_passwords_and_saves_encrypted", "crates/engine/src/tests.rs::protect_with_an_open_password_then_save_reopen_and_undo", "crates/automation/tests/automation.rs::protecting_through_tools"]
+evidence = ["crates/ui-egui/tests/ui_group/protect.rs::protecting_for_viewing_requires_matching_passwords_and_saves_encrypted", "crates/engine/src/tests.rs::protect_with_an_open_password_then_save_reopen_and_undo", "crates/automation/tests/automation.rs::protecting_through_tools"]
 notes = "Protect Using Password (Viewing); applied by the next save"
 
 [[feature]]
@@ -5338,7 +5350,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["protect.password"]
 tools = ["doc_protect"]
-evidence = ["crates/ui-egui/tests/protect.rs::editing_restrictions_via_advanced_options", "crates/engine/src/tests.rs::permissions_password_restricts_others_but_not_this_session", "crates/automation/tests/automation.rs::protecting_through_tools"]
+evidence = ["crates/ui-egui/tests/ui_group/protect.rs::editing_restrictions_via_advanced_options", "crates/engine/src/tests.rs::permissions_password_restricts_others_but_not_this_session", "crates/automation/tests/automation.rs::protecting_through_tools"]
 notes = "Protect Using Password (Editing); the author keeps full rights after saving"
 
 [[feature]]
@@ -5350,7 +5362,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["protect.password"]
 tools = ["doc_protect"]
-evidence = ["crates/ui-egui/tests/protect.rs::editing_restrictions_via_advanced_options", "crates/engine/src/tests.rs::permissions_password_restricts_others_but_not_this_session"]
+evidence = ["crates/ui-egui/tests/ui_group/protect.rs::editing_restrictions_via_advanced_options", "crates/engine/src/tests.rs::permissions_password_restricts_others_but_not_this_session"]
 notes = "Advanced Options: printing (none/low/high), changes (5 levels), copying, screen readers"
 
 [[feature]]
@@ -5398,7 +5410,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["protect.password"]
 tools = []
-evidence = ["crates/ui-egui/tests/protect.rs::protecting_for_viewing_requires_matching_passwords_and_saves_encrypted"]
+evidence = ["crates/ui-egui/tests/ui_group/protect.rs::protecting_for_viewing_requires_matching_passwords_and_saves_encrypted"]
 notes = "Weak / Medium / Strong under the password field"
 
 [[feature]]
@@ -5494,7 +5506,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.mark"]
 tools = ["redact_mark"]
-evidence = ["crates/ui-egui/tests/redact.rs::marking_applying_and_clearing", "crates/automation/tests/automation.rs::redacting_through_tools", "crates/redact/src/tests.rs::glyphs_under_a_mark_go_and_the_rest_stays_put"]
+evidence = ["crates/ui-egui/tests/ui_group/redact.rs::marking_applying_and_clearing", "crates/automation/tests/automation.rs::redacting_through_tools", "crates/redact/src/tests.rs::glyphs_under_a_mark_go_and_the_rest_stays_put"]
 notes = "drag across text (or select first) with the Redact tool"
 
 [[feature]]
@@ -5506,7 +5518,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.mark"]
 tools = ["redact_mark"]
-evidence = ["crates/ui-egui/tests/redact.rs::marking_applying_and_clearing", "crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared"]
+evidence = ["crates/ui-egui/tests/ui_group/redact.rs::marking_applying_and_clearing", "crates/redact/src/tests.rs::images_are_removed_or_have_their_pixels_cleared"]
 notes = "drag a box anywhere else"
 
 [[feature]]
@@ -5518,7 +5530,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.pages"]
 tools = ["redact_mark"]
-evidence = ["crates/ui-egui/tests/redact.rs::marking_applying_and_clearing"]
+evidence = ["crates/ui-egui/tests/ui_group/redact.rs::marking_applying_and_clearing"]
 notes = "Mark Page Range: current page or a range"
 
 [[feature]]
@@ -5542,7 +5554,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.search"]
 tools = ["redact_mark"]
-evidence = ["crates/redact/src/patterns.rs::word_lists_are_trimmed_unique_and_bounded", "crates/automation/tests/automation.rs::redacting_word_lists_through_tools", "crates/ui-egui/tests/redact.rs::redacting_an_imported_word_list"]
+evidence = ["crates/redact/src/patterns.rs::word_lists_are_trimmed_unique_and_bounded", "crates/automation/tests/automation.rs::redacting_word_lists_through_tools", "crates/ui-egui/tests/ui_group/redact.rs::redacting_an_imported_word_list"]
 notes = "Find text and redact ▸ Multiple words or phrases: one per line, typed or imported from a .txt file (at most 1 MB, 1,000 entries of 256 characters); every match of each is marked in one undo step; redact_mark words reports marks per word. Not yet: whole-words-only and case-sensitive options, exporting the list"
 
 [[feature]]
@@ -5602,7 +5614,7 @@ milestone = "M8"
 status = "partial"
 commands = ["redact.properties"]
 tools = ["redact_mark"]
-evidence = ["crates/ui-egui/tests/redact.rs::marking_applying_and_clearing", "crates/redact/src/tests.rs::overlay_text_takes_its_font_size_colour_alignment_and_repeats"]
+evidence = ["crates/ui-egui/tests/ui_group/redact.rs::marking_applying_and_clearing", "crates/redact/src/tests.rs::overlay_text_takes_its_font_size_colour_alignment_and_repeats"]
 notes = "fill colour or none; overlay text with font, size or auto-size, colour, alignment and repeat, or redaction codes (protect.redaction-codes)"
 
 [[feature]]
@@ -5614,7 +5626,7 @@ milestone = "M8"
 status = "partial"
 commands = ["redact.properties"]
 tools = ["redact_mark"]
-evidence = ["crates/redact/src/tests.rs::redaction_codes_join_in_set_order_and_reject_strangers", "crates/automation/tests/automation.rs::redacting_with_codes_through_tools", "crates/ui-egui/tests/redact.rs::redaction_codes_become_the_overlay_text"]
+evidence = ["crates/redact/src/tests.rs::redaction_codes_join_in_set_order_and_reject_strangers", "crates/automation/tests/automation.rs::redacting_with_codes_through_tools", "crates/ui-egui/tests/ui_group/redact.rs::redaction_codes_become_the_overlay_text"]
 notes = "built-in U.S. FOIA (5 U.S.C. 552(b)) and U.S. Privacy Act (552a) sets; picked codes become the overlay text, in the set's order. Missing: Edit Codes, custom code sets, import/export of code sets"
 
 [[feature]]
@@ -5626,7 +5638,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.apply"]
 tools = ["redact_apply"]
-evidence = ["crates/ui-egui/tests/redact.rs::marking_applying_and_clearing", "crates/engine/src/tests.rs::redaction_marks_apply_for_good_and_undo", "crates/automation/tests/automation.rs::redacting_through_tools"]
+evidence = ["crates/ui-egui/tests/ui_group/redact.rs::marking_applying_and_clearing", "crates/engine/src/tests.rs::redaction_marks_apply_for_good_and_undo", "crates/automation/tests/automation.rs::redacting_through_tools"]
 notes = "confirmation; one undo step; next save is a full rewrite"
 
 [[feature]]
@@ -5674,7 +5686,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.apply"]
 tools = ["redact_apply"]
-evidence = ["crates/redact/src/tests.rs::comments_links_and_fields_under_a_mark_go", "crates/ui-egui/tests/redact.rs::marking_applying_and_clearing"]
+evidence = ["crates/redact/src/tests.rs::comments_links_and_fields_under_a_mark_go", "crates/ui-egui/tests/ui_group/redact.rs::marking_applying_and_clearing"]
 notes = "with pop-ups; fields lose all widgets"
 
 [[feature]]
@@ -5734,7 +5746,7 @@ milestone = "M8"
 status = "shipped"
 commands = ["protect.remove_hidden"]
 tools = ["doc_hidden_info", "doc_remove_hidden"]
-evidence = ["crates/redact/src/tests.rs::hidden_information_is_counted_and_removed", "crates/ui-egui/tests/redact.rs::removing_hidden_information_and_sanitizing", "crates/automation/tests/automation.rs::removing_hidden_information_through_tools"]
+evidence = ["crates/redact/src/tests.rs::hidden_information_is_counted_and_removed", "crates/ui-egui/tests/ui_group/redact.rs::removing_hidden_information_and_sanitizing", "crates/automation/tests/automation.rs::removing_hidden_information_through_tools"]
 notes = "metadata, attachments, comments, form fields (flattened), hidden text, hidden layers, bookmarks, links/actions/scripts, private data; overlapping objects and cropped content pending"
 
 [[feature]]
@@ -5746,9 +5758,21 @@ milestone = "M8"
 status = "shipped"
 commands = ["redact.sanitize"]
 tools = ["doc_remove_hidden"]
-evidence = ["crates/redact/src/tests.rs::hidden_information_is_counted_and_removed", "crates/ui-egui/tests/redact.rs::removing_hidden_information_and_sanitizing", "crates/automation/tests/automation.rs::removing_hidden_information_through_tools"]
+evidence = ["crates/redact/src/tests.rs::hidden_information_is_counted_and_removed", "crates/ui-egui/tests/ui_group/redact.rs::removing_hidden_information_and_sanitizing", "crates/automation/tests/automation.rs::removing_hidden_information_through_tools"]
 notes = "every category, then a full rewrite on save"
 
+[[feature]]
+id = "protect.audit-faux-redactions"
+title = "Audit: detect faux redactions (opaque covers over extractable text, unapplied marks)"
+area = "G"
+tier = "P2"
+milestone = "M8"
+status = "partial"
+commands = []
+tools = ["doc_audit_redactions"]
+evidence = ["crates/audit/src/tests.rs::faux_redaction_is_found", "crates/audit/src/tests.rs::background_before_text_is_not_flagged", "crates/audit/src/tests.rs::light_shading_after_text_is_not_flagged", "crates/audit/src/tests.rs::graphics_state_carries_across_streams", "crates/audit/src/tests.rs::audit_fails_closed_on_undecodable_stream", "crates/audit/src/tests.rs::unapplied_redact_mark_is_found", "crates/automation/tests/automation.rs::auditing_faux_redactions_through_tools"]
+notes = "New pdfcraft-audit crate. A filled rectangle (re + fill, opaque) counts as a cover only when painted after the text it overlaps and dark enough to hide it (WCAG contrast < 3.0); page backgrounds, table shading and highlights are not flagged. Graphics state carries across a page's content streams. Fails closed: undecodable content is an error, never a clean bill. Also flags /Redact annotations never applied. CLI: pdfcraft-cli audit (fails when findings exist)."
+
 [[feature]]
 id = "protect.remove-hidden-on-close"
 title = "Remove hidden information when closing or sending"
@@ -5941,9 +5965,9 @@ tier = "P1"
 milestone = "M9"
 status = "partial"
 commands = ["sign.digital"]
-tools = []
-evidence = ["crates/ui-egui/tests/signing.rs::drawing_a_signature_creating_an_id_signing_and_trusting"]
-notes = "text items (name, date, reason, location, DN, labels); no graphics or saved appearances yet"
+tools = ["sign_document"]
+evidence = ["crates/ui-egui/tests/signing.rs::drawing_a_signature_creating_an_id_signing_and_trusting", "crates/ui-egui/tests/signing.rs::the_fill_and_sign_signature_or_an_image_shows_in_a_digital_signature", "crates/sign/tests/pdf.rs::visible_signatures_show_a_drawn_typed_or_image_graphic", "crates/sign/tests/pdf.rs::malformed_signature_graphics_are_refused_not_drawn", "crates/sign/tests/pdf.rs::an_encrypted_documents_signature_graphic_is_encrypted_with_it", "crates/automation/tests/automation.rs::signing_with_an_image_typed_or_drawn_graphic_through_tools"]
+notes = "text items (name, date, reason, location, DN, labels), and a graphic where the large name would be: the saved Fill & Sign signature (drawn, typed or image) or an imported PNG/JPEG (white paper made transparent, as in Fill & Sign), remembered for the next signing; alone it fills the box. Missing: named saved appearances (one remembered choice only), a PDF page as the graphic, the logo/watermark background, drawing a new signature inside the dialog"
 
 [[feature]]
 id = "sign.reason-location"
@@ -6531,11 +6555,11 @@ title = "Despeckle"
 area = "I"
 tier = "P1"
 milestone = "M10"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["ocr.enhance_camera"]
+tools = ["page_enhance_camera"]
+evidence = ["crates/engine/src/camera_clean.rs::a_shadow_and_a_yellow_cast_become_white_paper", "crates/engine/src/tests.rs::enhance_camera_page_at_a_level_whitens_a_shadowed_sheet", "crates/ui-egui/tests/camera.rs::the_clean_up_level_enhances_again_from_the_photo_and_keeps_the_turn"]
+notes = "Camera images only: from clean-up level 60, isolated dark pixels are removed. Missing: for scanned pages and as an OCR option."
 
 [[feature]]
 id = "ocr.background-removal"
@@ -6543,11 +6567,11 @@ title = "Background removal"
 area = "I"
 tier = "P1"
 milestone = "M10"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["ocr.enhance_camera"]
+tools = ["page_enhance_camera"]
+evidence = ["crates/engine/src/camera_clean.rs::a_shadow_and_a_yellow_cast_become_white_paper", "crates/engine/src/tests.rs::enhance_camera_page_at_a_level_whitens_a_shadowed_sheet", "crates/ui-egui/tests/camera.rs::the_clean_up_level_enhances_again_from_the_photo_and_keeps_the_turn"]
+notes = "Camera images only: Enhance camera image's clean-up level (and page_enhance_camera level) evens out the paper's illumination per channel, so the background turns white and colour casts go; colour ink stays. Missing: the same for scanned pages and as an OCR option."
 
 [[feature]]
 id = "ocr.descreen"
@@ -6579,11 +6603,11 @@ title = "Edge shadow removal"
 area = "I"
 tier = "P2"
 milestone = "M10"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["ocr.enhance_camera"]
+tools = ["page_enhance_camera"]
+evidence = ["crates/engine/src/camera_clean.rs::a_shadow_and_a_yellow_cast_become_white_paper", "crates/engine/src/tests.rs::enhance_camera_page_at_a_level_whitens_a_shadowed_sheet", "crates/ui-egui/tests/camera.rs::the_clean_up_level_enhances_again_from_the_photo_and_keeps_the_turn"]
+notes = "Camera images only: the clean-up level divides out a smooth illumination estimate, which removes shadows and darker edges on the straightened photo. Missing: for scanned pages (book gutters) and as an OCR option."
 
 [[feature]]
 id = "ocr.camera-perspective"
@@ -6591,11 +6615,11 @@ title = "Enhance camera images (edges, perspective, contrast)"
 area = "I"
 tier = "P1"
 milestone = "M10"
-status = "planned"
-commands = []
-tools = []
-evidence = []
-notes = ""
+status = "partial"
+commands = ["ocr.enhance_camera"]
+tools = ["page_enhance_camera"]
+evidence = ["crates/engine/src/tests.rs::enhance_camera_page_straightens_the_sheet", "crates/automation/tests/automation.rs::enhance_camera_image_through_tools", "crates/ui-egui/tests/camera.rs::dragging_a_corner_then_enhance_page_straightens_the_page", "crates/ui-egui/tests/camera.rs::after_enhance_page_crop_and_organize_take_over", "crates/engine/src/tests.rs::detect_camera_corners_finds_the_sheet_in_user_space", "crates/automation/tests/automation.rs::enhance_camera_image_finds_the_edges_by_itself"]
+notes = "Four corners (any order, a convex quadrilateral) are warped to an upright page at the picture's own resolution, in one undoable step; comments, links and bookmarks stay. Scan & OCR ▸ Enhance camera image shows four corner handles on the current page (Enhance page / Cancel / Esc), then offers rotate either way, Crop pages and Organize pages for the enhanced page; page_enhance_camera does the same headlessly. The corners start on the document's edges when they are found (straight lines with an edge along most of each side, refined by a line fit; tested on synthetic photos with text, wood grain, shadows, strong perspective and a 30° turn), else inset 5%. After Enhance page a clean-up slider (0–100, default 50) re-enhances from the straightened photo: even lighting, white paper, contrast, despeckle from 60 (camera_clean). Missing: turning the result upright (text orientation), rounded-corner cards keep their background in the corners, document types."
 
 [[feature]]
 id = "ocr.camera-document-type"
@@ -7914,8 +7938,8 @@ milestone = "M10"
 status = "shipped"
 commands = ["print.dialog"]
 tools = ["doc_print"]
-evidence = ["crates/print/src/tests.rs::size_modes"]
-notes = "fit, actual size, shrink oversized, custom %"
+evidence = ["crates/print/src/tests.rs::size_modes", "crates/print/src/tests.rs::architectural_sheets_preserve_full_scale", "crates/automation/tests/automation.rs::architectural_and_iso_papers_through_tools", "crates/ui-egui/tests/print.rs::architectural_page_can_be_matched_at_100_percent"]
+notes = "fit, actual size, shrink oversized, custom %; ARCH A/B/C/D/E1/E, ANSI C/D/E, ISO A0/A1/A2 presets; Match page at 100% matches the current page to a standard sheet. PDF scale shows the previewed source-to-sheet transform, not calibrated physical output; driver substitution/scaling remains possible"
 
 [[feature]]
 id = "print.paper-source-by-size"
@@ -7986,7 +8010,7 @@ milestone = "M10"
 status = "shipped"
 commands = ["print.dialog"]
 tools = ["doc_print"]
-evidence = ["crates/print/src/tests.rs::size_modes"]
+evidence = ["crates/print/src/tests.rs::size_modes", "crates/print/src/tests.rs::architectural_sheets_preserve_full_scale", "crates/automation/tests/automation.rs::architectural_and_iso_papers_through_tools", "crates/ui-egui/tests/print.rs::architectural_page_can_be_matched_at_100_percent"]
 notes = "auto portrait/landscape"
 
 [[feature]]
@@ -9854,8 +9878,8 @@ milestone = "M14"
 status = "partial"
 commands = ["app.preferences"]
 tools = []
-evidence = ["crates/ui-egui/src/commands.rs::localized_shortcut_labels_follow_language_and_platform", "crates/ui-egui/src/i18n/mod.rs::keyboard_key_names_have_a_separate_context_and_english_fallback", "crates/ui-egui/tests/commands.rs::localized_shortcuts_update_immediately_and_keep_command_ids_and_key_bindings", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::neutral_locale_does_not_override_display_language", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::arabic_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::arabic_lookups_are_in_display_order", "crates/ui-egui/src/i18n/mod.rs::arabic_plurals_follow_the_six_cldr_forms", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::arabic_labels_have_glyphs", "crates/ui-egui/src/bidi.rs::rtl_labels_keep_placeholders_whole", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/mod.rs::ukrainian_calendar_uses_month_case_for_dates", "crates/ui-egui/src/i18n/mod.rs::ukrainian_catalog_does_not_leave_english_ui_text", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::ukrainian_history_and_diagnostics_preserve_user_values"]
-notes = "Shortcut modifiers and key names use a dedicated catalog context across toolbar, menus, palette, Help and tooltips, with English fallback and macOS symbols preserved. Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian/Italian/Arabic and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk|it|ar and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. Engine/OS error details stay untranslated. Auto detects the Windows display language after explicitly named supported locale overrides; neutral C/POSIX launcher locales are skipped on Windows, with Chinese script/region mapping and English fallback. Arabic (ar and every ar-* locale) covers commands, dialogs and panels with the six CLDR plural forms; its labels are put into display order when the catalog loads, because egui joins Arabic letters but lays words out left to right. Missing: a right-to-left layout (Arabic labels sit in the left-to-right layout, a wrapped Arabic paragraph breaks at the wrong end, and text typed into a field is not reordered), Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases (the pinned craft-fonts revision has an Arabic face; its Noto Sans CJK SC is never embedded, AGENTS.md §1.1), a full localization audit."
+evidence = ["crates/ui-egui/src/commands.rs::localized_shortcut_labels_follow_language_and_platform", "crates/ui-egui/src/i18n/mod.rs::keyboard_key_names_have_a_separate_context_and_english_fallback", "crates/ui-egui/tests/commands.rs::localized_shortcuts_update_immediately_and_keep_command_ids_and_key_bindings", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_resolves_chinese_scripts", "crates/ui-egui/src/i18n/mod.rs::neutral_locale_does_not_override_display_language", "crates/ui-egui/src/i18n/mod.rs::windows_display_language_query_returns_a_locale_tag", "crates/ui-egui/src/i18n/mod.rs::language_persists_and_invalid_input_keeps_current_language", "crates/ui-egui/src/i18n/mod.rs::bundled_catalogs_are_consistent", "crates/ui-egui/src/i18n/mod.rs::arabic_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::arabic_lookups_are_in_display_order", "crates/ui-egui/src/i18n/mod.rs::arabic_plurals_follow_the_six_cldr_forms", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::arabic_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::arabic_labels_have_glyphs", "crates/ui-egui/src/bidi.rs::rtl_labels_keep_placeholders_whole", "crates/ui-egui/src/i18n/mod.rs::japanese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::simplified_chinese_history_and_diagnostics_preserve_user_values", "crates/ui-egui/tests/control.rs::simplified_chinese_signature_prompts_and_errors_keep_document_state", "crates/ui-egui/tests/control.rs::language_switch_preserves_document_and_command_ids", "crates/ui-egui/tests/control.rs::japanese_controls_and_search_keep_command_ids", "crates/ui-egui/tests/control.rs::japanese_dialogs_errors_and_custom_action_names", "crates/ui-egui/src/i18n/mod.rs::french_is_registered", "crates/ui-egui/src/i18n/mod.rs::french_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::french_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::french_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::german_certificate_subject_has_a_distinct_context", "crates/ui-egui/src/widgets.rs::search_placeholder_never_overlaps_the_shortcut", "crates/ui-egui/src/home.rs::translated_card_description_leaves_room_for_the_action", "crates/ui-egui/tests/control.rs::german_preferences_and_search_keep_command_ids", "crates/ui-egui/src/i18n/mod.rs::telugu_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::telugu_labels_have_glyphs", "crates/ui-egui/src/i18n/mod.rs::hungarian_is_registered", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::hungarian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::hungarian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::ukrainian_is_registered_and_persists", "crates/ui-egui/src/i18n/mod.rs::ukrainian_integer_plurals_cover_teens_and_large_counts", "crates/ui-egui/src/i18n/mod.rs::ukrainian_calendar_uses_month_case_for_dates", "crates/ui-egui/src/i18n/mod.rs::ukrainian_catalog_does_not_leave_english_ui_text", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_commands_and_catalogue", "crates/ui-egui/src/i18n/mod.rs::ukrainian_covers_ui_literals", "crates/ui-egui/src/i18n/mod.rs::ukrainian_history_and_diagnostics_preserve_user_values", "crates/ui-egui/src/i18n/mod.rs::spanish_covers_what_the_engine_says", "crates/ui-egui/src/i18n/mod.rs::spanish_keeps_the_holes_in_what_the_engine_says", "crates/print/src/tests.rs::wordings_are_said"]
+notes = "Shortcut modifiers and key names use a dedicated catalog context across toolbar, menus, palette, Help and tooltips, with English fallback and macOS symbols preserved. Preferences switches Auto (system language)/English/Japanese/Simplified Chinese/Traditional Chinese/Czech/Brazilian Portuguese/German/Spanish/French/Telugu/Hungarian/Ukrainian/Italian/Arabic and persists; ui.set language auto|en|ja|zh-hans|zh-hant|cs|pt-br|de|es|fr|te|hu|uk|it|ar and ui.state expose it. TSV catalogs per language (same system as PhotoCraft); every dialog, panel and notice goes through tl!. Japanese, Traditional Chinese, Simplified Chinese, German, Spanish, French and Hungarian cover commands, dialogs, panels, shortcuts and history labels; Czech and Brazilian Portuguese the menus. French locales (fr, fr_FR, fr_CA, fr_BE) select the French catalog, German locales (de, de_DE, de_AT, de_CH) the German one, Hungarian locales (hu, hu_HU) the Hungarian one. German search hints reserve shortcut space, Home cards bound translated text, certificate Subject has its own context, and inserted tool names keep their capitalization. The sentences the layers below word for themselves (accessibility findings and the saved report, PDF/A problems, signature details, page-range mistakes, edit labels) are handed over apart from the document's own values and go through the catalog too, through said(&i18n::words); Spanish translates them and the other catalogs fall back to English. OS error details, and faults rather than mistakes, stay as they are. Auto detects the Windows display language after explicitly named supported locale overrides; neutral C/POSIX launcher locales are skipped on Windows, with Chinese script/region mapping and English fallback. Arabic (ar and every ar-* locale) covers commands, dialogs and panels with the six CLDR plural forms; its labels are put into display order when the catalog loads, because egui joins Arabic letters but lays words out left to right. Missing: a right-to-left layout (Arabic labels sit in the left-to-right layout, a wrapped Arabic paragraph breaks at the wrong end, and text typed into a field is not reordered), Czech and Brazilian Portuguese dialogs, Chinese and Telugu font delivery in releases (the pinned craft-fonts revision has an Arabic face; its Noto Sans CJK SC is never embedded, AGENTS.md §1.1), the engine's sentences in the other catalogs, a full localization audit."
 
 [[feature]]
 id = "misc.prefs-reading"
diff --git a/vendor/README.md b/vendor/README.md
index 650d9296..7c9e3634 100644
--- a/vendor/README.md
+++ b/vendor/README.md
@@ -7,12 +7,13 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 
 | Crate | Version | Licence | Patches | Test |
 |---|---|---|---|---|
-| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs` |; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`
+| hayro-interpret | 0.7.0 | Apache-2.0 OR MIT | (1) select `/AP /N` appearance states via `/AS` (checkboxes, radios, stateful icons) and honour the NoView flag; (2) Type3 Unicode fallback to `/Encoding` glyph names, then printable ASCII; (3) `Type3Glyph::advance_width`; (4) `InterpreterSettings::ocg_overrides` for viewer layer toggles; (5) soft masks whose group lacks `/CS` were dropped (Chrome gradient text); (6) paint nesting cap `MAX_PAINT_NESTING` for tiling patterns and Type 3 glyphs (self-referencing content overflowed the stack); (7) CID width ranges in `/W` and `/W2` clamped to `MAX_CID` (a `0 4294967295 w` range hung); (8) `InterpreterSettings::hide_comments` skips markup annotations but keeps widgets and links (View ▸ Hide all comments); (9) `image_size_ok`: images and masks over 2^28 pixels are not decoded (a fuzzed `/W 4294967295` stencil mask allocated 4 GiB); (10) `MAX_NESTED_PAINTS`: nested paints (forms, Type 3 glyphs and tiling patterns inside one another) share a per-page budget of 50,000 (a glyph showing eight glyphs of its own font, sixteen deep, hung); (11) depends on skrifa 0.47 instead of 0.42 (upstream read-fonts fixed a Type 1 tokenizer that recursed through runs of numbers: a fuzzed font hung or overflowed the stack), with the one API change (`Charset::glyph_id` returns `Option`); (12) annotation appearances whose `/BBox` or `/Matrix` collapses to a line or a point are skipped (mapping them onto `/Rect` divided by zero and handed the device infinite or NaN matrices); (13) a Highlight annotation without a usable normal appearance is drawn from its `/QuadPoints`, `/C` and `/CA` with Multiply blending, as pdfcraft-annot draws highlights (it was not drawn at all); (14) simple-font `/Widths` (`read_widths`): entries only for codes 0–255 (one entry per code below `/FirstChar` was allocated: `4294967295` asked for 34 GB), an entry that isn't a number leaves its code missing instead of ending the array, and a `/LastChar` below `/FirstChar` gives no widths instead of discarding the font for a standard one; (15) the appearance box is mapped onto `/Rect` corner to corner: the translation now accounts for the scale (an appearance whose box didn't start at the origin and differed in size from `/Rect` was drawn shifted); (16) a clip set by `W`/`W*` takes effect after whichever path-painting operator ends the path (`S`, `f`, `B`, … as well as `n`; ISO 32000-2 §8.5.4): it was applied only on `n`, so `re W* S` clipped nothing and the clip stayed pending for a later, unrelated `n`; (17) `InterpreterSettings::cancelled`: once set, interpretation stops before the next content operator (a render pool sets it for every worker when dropped, after an edit or on closing, and for one worker when the watchdog gives up on its render, so renders whose answers nobody can receive stop instead of running to the end); (18) `MAX_PAGE_CONTENT`: the content a page holds at once (its contents, and the forms, tiling patterns and Type 3 glyph procedures being painted) stays within 512 MiB (`decode_content`; once it runs out, `InterpreterWarning::ContentTruncated` is reported (once per page by pdfcraft-render) so a truncated page is not a clean render; each level gives its bytes back when it finishes): forms nest fifty deep and each level kept its content while the next ran, so a form painting itself around a stream inflating to 256 MiB would have held over 12 GB; and Type 0 sampled functions take at most `MAX_SAMPLE_ENTRIES` (2^21) table points and `MAX_SAMPLE_VALUES` (2^23) samples, read no further than `/Size` asks (256 MiB of 1-bit samples asked for over 8 GB); (19) mesh shadings (types 4–7) are sampled only inside the area being drawn (`ShadingPattern::encode_within`, which the vendored hayro renderer calls with that area plus a pixel), within 8 visits per pixel of it plus 4 per triangle (`TriangleSampler`), and patches are triangulated one at a time: points far off the page were sampled over their whole bounding box, up to 65536 × 65536 entries (a fuzzed 147-byte patch stream; a synthetic page passed 6 GB in six seconds), ten thousand overlapping triangles ran for minutes, and every patch became 722 triangles before any limit; meshes hold at most `MAX_MESH_PATCHES` (2^16) patches and `MAX_MESH_TRIANGLES` (2^20) triangles, a lattice needs two to 2^19 vertices per row (`/VerticesPerRow 0` pushed empty rows for ever; one huge row read the whole stream), and a page samples at most `MAX_PAGE_MESH_TRIANGLES` (2^25) mesh triangles in all (a mesh painted a thousand times was triangulated a thousand times); each cut logs a warning; (20) PDF function construction is limited to 64 levels and 10,000 total nodes with cycle detection; calculator parsing and evaluation share procedure depth/work budgets, integer division/bitshift/rotation/index are panic-free, and fixed-size stack errors propagate; (21) a Type 0 font drawn with a substitute that isn't CID-keyed (it isn't embedded, or its program doesn't load) draws `.notdef` for a CID of an Adobe character collection (Japan1, GB1, CNS1, Korea1) that it can't find by Unicode: hayro took the CID for a glyph index of the substitute, which numbers its glyphs its own way, so the character was drawn as an unrelated one (𠮷 as "Ｑ" in BIZ UDPGothic); (22) a Type 0 font drawn with a substitute finds a character given with a variation selector (`/ToUnicode`, or Adobe-Japan1-UCS2, which maps the JIS X 0208 forms of the kanji JIS X 0213:2004 redrew that way: CID 1247 is 噂 U+E0100) through the substitute's variation sequences, else as the character alone: such a CID found no glyph and was drawn as an unrelated one; (23) backport of hayro 0.8's `gradient` module: `EncodedShadingPattern::as_svg_gradient` turns an axial or radial shading into stops of an sRGB gradient (within 0.01 per channel, a stop at every stitching-function bound via `Function::stitching_bounds`) when a native gradient draws it exactly (extended past the box drawn in; a radial one with no background colour) | (1) `raster::tests::widget_appearance_states`; (2, 3) `xtask text-oracle` on corpus/pdfjs issue918; (4) `raster::tests::layer_override_hides_content`; (5) `raster::tests::soft_mask_without_group_colour_space_is_applied`; (6) `raster::tests::self_referencing_tiling_pattern_terminates`, `raster::tests::self_referencing_type3_glyph_terminates`; (7) `raster::tests::huge_cid_width_ranges_terminate`; (8) `raster::tests::hiding_comments_keeps_fields`; (9) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (10) `raster::tests::type3_glyphs_that_fan_out_into_themselves_finish`; (11) `raster::tests::type1_font_programs_with_long_runs_of_numbers_load_quickly`; (12) `raster::tests::degenerate_annotation_appearances_are_skipped`; (13) `raster::tests::highlights_without_an_appearance_are_drawn`; (14) `raster::tests::malformed_simple_font_widths_keep_later_widths_and_the_font`, `raster::tests::huge_simple_font_first_char_terminates`; (15) `raster::tests::annotation_appearance_box_maps_onto_rect`; (16) `raster::tests::clipping_path_applies_after_any_painting_operator`; (17) `raster::tests::dropping_the_pool_cancels_its_renders`, `raster::tests::the_watchdog_stops_the_render_it_gives_up_on`; (18) `raster::tests::page_contents_and_nested_forms_share_one_budget`, `raster::tests::content_painted_again_and_again_keeps_drawing`, `raster::tests::sampled_functions_with_billions_of_samples_are_refused`; (19) `raster::tests::mesh_shadings_far_off_the_page_render`, `raster::tests::many_overlapping_mesh_triangles_finish`, `raster::tests::mesh_shadings_with_many_patches_or_no_rows_finish`; (20) `raster::tests::function_limits_calculator_arithmetic_and_depth`, `raster::tests::function_limits_public_construction_work_and_depth`, `raster::tests::function_limits_stitching_cycles_are_refused_and_shared_children_work`, `raster::tests::function_limits_invalid_calculator_keeps_the_page_renderable`; (21) `raster::tests::cids_a_substitute_lacks_are_not_drawn_as_other_glyphs` |; (22) `raster::tests::variation_sequences_draw_their_kanji_in_a_substitute`; (23) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients`
 
-| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel` |
+| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) backport of hayro 0.8: shadings that `as_svg_gradient` can represent are painted as a `vello_cpu` linear or two-point radial gradient instead of a texture sampled pixel by pixel through the shading function (InDesign fades are luminosity soft masks of one full-page axial `sh`: 40 on a report page took 15 s at 144 dpi, now under 1 s); without upstream's half-pixel shift, which suits vello_cpu 0.3 but moves 0.0.8's gradients off pixel centres | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::axial_and_radial_shadings_draw_as_native_gradients` |
+| hayro | 0.7.1 | Apache-2.0 OR MIT | (1) `RenderSettings::{x_offset, y_offset}` to render one tile of a large page; (2) images over `MAX_IMAGE_PIXELS` (2^28) are skipped (a fuzzed `/W 4294967295` hung in resampling); (3) `tiling_cell_scale` keeps a tiling pattern's cell pixmap within 3000 px a side whatever its `/XStep`/`/YStep` (a fuzzed step far beyond `/BBox` allocated 2 GB); (4) stroke widths clamped to 4 × (canvas width + height) device pixels (a fuzzed `/LW 9223372036854775807` allocated 10 GB in stroke expansion); (5) `usable_dash_pattern`: a stroke whose dash pattern could cut it into more than `MAX_DASHES_PER_STROKE` (250,000) pieces, counting kurbo's restart of the pattern at every subpath and `ClosePath`, is drawn solid (a fuzzed `/D [[11] 0]` on a line from x = 92234775807 allocated over 5 GB, `[0.000001] 0 d` on a 20 pt line over 10 GB); (6) a dash pattern with a negative or non-finite entry, or a period that isn't positive, is drawn solid (`[-1 -1] 0 d` looped for ever in kurbo); (7) `render_size` and `render_into`: render into a buffer the caller allocates (PdfCraft renders into pixel-aligned memory that the GUI takes over as texture data); `render` is `render_into` on a new pixmap; (8) checked image source/target/RGBA, alpha-premultiplication scratch and intermediate sizes before resampling, finite transforms and exact source/mask buffers; sources wider than u16 may shrink before backend limits, with a 2^20 source-axis cap and conservative 128 MiB filter-planning estimate; an over-limit or failed resize keeps the original image resolution and geometry when the source fits the backend, otherwise skips it, with a logged warning; staging, resampling output/scratch, RGBA conversion and padding buffers use fallible reserves; (9) `may_paint_canvas`: a fill or stroke whose control-point box, grown by how far its paint reaches past the path (half the stroke width times the larger of the miter limit and √2) plus 0.5 user units and 2 pixels, misses the canvas is not drawn, so a tile no longer strokes and fills every path of its page (item 5 of #623); `set_skip_offscreen_paths` turns this off for the regression test; (10) `/Interpolate` governs the pre-resize too (#624): a minified image that does not request interpolation is pre-resized with nearest-neighbour, planned without the Catmull-Rom filter limits (`image_resampling_size` takes the flag); a Type 3 glyph image is sampled bicubically only when interpolated; a minified image with a matching soft mask is nearest-sampled straight into premultiplied RGBA | (1) `raster::tests::tiles_match_full_render`; (2) `raster::tests::absurd_image_dimensions_are_skipped`; (3) `raster::tests::tiling_cells_stay_small_whatever_the_step`; (4) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (5) `raster::tests::dash_patterns_that_cut_a_stroke_into_billions_of_pieces_render`; (6) `raster::tests::invalid_dash_patterns_terminate_and_are_drawn_solid`; (7) `raster::tests::pixels_are_a_plain_renders_bytes_in_a_buffer_a_gui_can_take_over`; (8) `raster::tests::image_resampling_rejects_anisotropic_target_growth`, `raster::tests::image_resampling_bounds_intermediate_before_planning`, `raster::tests::image_resampling_rejects_invalid_sources_and_scales`, `raster::tests::image_resampling_keeps_valid_sizes_and_exact_limits`, `raster::tests::resampling_fallback_preserves_original_geometry_and_pixels`, `raster::tests::image_resampling_wide_sources_shrink_before_backend_side_limits`, `raster::tests::image_resampling_wide_transparent_sources_still_shrink`, `raster::tests::image_resampling_padded_backend_dimensions_stay_checked`, `raster::tests::image_resampling_mismatched_alpha_mask_keeps_pixels_and_placement`; (9) `raster::tests::skipping_paths_off_the_canvas_changes_no_pixel`; (10) `raster::tests::non_interpolated_images_are_not_smoothed_when_minified`, `raster::tests::non_interpolated_gray_images_are_not_smoothed_when_minified`, `raster::tests::non_integer_minification_samples_the_same_columns`, `raster::tests::non_integer_minification_samples_colour_and_mask_from_the_same_columns`, `raster::tests::non_interpolated_alpha_images_keep_their_colours_and_mask_when_minified`, `raster::tests::non_interpolated_type3_glyph_images_are_not_smoothed_when_minified`, `raster::tests::image_resampling_nearest_accepts_wide_sources_the_filter_refuses`, `raster::tests::wide_non_interpolated_sources_draw_after_shrinking` |
 | hayro-jbig2 | 0.3.0 | Apache-2.0 OR MIT | (1) at most 2^28 pixels per bitmap, page bitmap, halftone grid and grayscale image (each side could be 65535: 4.3 billion pixels decoded one by one); (2) at most 2^26 symbol pixels per symbol dictionary (a fuzzed dictionary decoded for minutes); (3) a symbol dictionary's height classes are capped at one per new symbol and its export runs at `2 × symbols + 1`, each plus `EXTRA_EMPTY_STEPS` (1024): an empty height class or a zero-length export run doesn't advance, and past the end of its data the arithmetic decoder can decode them for ever (one changed byte hung the renderer) | (1) `raster::tests::jbig2_regions_of_billions_of_pixels_are_refused`; (2) the nightly `cargo xtask fuzz` finding, which now finishes in about a second; (3) `raster::tests::jbig2_symbol_dictionaries_that_never_advance_terminate` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
-| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open` |
+| hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had; (14) revision 2–4 passwords are tried as given and then in PDFDocEncoding (`legacy_passwords` in `crypto/mod.rs`, which resolves the upstream `TODO: Convert to PDFDocEncoding`): passwords arrive as UTF-8 text, so a password with characters outside ASCII (`Çok güzel`, `ılık€`) written in PDFDocEncoding, as ISO 32000-2 §7.6.4.3.2 asks and qpdf and Acrobat write it, was always wrong; (15) page content is read a piece at a time (`page::ContentReader`, `Page::content_reader`): plain streams and Flate streams without a predictor are decoded as they are read, with a budget of 64 times their compressed size and never less than `MAX_DECODED_STREAM` (a stream that expands past it is cut and reported); other streams are decoded whole, as before, and share `MAX_DECODED_STREAM`. The content tokenizer reads a window at a time (`UntypedIter::new_window`, `TypedIter::needs_more`, `TypedIter::committed`): an instruction that runs past the window is not decided until more data follows, which `Reader` records by flagging reads and `at_end` past the end of the data, including through the clones the parser makes. The Flate decoder keeps its own 32 KiB history, so it pauses at any output size. `ContentReader::new` reuses raw/decrypted stream bytes for budget accounting and piece creation, and `decoded_raw_within` applies the existing Whole-stream filters and limits to those bytes without decrypting twice. | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it`; (14) `crypto::pdfcraft_password_tests`, `pdfcraft-engine` `tests::legacy_passwords_with_turkish_characters_open`; (15) `content::tests::windows_keep_every_instruction_at_every_split`, `content::tests::windows_keep_every_instruction_in_pieces_of_any_size`, `content::tests::windows_match_the_slice_on_random_content`, `content::tests::windows_drop_blanks_and_keep_a_comment_that_may_go_on`, `page::content_reader_tests::content_past_the_cap_is_read_to_the_end`, `page::content_reader_tests::a_stream_that_expands_past_the_budget_is_cut_there`, `page::content_reader_tests::a_small_expansion_under_the_cap_is_not_cut`, `raster::tests::page_content_past_the_old_cap_renders`, `raster::tests::content_reader_returns_the_same_bytes_in_any_pieces`, `raster::tests::content_bombs_stop_at_the_budget_and_say_so`, `page::content_reader_tests::plain_and_whole_pieces_keep_their_bytes`, `page::content_reader_tests::repeated_content_reference_counts_compressed_bytes_once`, `page::content_reader_tests::whole_cap_still_counts_later_unique_streams`
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589); (4) the object lookup keeps its cycle history through compressed objects, requires an ordinary in-file container, and caps the chain of indirect lookups at 16 (a chain of new objects, each a `/Length` compressed in a container whose own `/Length` names the next, or a stream whose `/Length` names the next stream, overflowed the stack: a dev build's 2 MiB thread within 800 hops); (5) object-stream members are parsed within their own extent (up to the next distinct offset), an entry whose offset repeats an earlier entry's is skipped (so a repeated object number can resolve to its earlier entry), and offsets are processed in index order | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding`; (4) `inspect::tests::compressed_object_self_container_does_not_recurse`, `inspect::tests::compressed_object_mutual_containers_do_not_recurse`, `inspect::tests::object_stream_length_cycle_does_not_recurse`, `inspect::tests::compressed_object_container_chain_does_not_recurse`, `inspect::tests::compressed_length_chain_does_not_recurse`, `inspect::tests::plain_stream_length_chain_does_not_recurse`, `inspect::tests::compressed_objects_and_indirect_stream_length_still_load`, `inspect::tests::compressed_length_in_a_container_with_an_indirect_length_still_loads`; (5) `inspect::tests::object_stream_member_extents_bound_owned_strings`, `inspect::tests::object_stream_member_extents_preserve_index_order_and_whitespace` |
 | hayro-syntax | 0.7.2 | Apache-2.0 OR MIT | (1) Page-tree cycle guard in `resolve_pages` (visited set + depth cap): a `/Kids` loop among compressed objects overflowed the stack and aborted the process; (2) `ccitt_size_ok`: CCITT images wider than 2^20 columns or over 2^28 pixels are not decoded (a fuzzed `/Columns 4294967295` allocated 4 GiB); (3) Flate/LZW predictor row widths are saturating `usize`, a zero width is refused and a row longer than the data is not allocated (a fuzzed `/Columns 9223372036854775807` wrapped to a 2^61-byte allocation and aborted); (4) the inline-image end-of-data check (`EI`) doesn't nest inside its own look-ahead and examines at most 256 candidates and steps (50 images with "EI" in their data ran for over ten minutes); (5) a stream whose `/Length` is wrong is recovered only when `stream` is the next token — scanning ahead to a later object's `stream` made an indirect appearance-state dictionary (Quartz checkboxes: `/AP /N` → `<< /Yes … /Off … >>`) render as a non-form, so the widget was skipped; (6) JPX rescaling uses an exact integer sample range for 1–32-bit components (32 shifted past u32, and floating-point maxima at 25–31 bits wrapped to zero), and refuses zero-sized rows; (7) `decode_limit`: Flate (through flate2 and the fallback inflater), LZW and RunLength never write past `MAX_DECODED_STREAM` (256 MiB), or, for the last filter of an image of known size, past twice its pixel bytes (a predictor tag byte per byte), at most 1 GiB; `Stream::decoded_within` for budgeted callers; a page's `/Contents` array shares one `MAX_DECODED_STREAM` (a 2 MB page whose content stream or 8 × 8 image inflated to 2 GB took the renderer past 3 GB in under a second; naming the stream twenty times in `/Contents`, 5 GB); (8) high-precision numbers (jsPDF MediaBox coordinates with over 19 digits) parse without overflowing the u64 mantissa: fractional digits past it are dropped, integer digits past it scale the value (a real, kept finite); (9) large dictionary indexes are built on first use and shared across repeated reads within each PDF (#307); the validated-byte cache is bounded, reader contexts remain separate, repairs and inline/content dictionaries bypass sharing, and small dictionaries stay eager; (10) decoded object-stream slots publish once under contention, cold loading rejects recursive dependencies, and xref repair serializes without holding recursive read guards; this permits one parser per native render pool with private worker caches; (11) `sync.rs`: a poisoned lock is recovered instead of unwrapped (a worker panic no longer cascades into every reader of the same PDF), and xref repair takes a blocking write lock instead of asserting a non-blocking one; (12) `SegmentList` (`util.rs`) returns `None` for an out-of-range index instead of panicking; (13) a page's `/UserUnit` scales `render_dimensions` and `initial_transform`, so the page and everything on it are sized in points, as Acrobat shows them; it is read as Acrobat reads it (the page's own entry, not inherited; a number from 1 up, at most 75,000; anything else counts as 1), and a page without it keeps exactly the transform it had | (1) `cos/tests/writer.rs::page_tree_loops_in_object_streams_do_not_crash_readers`; (2) `raster::tests::absurd_mask_and_fax_sizes_are_refused_before_decoding`; (3) `raster::tests::absurd_predictor_columns_and_line_widths_render`; (4) `raster::tests::inline_images_with_ei_in_their_data_parse_in_linear_time`; (5) `raster::tests::indirect_appearance_state_dict_is_not_another_stream`; (6) `raster::tests::jpx_stream_bit_depth_boundaries_do_not_panic`, `raster::tests::jpx_32_bit_image_does_not_prevent_other_page_content_from_rendering`, `raster::tests::jpx_gray_rgb_and_alpha_keep_eight_bit_samples`, `raster::tests::jpx_streams_reject_out_of_range_bit_depths`; (7) `raster::tests::decompression_bombs_stop_at_the_stream_limit`, `raster::tests::page_contents_and_nested_forms_share_one_budget`; (8) `inspect::tests::jspdf_high_precision_mediabox_does_not_overflow_dimensions`, `object::number::tests::high_precision_float_does_not_overflow_mantissa` (hayro-syntax); (9) `object::dict::lazy_index_tests`, `raster::tests::large_resource_indexes_preserve_pixels_and_text`; (10) `data::tests`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`, `raster::tests::shared_parser_is_lazy_and_initializes_once_under_contention`; (11) `data::tests::panicking_initializer_wakes_waiters_and_prevents_retries`, `xref::tests::concurrent_cold_object_stream_reads_all_succeed`; (12) `util::tests::segment_list_rejects_out_of_range_indices`; (13) `raster::tests::user_unit_scales_the_page_and_everything_on_it` |
 | lopdf | 0.45.0 | MIT | (1) PNG predictor rows longer than the data are refused before their buffers are allocated (a fuzzed `/Columns 4294967295` allocated two 4 GiB rows), and empty frames return without row buffers; (2) predictor row widths use saturating arithmetic or reject overflow; (3) sub-byte TIFF Predictor 2 scratch is bounded by the samples present in the input instead of the declared `/Colors`, aligned with [lopdf#589](https://github.com/J-F-Liu/lopdf/pull/589) | (1) `inspect::tests::png_predictor_rows_longer_than_the_data_are_refused_before_allocating`, `inspect::tests::empty_png_predictor_frames_do_not_allocate_rows`; (2) `inspect::tests::tiff_subbyte_predictor_row_width_overflow_is_refused`; (3) `inspect::tests::tiff_subbyte_predictor_scratch_is_bounded_by_available_samples`, `inspect::tests::tiff_subbyte_predictors_keep_components_rows_and_padding` |
@@ -20,6 +21,13 @@ the fix. Vendoring copyleft code is never allowed (plan/adr/0001).
 | winit | 0.30.13 | Apache-2.0 | (1) on Windows 11 (build 22000 and later), `WM_DPICHANGED` applies the rect Windows suggests. It used to nudge the window onto the monitor `MonitorFromWindow` names, which during a drag is still the monitor being left; the nudge sent another `WM_DPICHANGED`, so a window dragged to a monitor with another scale factor grew and stayed on the wrong monitor at the wrong scale (#324). Backport of winit master 488c036a ([winit#4341](https://github.com/rust-windowing/winit/pull/4341)), which no 0.30 release has; Windows 10 keeps the old adjustment, as on winit master. (2) on Wayland, a seat's text input is destroyed when the seat goes away, not whenever it loses a capability: losing any capability (a touch screen or tablet unplugged, a remote-desktop session ending) destroyed it, and only an added capability recreated it, so IME stopped working until restart. Port of [winit#4747](https://github.com/rust-windowing/winit/pull/4747); (3) on Windows, an IME composition reports its cursor from `GCS_CURSORPOS` only when `WM_IME_COMPOSITION` says it is set, and at the end of the composition otherwise: the Microsoft Korean IME never sets it, so the cursor read as 0 (egui then drew no caret while composing; it now draws it after the syllable). Port of [winit#4746](https://github.com/rust-windowing/winit/pull/4746); (4) on Windows, a hidden window is not maximized until it is shown, and a hidden window shown while maximized gets one `ShowWindow(SW_MAXIMIZE)`: `SW_MAXIMIZE` shows a hidden window, so PdfCraft, which eframe keeps hidden until its first frame is drawn, appeared unpainted (white) when it restored a maximized window, and could lose its focus. Port of [winit#4587](https://github.com/rust-windowing/winit/pull/4587) (the later, focus-safe form of [winit#4575](https://github.com/rust-windowing/winit/pull/4575)); (5) on X11, when allowing or disallowing IME replaces the focused window's input context (egui does it each time a text field gains or loses focus), the new context is focused: no focus event follows, so it stayed unfocused until the window lost and regained focus. Port of [winit#4727](https://github.com/rust-windowing/winit/pull/4727); (6) on macOS, `insertText` commits through IME when a composition was started (`pending_commit`, set by `setMarkedText`) rather than when marked text is left: input methods that end a composition with `unmarkText` before `insertText` lost the text, and Apple Korean dropped the key typed after a syllable (`한` then `5` or `;`); other `insertText` calls stay `KeyboardInput`; a commit outside a key press (a candidate clicked with the mouse, dictation) clears the marked text and leaves no key to swallow, as in [winit#4748](https://github.com/rust-windowing/winit/pull/4748) (without it the next key, such as Backspace, was lost). `validAttributesForMarkedText` lists the underline and marked-clause attributes, without which some input methods don't compose. Port of [winit#4650](https://github.com/rust-windowing/winit/pull/4650), the 0.30 backport of [winit#4651](https://github.com/rust-windowing/winit/pull/4651) (merged on winit master), with the underline attribute spelled as AppKit's `NSUnderlineStyleAttributeName` (`NSUnderline`); (7) on macOS, disallowing IME with a composition in progress (focus leaving a text field) tells the input method to discard its marked text (`discardMarkedText`): it kept composing it once IME was allowed again, so the abandoned syllable came back (`하`, then `가` typed in the next field, became `학`, then `하` + `가`; Japanese `か` then `さ` became `傘`). Port of [winit#4745](https://github.com/rust-windowing/winit/pull/4745); (8) on macOS, text inserted outside a key press without a composition (the emoji picker) is reported as `Ime::Commit`; it was dropped. Port of the emoji-picker part of [winit#4749](https://github.com/rust-windowing/winit/pull/4749) (0.30 backport of [winit#4748](https://github.com/rust-windowing/winit/pull/4748)); its `selectedRange` change for dictation is left out because it switches on press-and-hold for every held key (an accent menu instead of key repeat, and the chosen accent added after the repeated letters); (9) on macOS, a key whose text was committed through IME isn't also sent as `KeyboardInput` unless AppKit forwards it as a command (Enter): Apple Korean answers Space with no syllable in progress with `setMarkedText(" ")`, `insertText(" ")`, `setMarkedText("")`, and the last call reset winit's state, so the space arrived twice. Same goal as [winit#4478](https://github.com/rust-windowing/winit/pull/4478), whose changes don't reach this call order (macOS 14); to be proposed upstream there; (10) on macOS, when the first key in a fresh app reaches Apple Korean's `insertText` as a raw compatibility jamo instead of starting a composition, that key is interpreted once more, synchronously, before it is sent as `KeyboardInput` (g k s typed ㅎㅏㄴ instead of 한); only an unmodified, non-repeated first key whose one callback inserts that same jamo, with IME enabled and nothing composed, focus and input source unchanged, is retried (`ime_startup.rs`). Port of [winit#4744](https://github.com/rust-windowing/winit/pull/4744), with its policy tests. The published crate's asset files (`docs/res/*.svg`, `examples/data/*.png`) are left out, so its `window` example doesn't build | (1) `pdfcraft` `tests::winit_carries_the_windows_11_monitor_scale_fix` keeps the patch in the build; the drag itself needs two monitors with different scale factors on Windows 11; (2) `pdfcraft` `tests/winit_wayland_text_input.rs`; the capability change itself needs a Wayland session and an input method; (3) `pdfcraft` `tests/winit_windows_ime_cursor.rs`; composing itself needs the Microsoft Korean IME; (4) `pdfcraft` `tests/winit_windows_hidden_maximized.rs`; the start-up itself needs Windows and a window that was closed maximized; (5) `pdfcraft` `tests/winit_x11_ime_focus.rs`; switching fields itself needs an X11 session and an input method (IBus, fcitx5); (6) `pdfcraft` `tests/winit_macos_ime_commit.rs`; composing itself needs macOS and an input method; (7) `pdfcraft` `tests/winit_macos_ime_discard.rs`; composing itself needs macOS and an input method; (8) `pdfcraft` `tests/winit_macos_emoji_picker.rs`; the picker itself needs macOS; (9) `pdfcraft` `tests/winit_macos_korean_space.rs`; composing itself needs macOS and Apple Korean; (10) `pdfcraft` `tests/winit_macos_korean_first_key.rs` and `ime_startup.rs`'s own tests (run them with `rustc --test`); typing itself needs macOS and Apple Korean |
 | egui-wgpu | 0.36.2 | MIT OR Apache-2.0 | (1) `winit::surface_fit`: a window's surface is configured within the device's `max_texture_dimension_2d`, both sides shrunk by one factor that egui then draws at (`pixels_per_point × render_scale`), so the whole window is drawn into the surface (on DX12 it is stretched over the window and lines up with the pointer; wgpu's GL backend copies it unscaled into a corner); the longer side becomes exactly the limit; the depth and MSAA textures follow, and a recreated surface starts again from the window's own size. egui-wgpu configured the window's size as is, and `Surface::configure` panics beyond the limit: a window restored at another monitor's scale (opening an Outlook attachment on a mixed-DPI laptop asked an 8192-pixel device for 8600 × 3423, #577) or stretched across monitors closed PdfCraft, before its window appeared when it happened at start-up ([emilk/egui#8361](https://github.com/emilk/egui/issues/8361)). The published crate leaves out egui's licence files; `LICENSE-APACHE` and `LICENSE-MIT` are from the 0.36.2 tag; (2) `winit::catch_errors`: a new window's surface is configured inside wgpu error scopes (validation, out of memory, internal), and a failure is returned as `WgpuError::ConfigureSurface` (for the root window at start-up eframe returns it as `Error::Wgpu`, which PdfCraft retries with OpenGL); nothing is kept for the window. wgpu's default handler panicked instead, and eframe configures the root surface before the app is created, so a driver that can't configure one closed PdfCraft at launch (a 2015 Intel GPU through wgpu's GL backend timed out waiting for the GPU to go idle, `GpuWaitTimeout`, #519). Unchanged, so still a panic: an error in a later reconfigure (resize, a lost surface), a device lost during the first configure (wgpu reports it only to a callback), and a window shown at zero size (first configured on resize) | (1) `pdfcraft` `tests::a_window_larger_than_the_gpu_limit_gets_a_surface_within_it`, `tests::surface_fit_never_empties_or_overflows_a_surface`, and `tests::egui_wgpu_carries_the_surface_size_fit`, which keeps the patch in the build and in the paths that size a surface; (2) `pdfcraft` `tests::a_gpu_error_while_a_window_is_set_up_is_returned_not_a_panic` (a real device: an error inside `catch_errors` is returned, not a panic) and `tests::egui_wgpu_returns_a_surface_it_cannot_configure_as_an_error`, which keeps it around `add_surface`'s configure |
 
+Renderer startup errors: `egui-wgpu::RenderState::create` also wraps `Renderer::new` in
+`winit::catch_errors` when the winit feature is enabled. A rejected shader or render pipeline
+is returned as `WgpuError::CreateRenderer`, allowing PdfCraft's existing startup OpenGL retry.
+The regression `pdfcraft` `tests::pipeline_creation_error_is_returned_and_device_remains_usable`
+uses an invalid three-sample pipeline, then valid and invalid pipelines again on the same device.
+Later rendering errors, device loss, and non-winit renderer construction are unchanged.
+
 Temporary: hayro is the bootstrap renderer and lopdf the bootstrap inspector (ADR-0004); M2.6 replaces them with our own devices and `cos`/`model`.
 
 Text extraction: hayro-interpret exposes `OutlineGlyph::is_vertical` from a Type0 font’s CMap writing mode. PdfCraft follows negative glyph-space y for WMode 1 so upright vertical columns can be searched (#126).
diff --git a/vendor/egui-wgpu/src/lib.rs b/vendor/egui-wgpu/src/lib.rs
index 0603d786..80b09a04 100644
--- a/vendor/egui-wgpu/src/lib.rs
+++ b/vendor/egui-wgpu/src/lib.rs
@@ -68,6 +68,11 @@ pub enum WgpuError {
     #[cfg(feature = "winit")]
     #[error("The window's surface couldn't be configured: {0}")]
     ConfigureSurface(wgpu::Error),
+
+    /// The device rejected renderer resources before the app was created.
+    #[cfg(feature = "winit")]
+    #[error("The egui renderer couldn't be created: {0}")]
+    CreateRenderer(wgpu::Error),
 }
 
 /// Runtime-mutable subset of [`WgpuConfiguration`].
@@ -283,6 +288,12 @@ impl RenderState {
         };
         let target_format = crate::preferred_framebuffer_format(&surface_formats)?;
 
+        // Return startup pipeline errors so eframe's caller can retry with another renderer.
+        #[cfg(feature = "winit")]
+        let renderer = winit::catch_errors(&device, || Renderer::new(&device, target_format, options))
+            .await
+            .map_err(WgpuError::CreateRenderer)?;
+        #[cfg(not(feature = "winit"))]
         let renderer = Renderer::new(&device, target_format, options);
 
         // On wasm, depending on feature flags, wgpu objects may or may not implement sync.
diff --git a/vendor/hayro-interpret/src/function/mod.rs b/vendor/hayro-interpret/src/function/mod.rs
index 1258a4f9..005ab0bf 100644
--- a/vendor/hayro-interpret/src/function/mod.rs
+++ b/vendor/hayro-interpret/src/function/mod.rs
@@ -20,6 +20,8 @@ use std::sync::Arc;
 
 /// The input/output type of functions.
 pub(crate) type Values = SmallVec<[f32; 4]>;
+/// PdfCraft patch (backport of hayro 0.8): interior breakpoints of stitching functions.
+pub(crate) type StitchingBounds = SmallVec<[f32; 3]>;
 type TupleVec = SmallVec<[(f32, f32); 4]>;
 
 // PdfCraft patch: PDF functions are untrusted object graphs. A normal color/transfer function
@@ -100,6 +102,15 @@ impl Function {
             FunctionType::Type4(t4) => Some(t4.eval(input)?),
         }
     }
+
+    /// PdfCraft patch (backport of hayro 0.8): inputs where a stitching function switches
+    /// sub-function, so a gradient approximation can place a stop exactly there.
+    pub(crate) fn stitching_bounds(&self) -> StitchingBounds {
+        match self.0.as_ref() {
+            FunctionType::Type3(t3) => t3.stitching_bounds(),
+            _ => SmallVec::new(),
+        }
+    }
 }
 
 #[derive(Debug, Clone)]
diff --git a/vendor/hayro-interpret/src/function/type3.rs b/vendor/hayro-interpret/src/function/type3.rs
index f63668f1..37950f89 100644
--- a/vendor/hayro-interpret/src/function/type3.rs
+++ b/vendor/hayro-interpret/src/function/type3.rs
@@ -1,4 +1,4 @@
-use crate::function::{Clamper, Function, TupleVec, Values, interpolate};
+use crate::function::{Clamper, Function, StitchingBounds, TupleVec, Values, interpolate};
 use hayro_syntax::object::Array;
 use hayro_syntax::object::Dict;
 use hayro_syntax::object::Object;
@@ -83,6 +83,51 @@ impl Type3 {
 
         Some(evaluated)
     }
+
+    // PdfCraft patch (backport of hayro 0.8).
+    pub(crate) fn stitching_bounds(&self) -> StitchingBounds {
+        let mut stitching_bounds = StitchingBounds::new();
+        if self.bounds.len() > 2 {
+            stitching_bounds.extend_from_slice(&self.bounds[1..self.bounds.len() - 1]);
+        }
+
+        for (index, function) in self.functions.iter().enumerate() {
+            let Some(bounds_i_minus_1) = self.bounds.get(index).copied() else {
+                continue;
+            };
+            let Some(bounds_i) = self.bounds.get(index + 1).copied() else {
+                continue;
+            };
+
+            let Some((encode_min, encode_max)) = self.encode.get(index).copied() else {
+                continue;
+            };
+
+            if (encode_max - encode_min).abs() <= f32::EPSILON {
+                continue;
+            }
+
+            for child_bound in function.stitching_bounds() {
+                let bound = interpolate(
+                    child_bound,
+                    encode_min,
+                    encode_max,
+                    bounds_i_minus_1,
+                    bounds_i,
+                );
+                let min_bound = bounds_i_minus_1.min(bounds_i);
+                let max_bound = bounds_i_minus_1.max(bounds_i);
+                if bound > min_bound && bound < max_bound {
+                    stitching_bounds.push(bound);
+                }
+            }
+        }
+
+        stitching_bounds.sort_by(f32::total_cmp);
+        stitching_bounds.dedup_by(|a, b| (*a - *b).abs() <= f32::EPSILON);
+
+        stitching_bounds
+    }
 }
 
 fn find_interval(bounds: &[f32], x: f32) -> Option<usize> {
diff --git a/vendor/hayro-interpret/src/gradient.rs b/vendor/hayro-interpret/src/gradient.rs
new file mode 100644
index 00000000..1cfa30af
--- /dev/null
+++ b/vendor/hayro-interpret/src/gradient.rs
@@ -0,0 +1,361 @@
+//! SVG-like gradient conversion for encoded shadings.
+//!
+//! PDF shadings are very expensive to evaluate. Because of this, at least for
+//! radial-axial shadings it's useful if we can instead approximate them by
+//! SVG-like sRGB gradients.
+//!
+//! PdfCraft patch: backported from hayro-interpret 0.8.0 (Apache-2.0 OR MIT), adapted to this
+//! version's `EncodedShadingType::RadialAxial` variant. Remove when the vendored copy moves to
+//! 0.8. A full-page axial soft mask was sampled pixel by pixel (InDesign fades: 15 s per page).
+
+use crate::color::AlphaColor;
+use crate::encode::{EncodedShadingPattern, EncodedShadingType, RadialAxialParams};
+use crate::function::StitchingBounds;
+use crate::shading::ShadingFunction;
+use kurbo::{Affine, Circle, Point, Rect, Shape};
+use smallvec::smallvec;
+
+const MAX_GRADIENT_SUBDIVISION_DEPTH: u8 = 10;
+const RADIAL_EPSILON: f64 = 1.0e-6;
+
+/// An SVG-like gradient.
+pub struct SvgGradient {
+    /// The kind of the gradient.
+    pub kind: SvgGradientKind,
+    /// The transform from encoded shading coordinates into the renderer's coordinate space.
+    pub transform: Affine,
+    /// The stops of the gradient in the sRGB color space.
+    pub stops: Vec<SvgGradientStop>,
+}
+
+/// The kind of the SVG gradient.
+pub enum SvgGradientKind {
+    /// Linear gradient.
+    Linear {
+        /// The normalized start point of the gradient line.
+        start: Point,
+        /// The normalized end point of the gradient line.
+        end: Point,
+    },
+    /// Radial gradient.
+    Radial {
+        /// The center point of the start circle.
+        start_center: Point,
+        /// The radius of the start circle.
+        start_radius: f32,
+        /// The center point of the end circle.
+        end_center: Point,
+        /// The radius of the end circle.
+        end_radius: f32,
+    },
+}
+
+/// A color stop for an SVG-like gradient.
+pub struct SvgGradientStop {
+    /// Normalized offset.
+    pub offset: f32,
+    /// RGBA color components in sRGB.
+    pub color: [f32; 4],
+}
+
+impl EncodedShadingPattern {
+    /// Convert an axial/radial PDF shading into an SVG-like gradient approximation, or `None`
+    /// for other shading types and for cases a native gradient cannot represent exactly.
+    pub fn as_svg_gradient(&self, path_bbox: Rect, tolerance: f32) -> Option<SvgGradient> {
+        let EncodedShadingType::RadialAxial {
+            function,
+            params,
+            domain,
+            extend,
+        } = &self.shading_type
+        else {
+            return None;
+        };
+
+        EncodedRadialAxialShading {
+            function,
+            params,
+            domain: *domain,
+            extend: *extend,
+        }
+        .as_svg_gradient(self, path_bbox, tolerance)
+    }
+}
+
+struct EncodedRadialAxialShading<'a> {
+    function: &'a ShadingFunction,
+    params: &'a RadialAxialParams,
+    domain: [f32; 2],
+    extend: [bool; 2],
+}
+
+impl EncodedRadialAxialShading<'_> {
+    fn as_svg_gradient(
+        &self,
+        pattern: &EncodedShadingPattern,
+        path_bbox: Rect,
+        tolerance: f32,
+    ) -> Option<SvgGradient> {
+        // A couple of cases cannot be losslessly represented by an SVG gradient.
+        match self.params {
+            RadialAxialParams::Axial => {
+                if !self.axial_extend_covers_bbox(pattern, path_bbox) {
+                    return None;
+                }
+            }
+            RadialAxialParams::Radial { .. } => {
+                if !self.radial_extend_covers_bbox(pattern, path_bbox)
+                    || pattern.background_color.components()[3] > 0.0
+                {
+                    return None;
+                }
+            }
+        }
+
+        Some(SvgGradient {
+            kind: self.native_gradient_kind(),
+            transform: pattern.base_transform.inverse(),
+            stops: approximate_gradient_stops(
+                |t| self.sample_t(pattern, t),
+                &self.normalized_stitching_bounds(),
+                tolerance,
+            ),
+        })
+    }
+
+    fn native_gradient_kind(&self) -> SvgGradientKind {
+        match self.params {
+            RadialAxialParams::Axial => SvgGradientKind::Linear {
+                start: Point::ZERO,
+                end: Point::new(1.0, 0.0),
+            },
+            RadialAxialParams::Radial { p1, r } => SvgGradientKind::Radial {
+                start_center: Point::ZERO,
+                start_radius: r.x as f32,
+                end_center: *p1,
+                end_radius: r.y as f32,
+            },
+        }
+    }
+
+    fn sample_t(&self, pattern: &EncodedShadingPattern, t: f32) -> [f32; 4] {
+        let (t0, t1) = (self.domain[0], self.domain[1]);
+        let t = t0 + (t1 - t0) * t;
+        let Some(out) = self.function.eval(&smallvec![t]) else {
+            return [0.0, 0.0, 0.0, 0.0];
+        };
+        let mut components = pattern.color_space.to_rgba(&out, 1.0, false).components();
+        components[3] *= pattern.opacity;
+
+        if let Some(tf) = &pattern.transfer_function {
+            return tf.apply(&AlphaColor::new(components)).components();
+        }
+
+        components
+    }
+
+    fn axial_extend_covers_bbox(&self, pattern: &EncodedShadingPattern, path_bbox: Rect) -> bool {
+        let path_bbox = pattern.base_transform.transform_rect_bbox(path_bbox);
+
+        let min_x = path_bbox.min_x();
+        let max_x = path_bbox.max_x();
+
+        (self.extend[0] || min_x >= 0.0) && (self.extend[1] || max_x <= 1.0)
+    }
+
+    fn radial_extend_covers_bbox(&self, pattern: &EncodedShadingPattern, path_bbox: Rect) -> bool {
+        let RadialAxialParams::Radial { p1, r } = *self.params else {
+            return false;
+        };
+
+        let path_bbox = pattern.base_transform.transform_rect_bbox(path_bbox);
+
+        if p1.x.abs() <= RADIAL_EPSILON && p1.y.abs() <= RADIAL_EPSILON {
+            return self.same_center_radial_extend_covers_bbox(path_bbox, r.x, r.y);
+        }
+
+        let start_extend_ok = self.extend[0] || r.x.abs() <= RADIAL_EPSILON;
+        let end_extend_ok = self.extend[1] || circle_covers_bbox(Circle::new(p1, r.y), path_bbox);
+
+        start_extend_ok && end_extend_ok
+    }
+
+    fn same_center_radial_extend_covers_bbox(&self, path_bbox: Rect, r0: f64, r1: f64) -> bool {
+        let mut inner_circle = Circle::new(Point::ZERO, r0);
+        let mut outer_circle = Circle::new(Point::ZERO, r1);
+        let mut inner_extend = self.extend[0];
+        let mut outer_extend = self.extend[1];
+
+        if inner_circle.radius > outer_circle.radius {
+            std::mem::swap(&mut inner_circle, &mut outer_circle);
+            std::mem::swap(&mut inner_extend, &mut outer_extend);
+        }
+
+        let inner_extend_ok = inner_extend
+            || inner_circle.radius <= RADIAL_EPSILON
+            || circle_outside_bbox(inner_circle, path_bbox);
+        let outer_extend_ok = outer_extend || circle_covers_bbox(outer_circle, path_bbox);
+
+        inner_extend_ok && outer_extend_ok
+    }
+
+    fn normalized_stitching_bounds(&self) -> StitchingBounds {
+        let [t0, t1] = self.domain;
+        let dt = t1 - t0;
+        if dt.abs() <= f32::EPSILON {
+            return StitchingBounds::new();
+        }
+
+        let mut bounds = self
+            .function
+            .stitching_bounds()
+            .into_iter()
+            .map(|bound| (bound - t0) / dt)
+            .filter(|bound| *bound > 0.0 && *bound < 1.0)
+            .collect::<StitchingBounds>();
+
+        if dt < 0.0 {
+            bounds.reverse();
+        }
+
+        bounds
+    }
+}
+
+fn circle_covers_bbox(circle: Circle, bbox: Rect) -> bool {
+    if circle.radius < 0.0 {
+        return false;
+    }
+
+    let radius_squared = circle.radius * circle.radius;
+    [
+        Point::new(bbox.x0, bbox.y0),
+        Point::new(bbox.x1, bbox.y0),
+        Point::new(bbox.x0, bbox.y1),
+        Point::new(bbox.x1, bbox.y1),
+    ]
+    .into_iter()
+    .all(|point| {
+        let delta = point - circle.center;
+        delta.hypot2() <= radius_squared
+    })
+}
+
+fn circle_outside_bbox(circle: Circle, bbox: Rect) -> bool {
+    if circle.radius <= 0.0 {
+        return true;
+    }
+
+    let closest = Point::new(
+        circle.center.x.clamp(bbox.x0, bbox.x1),
+        circle.center.y.clamp(bbox.y0, bbox.y1),
+    );
+
+    !circle.contains(closest)
+}
+
+fn approximate_gradient_stops(
+    mut sample: impl FnMut(f32) -> [f32; 4],
+    breakpoints: &[f32],
+    tolerance: f32,
+) -> Vec<SvgGradientStop> {
+    let mut interval_bounds = Vec::with_capacity(breakpoints.len() + 2);
+    interval_bounds.push(0.0);
+    interval_bounds.extend(breakpoints.iter().copied());
+    interval_bounds.push(1.0);
+
+    let mut stops = Vec::new();
+    for interval in interval_bounds.windows(2) {
+        let start_offset = interval[0];
+        let end_offset = interval[1];
+
+        let start_color = sample(start_offset);
+        stops.push(SvgGradientStop {
+            offset: start_offset,
+            color: start_color,
+        });
+
+        let end_color = sample(end_offset);
+
+        approximate_gradient_interval(
+            &mut sample,
+            &mut stops,
+            GradientSample {
+                offset: start_offset,
+                color: start_color,
+            },
+            GradientSample {
+                offset: end_offset,
+                color: end_color,
+            },
+            tolerance.max(0.0),
+            0,
+        );
+    }
+
+    stops
+}
+
+#[derive(Clone, Copy)]
+struct GradientSample {
+    offset: f32,
+    color: [f32; 4],
+}
+
+fn approximate_gradient_interval(
+    sample: &mut impl FnMut(f32) -> [f32; 4],
+    stops: &mut Vec<SvgGradientStop>,
+    start: GradientSample,
+    end: GradientSample,
+    tolerance: f32,
+    depth: u8,
+) {
+    let offset_delta = end.offset - start.offset;
+    let quarter_offset = start.offset + offset_delta * 0.25;
+    let mid_offset = start.offset + offset_delta * 0.5;
+    let three_quarter_offset = start.offset + offset_delta * 0.75;
+
+    let quarter_color = sample(quarter_offset);
+    let mid_color = sample(mid_offset);
+    let three_quarter_color = sample(three_quarter_offset);
+
+    if color_error(quarter_color, lerp_color(start.color, end.color, 0.25)) <= tolerance
+        && color_error(mid_color, lerp_color(start.color, end.color, 0.5)) <= tolerance
+        && color_error(
+            three_quarter_color,
+            lerp_color(start.color, end.color, 0.75),
+        ) <= tolerance
+        || depth == MAX_GRADIENT_SUBDIVISION_DEPTH
+    {
+        stops.push(SvgGradientStop {
+            offset: end.offset,
+            color: end.color,
+        });
+
+        return;
+    }
+
+    let mid = GradientSample {
+        offset: mid_offset,
+        color: mid_color,
+    };
+
+    approximate_gradient_interval(sample, stops, start, mid, tolerance, depth + 1);
+    approximate_gradient_interval(sample, stops, mid, end, tolerance, depth + 1);
+}
+
+fn lerp_color(c0: [f32; 4], c1: [f32; 4], t: f32) -> [f32; 4] {
+    [
+        c0[0] + (c1[0] - c0[0]) * t,
+        c0[1] + (c1[1] - c0[1]) * t,
+        c0[2] + (c1[2] - c0[2]) * t,
+        c0[3] + (c1[3] - c0[3]) * t,
+    ]
+}
+
+fn color_error(c0: [f32; 4], c1: [f32; 4]) -> f32 {
+    c0.iter()
+        .zip(c1)
+        .map(|(a, b)| (a - b).abs())
+        .fold(0.0, f32::max)
+}
diff --git a/vendor/hayro-interpret/src/interpret/mod.rs b/vendor/hayro-interpret/src/interpret/mod.rs
index 8f5e7ce7..5ede4d44 100644
--- a/vendor/hayro-interpret/src/interpret/mod.rs
+++ b/vendor/hayro-interpret/src/interpret/mod.rs
@@ -21,7 +21,8 @@ use hayro_syntax::object::dict::keys::{
     ANNOTS, AP, AS, C, CA, F, MCID, N, OC, QUADPOINTS, RECT, SUBTYPE,
 };
 use hayro_syntax::object::{Array, Dict, Object, Rect, Stream, dict_or_stream};
-use hayro_syntax::page::{Page, Resources};
+use hayro_syntax::page::{ContentReader, Page, Resources};
+use hayro_syntax::MAX_DECODED_STREAM;
 use kurbo::{Affine, BezPath, Point, Shape};
 use smallvec::smallvec;
 use std::sync::Arc;
@@ -159,9 +160,11 @@ pub fn interpret_page<'a>(
     device: &mut impl Device<'a>,
 ) {
     let resources = page.resources();
-    // PdfCraft patch: the page's own contents count against its content budget too.
-    crate::context::charge_content(page.page_stream().map_or(0, <[u8]>::len));
-    interpret(page.typed_operations(), resources, context, device);
+    let mut content = page.content_reader();
+    // PdfCraft patch: the page's own contents count against its content budget too, where they
+    // are decoded whole. Streamed content is only ever held a window at a time.
+    crate::context::charge_content(content.materialized_len());
+    interpret_content(&mut content, resources, context, device);
 
     if context.settings.render_annotations
         && let Some(annot_arr) = page.raw().get::<Array<'_>>(ANNOTS)
@@ -323,17 +326,15 @@ fn draw_highlight_without_appearance<'a>(
     context.restore_state(device);
 }
 
-/// Interpret the instructions from `ops` and render them into the device.
-pub fn interpret<'a>(
-    mut ops: TypedIter<'_>,
+/// Interprets the instructions that `ops` yields, until they run out or the caller cancels. It runs
+/// once per window of a content stream, between one `save_state` and its restore (see
+/// `interpret_content`).
+fn interpret_window<'a>(
+    ops: &mut TypedIter<'_>,
     resources: &Resources<'a>,
     context: &mut Context<'a>,
     device: &mut impl Device<'a>,
 ) {
-    let num_states = context.num_states();
-
-    context.save_state();
-
     while let Some(op) = ops.next() {
         // PdfCraft patch: stop when the caller cancelled (see `InterpreterSettings::cancelled`).
         if context.settings.cancelled.as_ref().is_some_and(|c| c.load(Ordering::Relaxed)) {
@@ -842,6 +843,20 @@ pub fn interpret<'a>(
             }
         }
     }
+}
+
+/// Interpret the instructions from `ops` and render them into the device.
+pub fn interpret<'a>(
+    mut ops: TypedIter<'_>,
+    resources: &Resources<'a>,
+    context: &mut Context<'a>,
+    device: &mut impl Device<'a>,
+) {
+    let num_states = context.num_states();
+
+    context.save_state();
+
+    interpret_window(&mut ops, resources, context, device);
 
     while context.num_states() > num_states {
         context.restore_state(device);
@@ -851,3 +866,61 @@ pub fn interpret<'a>(
         (context.settings.warning_sink)(InterpreterWarning::ContentTruncated);
     }
 }
+
+/// PdfCraft patch: the bytes of a window of page content. A window grows only while an instruction
+/// at its end is incomplete.
+const CONTENT_WINDOW: usize = 64 << 10;
+
+/// PdfCraft patch: interprets the content of a page a window at a time, so the decoded content is
+/// never all in memory (see `ContentReader`). A window ends at an instruction that is not complete
+/// yet: its bytes are kept, and the next window starts with them.
+fn interpret_content<'a>(
+    content: &mut ContentReader<'_>,
+    resources: &Resources<'a>,
+    context: &mut Context<'a>,
+    device: &mut impl Device<'a>,
+) {
+    let num_states = context.num_states();
+
+    context.save_state();
+
+    let mut window = Vec::with_capacity(CONTENT_WINDOW);
+    let mut exhausted = false;
+    let mut cut = false;
+    loop {
+        let (committed, needs_more) = {
+            let mut ops = TypedIter::new_window(&window, exhausted);
+            interpret_window(&mut ops, resources, context, device);
+            (ops.committed(), ops.needs_more())
+        };
+        window.drain(..committed);
+
+        let cancelled = context
+            .settings
+            .cancelled
+            .as_ref()
+            .is_some_and(|c| c.load(Ordering::Relaxed));
+        if !needs_more || cancelled || exhausted {
+            break;
+        }
+        // A window that is still incomplete at its end waits for more of the stream. It doubles
+        // while it waits, so one long instruction costs time in proportion to its length, and it
+        // stops growing at `MAX_DECODED_STREAM`, the most any one stream may decode to.
+        if window.len() >= MAX_DECODED_STREAM {
+            cut = true;
+            break;
+        }
+        let want = window.len().max(CONTENT_WINDOW);
+        if content.read_into(&mut window, want) == 0 {
+            exhausted = true;
+        }
+    }
+
+    while context.num_states() > num_states {
+        context.restore_state(device);
+    }
+    // PdfCraft patch (18): say that content was skipped, so a truncated page isn't a clean render.
+    if cut || content.truncated() || crate::context::content_was_truncated() {
+        (context.settings.warning_sink)(InterpreterWarning::ContentTruncated);
+    }
+}
diff --git a/vendor/hayro-interpret/src/lib.rs b/vendor/hayro-interpret/src/lib.rs
index 07cfb004..24c3be29 100644
--- a/vendor/hayro-interpret/src/lib.rs
+++ b/vendor/hayro-interpret/src/lib.rs
@@ -47,6 +47,7 @@ pub use x_object::image_size_ok;
 pub mod color;
 pub mod encode;
 pub mod font;
+pub mod gradient;
 pub mod pattern;
 pub mod shading;
 pub mod util;
diff --git a/vendor/hayro-interpret/src/shading.rs b/vendor/hayro-interpret/src/shading.rs
index 74aaa801..98fbb583 100644
--- a/vendor/hayro-interpret/src/shading.rs
+++ b/vendor/hayro-interpret/src/shading.rs
@@ -5,7 +5,7 @@
 use crate::CacheKey;
 use crate::cache::Cache;
 use crate::color::{ColorComponents, ColorSpace};
-use crate::function::{Function, Values, interpolate};
+use crate::function::{Function, StitchingBounds, Values, interpolate};
 use crate::util::{Float32Ext, PointExt, RectExt};
 use hayro_syntax::bit_reader::BitReader;
 use hayro_syntax::object::Array;
@@ -48,6 +48,24 @@ impl ShadingFunction {
             }
         }
     }
+
+    /// PdfCraft patch (backport of hayro 0.8): stitching breakpoints of all component functions.
+    pub(crate) fn stitching_bounds(&self) -> StitchingBounds {
+        let mut bounds = StitchingBounds::new();
+
+        match self {
+            Self::Single(function) => bounds.extend(function.stitching_bounds()),
+            Self::Multiple(functions) => {
+                for function in functions {
+                    bounds.extend(function.stitching_bounds());
+                }
+            }
+        }
+
+        bounds.sort_by(f32::total_cmp);
+        bounds.dedup_by(|a, b| (*a - *b).abs() <= f32::EPSILON);
+        bounds
+    }
 }
 
 /// A type of shading.
diff --git a/vendor/hayro-syntax/src/byte_reader.rs b/vendor/hayro-syntax/src/byte_reader.rs
index f3c7a20e..78b282c8 100644
--- a/vendor/hayro-syntax/src/byte_reader.rs
+++ b/vendor/hayro-syntax/src/byte_reader.rs
@@ -1,5 +1,6 @@
 //! A byte reader.
 
+use core::cell::Cell;
 use core::ops::Range;
 
 /// PdfCraft patch: how deeply direct arrays and dictionaries may nest (the same cap as `pdfcraft-cos`; a
@@ -13,6 +14,9 @@ pub struct Reader<'a> {
     pub data: &'a [u8],
     /// The current byte-offset.
     pub offset: usize,
+    /// PdfCraft patch: set when a read needed a byte past the end of `data`. A decision made from
+    /// such a read could change if more data followed (see `content::UntypedIter`).
+    past_end: Cell<bool>,
     // PdfCraft patch: bound direct-object nesting while skipping arrays and dictionaries
     // and while parsing dictionaries (`Dict::skip`, `Array::skip`, `parse_dict_with`).
     skip_depth: usize,
@@ -22,13 +26,26 @@ impl<'a> Reader<'a> {
     /// Create a new reader.
     #[inline]
     pub fn new(data: &'a [u8]) -> Self {
-        Self { data, offset: 0, skip_depth: 0 }
+        Self::new_with(data, 0)
     }
 
     /// Create a new reader at the given offset.
     #[inline]
     pub fn new_with(data: &'a [u8], offset: usize) -> Self {
-        Self { data, offset, skip_depth: 0 }
+        Self { data, offset, past_end: Cell::new(false), skip_depth: 0 }
+    }
+
+    /// PdfCraft patch: whether a read needed bytes past the end of the data since the flag was
+    /// last cleared.
+    #[inline]
+    pub(crate) fn looked_past_end(&self) -> bool {
+        self.past_end.get()
+    }
+
+    /// PdfCraft patch: clears the flag set by [`Reader::looked_past_end`].
+    #[inline]
+    pub(crate) fn clear_looked_past_end(&self) {
+        self.past_end.set(false);
     }
 
     pub(crate) fn enter_container(&mut self) -> Option<()> {
@@ -46,7 +63,21 @@ impl<'a> Reader<'a> {
     /// Returns `true` if the reader has reached the end of the data.
     #[inline]
     pub fn at_end(&self) -> bool {
-        self.offset >= self.data.len()
+        let at_end = self.offset >= self.data.len();
+        if at_end {
+            // PdfCraft patch: a parser that stops at the end decides from it (see `past_end`).
+            self.past_end.set(true);
+        }
+
+        at_end
+    }
+
+    /// PdfCraft patch: carries over whether `other`, a clone of this reader, looked past the end.
+    #[inline]
+    pub(crate) fn absorb_past_end(&self, other: &Reader<'_>) {
+        if other.past_end.get() {
+            self.past_end.set(true);
+        }
     }
 
     /// Moves the reader offset to the end of the data.
@@ -118,15 +149,26 @@ impl<'a> Reader<'a> {
     /// Peeks the specified number of bytes.
     #[inline]
     pub fn peek_bytes(&self, len: usize) -> Option<&'a [u8]> {
-        self.offset
+        let bytes = self
+            .offset
             .checked_add(len)
-            .and_then(|end| self.data.get(self.offset..end))
+            .and_then(|end| self.data.get(self.offset..end));
+        if bytes.is_none() {
+            self.past_end.set(true);
+        }
+
+        bytes
     }
 
     /// Peeks a single byte.
     #[inline]
     pub fn peek_byte(&self) -> Option<u8> {
-        self.data.get(self.offset).copied()
+        let byte = self.data.get(self.offset).copied();
+        if byte.is_none() {
+            self.past_end.set(true);
+        }
+
+        byte
     }
 
     /// Eat the next byte if it satisfies the condition.
@@ -197,6 +239,7 @@ impl<'a> Reader<'a> {
             if cloned.peek_byte() == Some(b) {
                 cloned.forward();
             } else {
+                self.past_end.set(cloned.past_end.get());
                 return None;
             }
         }
diff --git a/vendor/hayro-syntax/src/content/mod.rs b/vendor/hayro-syntax/src/content/mod.rs
index ce0a4b56..8e47324d 100644
--- a/vendor/hayro-syntax/src/content/mod.rs
+++ b/vendor/hayro-syntax/src/content/mod.rs
@@ -40,7 +40,7 @@ use crate::object::name::{Name, skip_name_like};
 use crate::object::{Array, Null, Number, Object, Stream};
 use crate::reader::Reader;
 use crate::reader::{Readable, ReaderContext, ReaderExt, Skippable};
-use crate::trivia::is_white_space_character;
+use crate::trivia::{Comment, is_white_space_character};
 use crate::util::find_needle;
 use core::array;
 use core::fmt::{Debug, Formatter};
@@ -120,27 +120,40 @@ pub struct UntypedIter<'a> {
     /// PdfCraft patch: this iterator only checks whether data reads as content (the
     /// end-of-data heuristic below); inline images it meets end at their first `EI`.
     lookahead: bool,
+    /// PdfCraft patch: whether `reader` holds the whole content stream. The end of a window of a
+    /// longer stream can fall inside an instruction, so nothing that reads up to it is decided
+    /// (see `needs_more`).
+    complete: bool,
+    /// PdfCraft patch: set when `next` stopped because the window ran out before the next
+    /// instruction was decided. The caller reads more data and resumes at `committed`.
+    needs_more: bool,
+    /// PdfCraft patch: the offset just after the instruction `next` returned last.
+    committed: usize,
 }
 
 impl<'a> UntypedIter<'a> {
     /// Create a new untyped iterator.
     pub fn new(data: &'a [u8]) -> Self {
+        Self::new_window(data, true)
+    }
+
+    /// PdfCraft patch: an iterator over `data`, which is the whole stream when `complete`, and
+    /// otherwise the start of a longer one.
+    pub(crate) fn new_window(data: &'a [u8], complete: bool) -> Self {
         Self {
             reader: Reader::new(data),
             stack: Stack::new(),
             operator: None,
             lookahead: false,
+            complete,
+            needs_more: false,
+            committed: 0,
         }
     }
 
     /// Create a new empty untyped iterator.
     pub fn empty() -> Self {
-        Self {
-            reader: Reader::new(&[]),
-            stack: Stack::new(),
-            operator: None,
-            lookahead: false,
-        }
+        Self::new_window(&[], true)
     }
 
     /// Return the next instruction.
@@ -148,8 +161,16 @@ impl<'a> UntypedIter<'a> {
     pub fn next(&mut self) -> Option<Instruction<'_, 'a>> {
         self.stack.clear();
         self.operator = None;
+        self.needs_more = false;
+        self.reader.clear_looked_past_end();
 
-        self.reader.skip_white_spaces_and_comments();
+        if self.complete {
+            self.reader.skip_white_spaces_and_comments();
+        } else {
+            // A window may drop what comes before the next instruction, blanks included, but not a
+            // comment that the window ends in: that comment may go on in the next window.
+            self.committed = self.skip_blanks_and_comments();
+        }
 
         while !self.reader.at_end() {
             // I believe booleans/null never appear as an operator?
@@ -165,35 +186,61 @@ impl<'a> UntypedIter<'a> {
                 // similar behavior to Acrobat and Chromium, we try to consume
                 // such an operator and then simply skip it.
                 if let Some(object) = self.reader.read_without_context::<Object<'_>>() {
+                    if self.undecided() {
+                        return None;
+                    }
                     self.stack.push(object)?;
                 } else if self.reader.read_without_context::<Operator<'_>>().is_some() {
+                    if self.undecided() {
+                        return None;
+                    }
                     self.stack.clear();
                 } else {
+                    self.undecided();
                     return None;
                 }
             } else {
                 let operator = match self.reader.read_without_context::<Operator<'_>>() {
                     Some(o) => o,
                     None => {
+                        if self.undecided() {
+                            return None;
+                        }
+
                         warn!("failed to read operator in content stream");
 
                         self.reader.jump_to_end();
                         return None;
                     }
                 };
+                if self.undecided() {
+                    return None;
+                }
 
                 // Inline images need special casing...
                 if operator.as_ref() == b"BI" {
                     // The ID operator will already be consumed by this.
-                    let inline_dict = self.reader.read_without_context::<InlineImageDict<'_>>()?;
+                    let Some(inline_dict) = self
+                        .reader
+                        .read_without_context::<InlineImageDict<'_>>()
+                    else {
+                        self.undecided();
+                        return None;
+                    };
                     let dict = inline_dict.get_dict().clone();
 
                     // One whitespace after "ID".
-                    self.reader.read_white_space()?;
+                    if self.reader.read_white_space().is_none() {
+                        self.undecided();
+                        return None;
+                    }
 
                     let stream_data = self.reader.tail()?;
                     let start_offset = self.reader.offset();
                     let mut candidates = 0;
+                    // PdfCraft patch: set when a look-ahead below ran into the end of the window.
+                    let mut lookahead_touched = false;
+                    let mut accepted = false;
 
                     'outer: while let Some(pos) = find_needle(self.reader.tail()?, b"EI") {
                         self.reader.read_bytes(pos)?;
@@ -228,7 +275,11 @@ impl<'a> UntypedIter<'a> {
                             let mut steps = 0;
                             let heuristic = !self.lookahead && candidates <= MAX_EI_CANDIDATES;
 
-                            while heuristic && !find_reader.at_end() && steps < MAX_EI_LOOKAHEAD_STEPS {
+                            while heuristic && steps < MAX_EI_LOOKAHEAD_STEPS {
+                                if find_reader.at_end() {
+                                    lookahead_touched = true;
+                                    break;
+                                }
                                 steps += 1;
                                 let remaining = find_reader.tail()?;
                                 let next_ei = find_needle(remaining, b"EI");
@@ -239,7 +290,10 @@ impl<'a> UntypedIter<'a> {
                                     (Some(_), Some(bi)) => (bi, false),
                                     (Some(ei), None) => (ei, true),
                                     (None, Some(bi)) => (bi, false),
-                                    (None, None) => break,
+                                    (None, None) => {
+                                        lookahead_touched = true;
+                                        break;
+                                    }
                                 };
 
                                 find_reader.read_bytes(next_pos)?;
@@ -262,7 +316,10 @@ impl<'a> UntypedIter<'a> {
                                     // stream and there should be at least one text-related
                                     // operator that can be parsed correctly.
 
-                                    let mut iter = TypedIter::from_untyped(UntypedIter { lookahead: true, ..UntypedIter::new(tail) });
+                                    let mut iter = TypedIter::from_untyped(UntypedIter {
+                                        lookahead: true,
+                                        ..UntypedIter::new_window(tail, self.complete)
+                                    });
                                     let mut found = false;
                                     let mut counter = 0;
 
@@ -292,6 +349,8 @@ impl<'a> UntypedIter<'a> {
 
                                         counter += 1;
                                     }
+                                    lookahead_touched |=
+                                        iter.needs_more() || iter.untyped.reader.looked_past_end();
 
                                     if !found {
                                         // Seems like the data in-between is not a valid content
@@ -304,10 +363,11 @@ impl<'a> UntypedIter<'a> {
                                     // is indeed the end of data.
                                     let mut cloned = find_reader.clone();
                                     cloned.read_bytes(2)?;
-                                    if cloned
+                                    let is_inline_image_dict = cloned
                                         .read_without_context::<InlineImageDict<'_>>()
-                                        .is_some()
-                                    {
+                                        .is_some();
+                                    lookahead_touched |= cloned.looked_past_end();
+                                    if is_inline_image_dict {
                                         break;
                                     }
                                 }
@@ -315,17 +375,35 @@ impl<'a> UntypedIter<'a> {
                                 find_reader.read_byte()?;
                             }
 
+                            // PdfCraft patch: the end is only certain if no look-ahead needed bytes
+                            // past the window. Otherwise read more and decide again.
+                            if !self.complete
+                                && (lookahead_touched || self.reader.looked_past_end())
+                            {
+                                self.needs_more = true;
+                                return None;
+                            }
+
                             self.stack.push(Object::Stream(stream))?;
 
                             self.reader.read_bytes(2)?;
                             self.reader.skip_white_spaces();
 
+                            accepted = true;
+
                             break;
                         }
                     }
+
+                    // PdfCraft patch: without an accepted "EI" the image may still end in later data.
+                    if !accepted && !self.complete {
+                        self.needs_more = true;
+                        return None;
+                    }
                 }
 
                 self.operator = Some(operator);
+                self.committed = self.reader.offset();
                 return Some(Instruction {
                     operands: &self.stack,
                     operator: self.operator.as_ref().unwrap(),
@@ -335,8 +413,43 @@ impl<'a> UntypedIter<'a> {
             self.reader.skip_white_spaces_and_comments();
         }
 
+        // PdfCraft patch: the window ended between instructions, and another may follow.
+        if !self.complete {
+            self.needs_more = true;
+        }
+
         None
     }
+
+    /// PdfCraft patch: skips the blanks and comments before an instruction, as
+    /// `skip_white_spaces_and_comments` does, and returns where a window may be cut: the start of a
+    /// comment that runs into the end of the window, or else where the skipping stopped.
+    fn skip_blanks_and_comments(&mut self) -> usize {
+        let mut open_comment = None;
+        while let Some(b) = self.reader.peek_byte() {
+            if is_white_space_character(b) {
+                self.reader.skip_white_spaces();
+            } else if b == b'%' {
+                let start = self.reader.offset();
+                Comment::skip(&mut self.reader, true);
+                open_comment = self.reader.at_end().then_some(start);
+            } else {
+                break;
+            }
+        }
+
+        open_comment.unwrap_or(self.reader.offset())
+    }
+
+    /// PdfCraft patch: whether the instruction being read ran into the end of a window, so it
+    /// cannot be decided yet. Records that more data is needed.
+    fn undecided(&mut self) -> bool {
+        if !self.complete && self.reader.looked_past_end() {
+            self.needs_more = true;
+        }
+
+        self.needs_more
+    }
 }
 
 impl<'a> ContentTokenizer<'a> for UntypedIter<'a> {
@@ -345,6 +458,7 @@ impl<'a> ContentTokenizer<'a> for UntypedIter<'a> {
     }
 }
 
+
 /// An iterator over PDF content streams that provide access to the instructions
 /// in a typed fashion.
 #[derive(Clone)]
@@ -362,6 +476,27 @@ impl<'a> TypedIter<'a, UntypedIter<'a>> {
         }
     }
 
+    /// PdfCraft patch: an iterator over a window of a content stream: the whole stream when
+    /// `complete`, and otherwise the start of a longer one (see [`TypedIter::needs_more`]).
+    pub fn new_window(data: &'a [u8], complete: bool) -> Self {
+        Self {
+            untyped: UntypedIter::new_window(data, complete),
+            marker: PhantomData,
+        }
+    }
+
+    /// PdfCraft patch: whether the last `next` returned `None` only because the window ran out
+    /// before the next instruction was decided. Read more of the stream, then resume at
+    /// [`TypedIter::committed`] in a window that starts there.
+    pub fn needs_more(&self) -> bool {
+        self.untyped.needs_more
+    }
+
+    /// PdfCraft patch: the offset in the window just after the last instruction `next` returned.
+    pub fn committed(&self) -> usize {
+        self.untyped.committed
+    }
+
     pub(crate) fn from_untyped(untyped: UntypedIter<'a>) -> Self {
         Self { untyped, marker: PhantomData }
     }
@@ -749,4 +884,134 @@ mod tests {
             assert_eq!(operators(&joined), expected, "split at byte {split}");
         }
     }
+
+    /// The instructions of `data`, read from the whole of it.
+    fn slice_instructions(data: &[u8]) -> Vec<String> {
+        let mut tokenizer = UntypedIter::new(data);
+        let mut result = Vec::new();
+        while let Some(instruction) = tokenizer.next_instruction() {
+            result.push(format!("{:?} {:?}", instruction.operator, instruction.operands));
+        }
+        result
+    }
+
+    /// The instructions of `data` as a window driver reads them: the stream arrives in pieces of
+    /// the lengths `next_piece` gives. Each window holds the bytes from the first instruction
+    /// that is not yet decided, and another piece is appended when a window runs out.
+    fn windowed_instructions(data: &[u8], mut next_piece: impl FnMut() -> usize) -> Vec<String> {
+        let mut result = Vec::new();
+        let mut window: Vec<u8> = Vec::new();
+        let mut fed = 0;
+        let mut exhausted = false;
+        loop {
+            let (committed, needs_more) = {
+                let mut tokenizer = UntypedIter::new_window(&window, exhausted);
+                while let Some(instruction) = tokenizer.next_instruction() {
+                    result.push(format!("{:?} {:?}", instruction.operator, instruction.operands));
+                }
+                (tokenizer.committed, tokenizer.needs_more)
+            };
+            window.drain(..committed);
+            if !needs_more || exhausted {
+                break;
+            }
+            if fed == data.len() {
+                exhausted = true;
+                continue;
+            }
+            let end = fed.saturating_add(next_piece().max(1)).min(data.len());
+            window.extend_from_slice(&data[fed..end]);
+            fed = end;
+        }
+
+        result
+    }
+
+    /// Content whose instructions are hard to read in pieces: inline images with `EI` in their
+    /// data or right after it, unterminated tokens, and operands that are too many or invalid.
+    const WINDOWED_CORPUS: [&[u8]; 14] = [
+        b"% comment\n1 -2.5 /Name /A#20B (a\\(b\\) \\101) <4869> [1 2] << /Key (value) >> [(a) 1] TJ BI /W 1 /H 1 /BPC 8 /CS /DeviceGray ID \x00 EI q Q",
+        b"BT /F1 12 Tf 10 20 Td [(Hel) -250 (lo)] TJ (x) Tj ET",
+        b"q 1 0 0 1 0 0 cm BI /W 2 /H 2 /BPC 8 /CS /G ID \x00\x01EI\x00 EI Q 0 0 m 1 1 l S",
+        b"BI /W 1 /H 1 /BPC 8 /CS /G ID EI x EI EI BT (a) Tj ET",
+        b"0.5 .5 -.5 +5 12.3.4 f",
+        b"/A B C /D 1 2 3 4 5 6 7 8 9 10 11 12 re",
+        b"BI /W 1 /H 1 /BPC 8 /CS /G ID\n\x00\nEI BI /W 1 /H 1 /BPC 8 /CS /G ID \x01 EI Q",
+        b"(unterminated string 1 0 0 1 0 0 cm",
+        b"1 0 0 1 0 0 cm\n%comment at the end",
+        b"BI /W 1 /H 1 /BPC 8 /CS /G ID \x00 EIxy q",
+        b"BI /W 2 /H 1 /BPC 8 /CS /G ID \x00\x01 EI \x00 EI \x01 q",
+        b"[1 [2 [3]]] 0 d q Q",
+        b"/Lbl BDC EMC 1 w",
+        b"<</A 1>> BDC BI /W 1 /H 1 /BPC 8 /CS /G ID \x07 EI (end) Tj",
+    ];
+
+    #[test]
+    fn windows_keep_every_instruction_at_every_split() {
+        for data in WINDOWED_CORPUS {
+            let expected = slice_instructions(data);
+            for split in 1..=data.len() {
+                let mut lengths = [split, data.len()].into_iter();
+                let windowed = windowed_instructions(data, || lengths.next().unwrap_or(data.len()));
+                assert_eq!(windowed, expected, "{:?} split at byte {split}", String::from_utf8_lossy(data));
+            }
+        }
+    }
+
+    #[test]
+    fn windows_keep_every_instruction_in_pieces_of_any_size() {
+        for data in WINDOWED_CORPUS {
+            let expected = slice_instructions(data);
+            for piece in 1..=data.len() {
+                let windowed = windowed_instructions(data, || piece);
+                assert_eq!(windowed, expected, "{:?} in pieces of {piece}", String::from_utf8_lossy(data));
+            }
+        }
+    }
+
+    #[test]
+    fn windows_drop_blanks_and_keep_a_comment_that_may_go_on() {
+        // Blanks alone decide nothing, so a window of them can be dropped whole.
+        let blanks = vec![b' '; 4096];
+        let mut tokenizer = UntypedIter::new_window(&blanks, false);
+        assert!(tokenizer.next().is_none());
+        assert!(tokenizer.needs_more);
+        assert_eq!(tokenizer.committed, blanks.len());
+
+        // The window ends in a comment: it is kept, from its `%`, for the next window.
+        let data = b"1 0 0 1 0 0 cm  % a comment that goes on";
+        let mut tokenizer = UntypedIter::new_window(data, false);
+        assert!(tokenizer.next().is_some());
+        assert!(tokenizer.next().is_none());
+        assert!(tokenizer.needs_more);
+        assert_eq!(tokenizer.committed, data.iter().position(|&b| b == b'%').expect("a comment"));
+    }
+
+    #[test]
+    fn windows_match_the_slice_on_random_content() {
+        const PARTS: [&[u8]; 24] = [
+            b"BI", b" ID ", b"EI", b" EI ", b"/W", b" 1 ", b"-2.5", b".5", b"(", b")", b"\\", b"<",
+            b">", b"[", b"]", b"TJ", b"Tj", b"q", b"Q", b"re", b"f", b"% c\n", b"\n", b"\x00\xff",
+        ];
+        // A fixed xorshift sequence, so that a failure can be reproduced.
+        let mut state = 0x9e37_79b9_7f4a_7c15_u64;
+        let mut next = move || {
+            state ^= state << 13;
+            state ^= state >> 7;
+            state ^= state << 17;
+            state
+        };
+
+        for _ in 0..2000 {
+            let mut data = Vec::new();
+            for _ in 0..next() % 40 {
+                let part = PARTS[(next() % PARTS.len() as u64) as usize];
+                data.extend_from_slice(part);
+            }
+
+            let expected = slice_instructions(&data);
+            let windowed = windowed_instructions(&data, || 1 + (next() % 12) as usize);
+            assert_eq!(windowed, expected, "{:?}", String::from_utf8_lossy(&data));
+        }
+    }
 }
diff --git a/vendor/hayro-syntax/src/filter/lzw_flate.rs b/vendor/hayro-syntax/src/filter/lzw_flate.rs
index c82bc033..ac1c19d6 100644
--- a/vendor/hayro-syntax/src/filter/lzw_flate.rs
+++ b/vendor/hayro-syntax/src/filter/lzw_flate.rs
@@ -7,6 +7,14 @@ use alloc::vec::Vec;
 pub(crate) mod flate {
     use super::*;
     use crate::filter::lzw_flate::{PredictorParams, apply_predictor};
+
+    pub(crate) use fallback::FlateState;
+
+    /// PdfCraft patch: whether a Flate stream with `params` has no predictor, so that
+    /// [`FlateState`] can produce it a piece at a time.
+    pub(crate) fn is_plain(params: &Dict<'_>) -> bool {
+        PredictorParams::from_params(params).predictor == 1
+    }
     use crate::object::Dict;
 
     /// PdfCraft patch: `limit` is the most bytes inflated (see `filter::decode_limit`).
@@ -69,53 +77,148 @@ pub(crate) mod flate {
         }
 
         fn flate_decode(data: &[u8], limit: usize) -> Option<Vec<u8>> {
-            if data.len() >= 2 {
-                let cmf = data[0];
-                let flg = data[1];
+            let mut state = FlateState::new(data);
+            let mut output = Vec::new();
+            state.decode_into(data, &mut output, limit);
 
-                if (cmf & 0x0f) == 0x08
-                    && ((cmf as u16) << 8 | flg as u16).is_multiple_of(31)
-                    && (flg & 0x20) == 0
-                {
-                    let mut stream = FlateStream::new(&data[2..], limit);
-                    return stream.decode();
+            Some(output)
+        }
+
+        /// PdfCraft patch: where a Flate stream is between two calls of [`FlateState::decode_into`].
+        /// Decoding pauses at any output size and resumes where it stopped, so a stream can be
+        /// produced a piece at a time without holding all of it.
+        #[derive(Default)]
+        pub(crate) struct FlateState {
+            pos: usize,
+            code_buf: u32,
+            code_size: u8,
+            eof: bool,
+            block: Block,
+            /// The last `WINDOW` bytes decoded: back-references copy from them, whatever the caller
+            /// has done with the bytes it was given.
+            history: Vec<u8>,
+            /// How many bytes have been decoded in all.
+            total: usize,
+        }
+
+        /// The furthest a Flate back-reference reaches: the largest distance in `DIST_DECODE`.
+        const WINDOW: usize = 32 << 10;
+
+        impl FlateState {
+            /// The state at the start of `data`, past a zlib header if it has one.
+            pub(crate) fn new(data: &[u8]) -> Self {
+                let pos = match data {
+                    [cmf, flg, ..]
+                        if (cmf & 0x0f) == 0x08
+                            && (u16::from(*cmf) << 8 | u16::from(*flg)).is_multiple_of(31)
+                            && (flg & 0x20) == 0 =>
+                    {
+                        2
+                    }
+                    _ => 0,
+                };
+
+                Self {
+                    pos,
+                    ..Self::default()
                 }
             }
 
-            let mut stream = FlateStream::new(data, limit);
-            stream.decode()
+            /// Whether nothing more can be decoded from `data`.
+            pub(crate) fn finished(&self, data: &[u8]) -> bool {
+                self.eof || (matches!(self.block, Block::Header) && self.pos >= data.len())
+            }
+
+            /// Appends decoded bytes to `out` until it holds `until` bytes or the stream ends.
+            /// `data` is the whole encoded stream, the same on every call.
+            pub(crate) fn decode_into(&mut self, data: &[u8], out: &mut Vec<u8>, until: usize) {
+                // The working buffer is the history followed by the bytes decoded now. Only the
+                // latter go to `out`, which the caller may have drained since.
+                let base = self.history.len();
+                let mut stream = FlateStream {
+                    data,
+                    pos: self.pos,
+                    code_buf: self.code_buf,
+                    code_size: self.code_size,
+                    output: core::mem::take(&mut self.history),
+                    base,
+                    total: self.total,
+                    eof: self.eof,
+                    limit: base.saturating_add(until.saturating_sub(out.len())),
+                    block: core::mem::take(&mut self.block),
+                };
+                stream.run();
+
+                out.extend_from_slice(stream.output.get(base..).unwrap_or(&[]));
+                self.total = self.total.saturating_add(stream.output.len() - base);
+                let keep = stream.output.len().min(WINDOW);
+                stream.output.drain(..stream.output.len() - keep);
+                self.history = stream.output;
+
+                self.pos = stream.pos;
+                self.code_buf = stream.code_buf;
+                self.code_size = stream.code_size;
+                self.eof = stream.eof;
+                self.block = stream.block;
+            }
         }
 
+        /// PdfCraft patch: the working state of one [`FlateState::decode_into`] call.
         struct FlateStream<'a> {
             data: &'a [u8],
             pos: usize,
             code_buf: u32,
             code_size: u8,
+            /// The history, then the bytes decoded in this call.
             output: Vec<u8>,
+            /// How many bytes of `output` are history.
+            base: usize,
+            /// How many bytes were decoded before this call.
+            total: usize,
             eof: bool,
-            /// PdfCraft patch: the most bytes inflated (see `filter::decode_limit`).
+            /// PdfCraft patch: the most bytes in `output` (see `filter::decode_limit`).
             limit: usize,
+            block: Block,
         }
 
-        impl<'a> FlateStream<'a> {
-            fn new(data: &'a [u8], limit: usize) -> Self {
-                FlateStream {
-                    data,
-                    pos: 0,
-                    code_buf: 0,
-                    code_size: 0,
-                    output: Vec::new(),
-                    eof: false,
-                    limit,
-                }
-            }
+        /// PdfCraft patch: the block a Flate stream is in.
+        #[derive(Default)]
+        enum Block {
+            /// Between blocks, at a block header (or at the end of the data).
+            #[default]
+            Header,
+            /// Inside a stored block, with `left` bytes still to copy.
+            Stored { left: usize, last: bool },
+            /// Inside a block coded with Huffman tables. `copy` is a back-reference that the limit
+            /// cut off, as (whether its source exists, distance, bytes left to copy).
+            Coded {
+                lit: HuffmanTable,
+                dist: HuffmanTable,
+                last: bool,
+                copy: Option<(bool, usize, usize)>,
+            },
+        }
 
-            fn decode(&mut self) -> Option<Vec<u8>> {
-                while !self.eof && self.pos < self.data.len() && self.output.len() < self.limit {
-                    self.read_block();
-                }
+        impl FlateStream<'_> {
+            /// Decodes until `output` holds `limit` bytes or the stream ends.
+            fn run(&mut self) {
+                loop {
+                    if self.eof || self.output.len() >= self.limit {
+                        return;
+                    }
 
-                Some(core::mem::take(&mut self.output))
+                    match self.block {
+                        Block::Header => {
+                            if self.pos >= self.data.len() {
+                                return;
+                            }
+
+                            self.read_block();
+                        }
+                        Block::Stored { .. } => self.copy_stored(),
+                        Block::Coded { .. } => self.read_codes(),
+                    }
+                }
             }
 
             fn get_byte(&mut self) -> Option<u8> {
@@ -136,13 +239,6 @@ pub(crate) mod flate {
                 }
             }
 
-            fn get_bytes(&mut self, n: usize) -> Vec<u8> {
-                let end = (self.pos + n).min(self.data.len());
-                let bytes = self.data[self.pos..end].to_vec();
-                self.pos = end;
-                bytes
-            }
-
             fn get_bits(&mut self, bits: u8) -> Option<u32> {
                 while self.code_size < bits {
                     let b = self.get_byte()?;
@@ -196,16 +292,16 @@ pub(crate) mod flate {
                     }
                 };
 
-                if (hdr & 1) != 0 {
-                    self.eof = true;
-                }
+                // PdfCraft patch: the final block ends the stream once it is decoded, not when its
+                // header is read: a stored block still has its bytes to copy.
+                let last = (hdr & 1) != 0;
 
                 let hdr = hdr >> 1;
 
                 match hdr {
-                    0 => self.read_uncompressed_block(),
-                    1 => self.read_compressed_block(true),
-                    2 => self.read_compressed_block(false),
+                    0 => self.start_uncompressed_block(last),
+                    1 => self.start_compressed_block(true, last),
+                    2 => self.start_compressed_block(false, last),
                     _ => {
                         warn!("unknown block type in flate stream");
                         self.eof = true;
@@ -213,7 +309,7 @@ pub(crate) mod flate {
                 }
             }
 
-            fn read_uncompressed_block(&mut self) {
+            fn start_uncompressed_block(&mut self, last: bool) {
                 // Skip any remaining bits in current byte
                 self.code_buf = 0;
                 self.code_size = 0;
@@ -264,22 +360,49 @@ pub(crate) mod flate {
                 }
 
                 if block_len == 0 {
-                    if self.peek_byte().is_none() {
+                    if last || self.peek_byte().is_none() {
                         self.eof = true;
                     }
                 } else {
-                    let block = self.get_bytes(block_len as usize);
-                    // PdfCraft patch: never past `limit`.
-                    let left = self.limit.saturating_sub(self.output.len());
+                    self.block = Block::Stored {
+                        left: usize::from(block_len),
+                        last,
+                    };
+                }
+            }
+
+            /// Copies the stored block's bytes, up to the limit or the end of the data.
+            fn copy_stored(&mut self) {
+                let Block::Stored { mut left, last } = self.block else {
+                    return;
+                };
+
+                while left > 0 && self.output.len() < self.limit {
+                    let rest = self.data.get(self.pos..).unwrap_or(&[]);
+                    if rest.is_empty() {
+                        // Premature end of stream: the rest of the block is missing.
+                        self.eof = true;
+                        return;
+                    }
+
+                    let take = left.min(rest.len()).min(self.limit - self.output.len());
                     self.output
-                        .extend_from_slice(block.get(..block.len().min(left)).unwrap_or(&[]));
-                    if block.len() < block_len as usize {
+                        .extend_from_slice(rest.get(..take).unwrap_or(&[]));
+                    self.pos += take;
+                    left -= take;
+                }
+
+                if left > 0 {
+                    self.block = Block::Stored { left, last };
+                } else {
+                    self.block = Block::Header;
+                    if last {
                         self.eof = true;
                     }
                 }
             }
 
-            fn read_compressed_block(&mut self, fixed: bool) {
+            fn start_compressed_block(&mut self, fixed: bool, last: bool) {
                 let (lit_code_table, dist_code_table) = if fixed {
                     (get_fixed_lit_table(), get_fixed_dist_table())
                 } else {
@@ -292,11 +415,54 @@ pub(crate) mod flate {
                     }
                 };
 
+                self.block = Block::Coded {
+                    lit: lit_code_table,
+                    dist: dist_code_table,
+                    last,
+                    copy: None,
+                };
+            }
+
+            /// Decodes the codes of a Huffman-coded block until its end, the limit or the end of
+            /// the data.
+            fn read_codes(&mut self) {
+                let Block::Coded {
+                    lit: lit_code_table,
+                    dist: dist_code_table,
+                    last,
+                    mut copy,
+                } = core::mem::take(&mut self.block)
+                else {
+                    return;
+                };
+
                 loop {
+                    if let Some((valid, distance, left)) = copy {
+                        let left = self.copy_back(valid, distance, left);
+                        if left > 0 {
+                            // The limit cut the copy short: it resumes on the next call.
+                            self.block = Block::Coded {
+                                lit: lit_code_table,
+                                dist: dist_code_table,
+                                last,
+                                copy: Some((valid, distance, left)),
+                            };
+                            return;
+                        }
+                        copy = None;
+                    }
+
                     // PdfCraft patch: one code adds at most 258 bytes; stop at the limit.
                     if self.output.len() >= self.limit {
+                        self.block = Block::Coded {
+                            lit: lit_code_table,
+                            dist: dist_code_table,
+                            last,
+                            copy,
+                        };
                         return;
                     }
+
                     let code1 = match self.get_code(&lit_code_table) {
                         Some(c) => c,
                         None => {
@@ -308,6 +474,9 @@ pub(crate) mod flate {
                     if code1 < 256 {
                         self.output.push(code1 as u8);
                     } else if code1 == 256 {
+                        if last {
+                            self.eof = true;
+                        }
                         return;
                     } else {
                         let code1 = code1 - 257;
@@ -354,22 +523,36 @@ pub(crate) mod flate {
                             }
                         }
 
-                        // Copy from previous output
-                        let start = self.output.len().wrapping_sub(distance);
-                        for _ in 0..length {
-                            // PdfCraft patch: never past `limit`.
-                            if self.output.len() >= self.limit {
-                                return;
-                            }
-                            if start < self.output.len() {
-                                let byte = self.output[self.output.len() - distance];
-                                self.output.push(byte);
-                            }
-                        }
+                        // Copy from previous output. As before, a distance reaching before the first
+                        // byte decoded copies nothing.
+                        let decoded = self.total.saturating_add(self.output.len().saturating_sub(self.base));
+                        let valid = distance > 0 && distance <= decoded;
+                        copy = Some((valid, distance, length));
                     }
                 }
             }
 
+            /// Copies `left` bytes from `distance` back in the output, up to the limit. Returns how
+            /// many are still to copy. A copy whose source does not exist writes nothing.
+            fn copy_back(&mut self, valid: bool, distance: usize, mut left: usize) -> usize {
+                while left > 0 && self.output.len() < self.limit {
+                    if valid {
+                        let byte = self
+                            .output
+                            .len()
+                            .checked_sub(distance)
+                            .and_then(|index| self.output.get(index))
+                            .copied();
+                        if let Some(byte) = byte {
+                            self.output.push(byte);
+                        }
+                    }
+                    left -= 1;
+                }
+
+                left
+            }
+
             fn read_dynamic_tables(&mut self) -> Option<(HuffmanTable, HuffmanTable)> {
                 let num_lit_codes = self.get_bits(5)? as usize + 257;
                 let num_dist_codes = self.get_bits(5)? as usize + 1;
diff --git a/vendor/hayro-syntax/src/filter/mod.rs b/vendor/hayro-syntax/src/filter/mod.rs
index e5353f35..22bebf6d 100644
--- a/vendor/hayro-syntax/src/filter/mod.rs
+++ b/vendor/hayro-syntax/src/filter/mod.rs
@@ -13,6 +13,9 @@ mod jpx;
 mod lzw_flate;
 mod run_length;
 
+// PdfCraft patch: the incremental Flate decoder that `page::ContentReader` drives.
+pub(crate) use lzw_flate::flate::{FlateState, is_plain as flate_is_plain};
+
 use crate::object::Dict;
 use crate::object::Name;
 use crate::object::dict::keys::*;
diff --git a/vendor/hayro-syntax/src/object/mod.rs b/vendor/hayro-syntax/src/object/mod.rs
index d9b4816d..d692db8b 100644
--- a/vendor/hayro-syntax/src/object/mod.rs
+++ b/vendor/hayro-syntax/src/object/mod.rs
@@ -189,10 +189,14 @@ impl<'a> Readable<'a> for Object<'a> {
             b'<' => match r.peek_bytes(2)? {
                 b"<<" => {
                     let mut cloned = r.clone();
-                    let dict = Dict::read(&mut cloned, ctx)?;
+                    let dict = Dict::read(&mut cloned, ctx);
                     cloned.skip_white_spaces_and_comments();
+                    let is_stream = cloned.forward_tag(b"stream").is_some();
+                    // PdfCraft patch: what the clone looked at past the end counts for `r` too.
+                    r.absorb_past_end(&cloned);
+                    let dict = dict?;
 
-                    if cloned.forward_tag(b"stream").is_some() {
+                    if is_stream {
                         Object::Stream(Stream::read(r, ctx)?)
                     } else {
                         r.jump(cloned.offset());
diff --git a/vendor/hayro-syntax/src/object/stream.rs b/vendor/hayro-syntax/src/object/stream.rs
index f4856682..83361081 100644
--- a/vendor/hayro-syntax/src/object/stream.rs
+++ b/vendor/hayro-syntax/src/object/stream.rs
@@ -22,6 +22,16 @@ struct FiltersAndParams<'a> {
     params: SmallVec<[Dict<'a>; 2]>,
 }
 
+/// PdfCraft patch: how the decoded data of a stream can be produced (see `Stream::incremental`).
+pub(crate) enum Incremental {
+    /// The stream has no filter, so its data is its own bytes.
+    Plain,
+    /// The stream is Flate-compressed without a predictor, so it decodes a piece at a time.
+    Flate,
+    /// Anything else decodes whole.
+    Whole,
+}
+
 /// A stream of arbitrary data.
 #[derive(Clone)]
 pub struct Stream<'a> {
@@ -152,6 +162,22 @@ impl<'a> Stream<'a> {
         self.filters_and_params().filters
     }
 
+    /// PdfCraft patch: how the decoded data of the stream can be produced a piece at a time.
+    pub(crate) fn incremental(&self) -> Incremental {
+        let filters_and_params = self.filters_and_params();
+
+        match (
+            filters_and_params.filters.as_slice(),
+            filters_and_params.params.first(),
+        ) {
+            ([], _) => Incremental::Plain,
+            ([Filter::FlateDecode], Some(params)) if crate::filter::flate_is_plain(params) => {
+                Incremental::Flate
+            }
+            _ => Incremental::Whole,
+        }
+    }
+
     /// Return the decoded data of the stream.
     ///
     /// Note that the result of this method will not be cached, so calling it multiple
@@ -185,7 +211,25 @@ impl<'a> Stream<'a> {
         image_params: &ImageDecodeParams,
         max: usize,
     ) -> Result<FilterResult<'a>, DecodeFailure> {
-        let data = self.raw_data();
+        self.decode_raw_within(self.raw_data(), image_params, max)
+    }
+
+    /// PdfCraft patch: decode caller-supplied raw/decrypted bytes with the same filters and limits.
+    pub(crate) fn decoded_raw_within(
+        &self,
+        data: Cow<'a, [u8]>,
+        max: usize,
+    ) -> Result<Cow<'a, [u8]>, DecodeFailure> {
+        self.decode_raw_within(data, &ImageDecodeParams::default(), max)
+            .map(|r| r.data)
+    }
+
+    fn decode_raw_within(
+        &self,
+        data: Cow<'a, [u8]>,
+        image_params: &ImageDecodeParams,
+        max: usize,
+    ) -> Result<FilterResult<'a>, DecodeFailure> {
         let filters_and_params = self.filters_and_params();
         let count = filters_and_params.filters.len();
 
diff --git a/vendor/hayro-syntax/src/page.rs b/vendor/hayro-syntax/src/page.rs
index 2aed8963..7d63931a 100644
--- a/vendor/hayro-syntax/src/page.rs
+++ b/vendor/hayro-syntax/src/page.rs
@@ -13,8 +13,11 @@ use crate::sync::OnceLock;
 use crate::transform::Transform;
 use crate::util::FloatExt;
 use crate::xref::XRef;
+use crate::filter::{FlateState, MAX_DECODED_STREAM};
+use crate::object::stream::Incremental;
+use alloc::borrow::Cow;
 use alloc::boxed::Box;
-use alloc::collections::BTreeSet;
+use alloc::collections::{BTreeSet, VecDeque};
 use crate::object::ObjectIdentifier;
 use alloc::vec;
 use alloc::vec::Vec;
@@ -183,6 +186,198 @@ pub enum Rotation {
     FlippedHorizontal,
 }
 
+/// PdfCraft patch: the cut-off for content that expands from its compressed streams. The decoded
+/// content of a page may be `MAX_CONTENT_EXPANSION` times the size of those streams, and never less
+/// than `MAX_DECODED_STREAM`. Real content expands a few times, and a stream that inflates a
+/// thousandfold from a few kilobytes is a decompression bomb.
+const MAX_CONTENT_EXPANSION: usize = 64;
+
+/// PdfCraft patch: the decoded content of a page, produced a piece at a time, so that the whole of
+/// it need not be in memory at once (see `interpret_page`). Plain streams and Flate streams without
+/// a predictor are decoded as they are read. Any other stream is decoded whole when the reader is
+/// made, as `page_stream` does, and the decoded streams share one `MAX_DECODED_STREAM`.
+///
+/// The decoded bytes of the page's streams are also cut off at a budget: `MAX_CONTENT_EXPANSION`
+/// times their compressed size, counting each distinct stream once however many times `/Contents`
+/// names it. Content that reaches the budget is cut short, and [`ContentReader::truncated`] says so.
+pub struct ContentReader<'a> {
+    pieces: VecDeque<Piece<'a>>,
+    budget: usize,
+    produced: usize,
+    materialized: usize,
+    truncated: bool,
+}
+
+/// One part of the content of a page, in order.
+enum Piece<'a> {
+    /// A stream's own bytes, which are not decoded.
+    Plain { data: Cow<'a, [u8]>, pos: usize },
+    /// A Flate stream, decoded as it is read.
+    Flate { data: Cow<'a, [u8]>, state: FlateState },
+    /// A stream that was decoded whole.
+    Whole { data: Vec<u8>, pos: usize },
+    /// The space that separates the streams of a `/Contents` array.
+    Separator { written: bool },
+}
+
+impl Piece<'_> {
+    fn exhausted(&self) -> bool {
+        match self {
+            Piece::Plain { data, pos } => *pos >= data.len(),
+            Piece::Flate { data, state } => state.finished(data),
+            Piece::Whole { data, pos } => *pos >= data.len(),
+            Piece::Separator { written } => *written,
+        }
+    }
+
+    /// Appends the next bytes of the piece to `out`, which may end at `limit` bytes.
+    fn append_to(&mut self, out: &mut Vec<u8>, limit: usize) {
+        match self {
+            Piece::Plain { data, pos } => copy_from(data, pos, out, limit),
+            Piece::Flate { data, state } => state.decode_into(data, out, limit),
+            Piece::Whole { data, pos } => copy_from(data, pos, out, limit),
+            Piece::Separator { written } => {
+                out.push(b' ');
+                *written = true;
+            }
+        }
+    }
+}
+
+/// Copies the bytes of `data` from `pos` to `out`, up to `limit` bytes in all.
+fn copy_from(data: &[u8], pos: &mut usize, out: &mut Vec<u8>, limit: usize) {
+    let rest = data.get(*pos..).unwrap_or(&[]);
+    let take = rest.len().min(limit.saturating_sub(out.len()));
+    out.extend_from_slice(rest.get(..take).unwrap_or(&[]));
+    *pos += take;
+}
+
+impl<'a> ContentReader<'a> {
+    /// A reader of no content.
+    fn empty() -> Self {
+        Self {
+            pieces: VecDeque::new(),
+            budget: 0,
+            produced: 0,
+            materialized: 0,
+            truncated: false,
+        }
+    }
+
+    /// A reader of `streams`, the content of a page in order. `separated` says whether they come
+    /// from an array, whose streams are separated by spaces. `cap` is the most bytes that streams
+    /// decoded whole may make in all, and at least the budget's floor.
+    fn new(streams: Vec<Stream<'a>>, separated: bool, cap: usize) -> Self {
+        let mut counted = BTreeSet::new();
+        let mut compressed = 0_usize;
+        let mut pieces = VecDeque::new();
+        let mut materialized = 0_usize;
+        // The bytes that the streams decoded whole take up, separators included, as `page_stream`
+        // counted them against `MAX_DECODED_STREAM`.
+        let mut whole_used = 0_usize;
+        let mut accepting_pieces = true;
+        for stream in streams {
+            let newly_counted = counted.insert(stream.obj_id());
+            if !accepting_pieces {
+                if newly_counted {
+                    compressed = compressed.saturating_add(stream.raw_data().len());
+                }
+                continue;
+            }
+
+            let incremental = stream.incremental();
+            let left = cap.saturating_sub(whole_used);
+            if matches!(&incremental, Incremental::Whole) && left == 0 {
+                accepting_pieces = false;
+                if newly_counted {
+                    compressed = compressed.saturating_add(stream.raw_data().len());
+                }
+                continue;
+            }
+
+            let raw = stream.raw_data();
+            if newly_counted {
+                compressed = compressed.saturating_add(raw.len());
+            }
+
+            match incremental {
+                Incremental::Plain => pieces.push_back(Piece::Plain {
+                    data: raw,
+                    pos: 0,
+                }),
+                Incremental::Flate => {
+                    let state = FlateState::new(&raw);
+                    pieces.push_back(Piece::Flate { data: raw, state });
+                }
+                Incremental::Whole => {
+                    let Ok(data) = stream.decoded_raw_within(raw, left) else {
+                        continue;
+                    };
+                    let data = data.into_owned();
+                    whole_used = whole_used.saturating_add(data.len());
+                    materialized = materialized.saturating_add(data.len());
+                    pieces.push_back(Piece::Whole { data, pos: 0 });
+                }
+            }
+
+            if separated {
+                whole_used = whole_used.saturating_add(1);
+                pieces.push_back(Piece::Separator { written: false });
+            }
+        }
+        let budget = cap.max(MAX_CONTENT_EXPANSION.saturating_mul(compressed));
+
+        Self {
+            pieces,
+            budget,
+            produced: 0,
+            materialized,
+            truncated: false,
+        }
+    }
+
+    /// Appends up to `max` bytes of the decoded content to `out`, and returns how many it appended.
+    /// That is fewer than `max` only at the end of the content, or where it is cut short.
+    pub fn read_into(&mut self, out: &mut Vec<u8>, max: usize) -> usize {
+        let start = out.len();
+        let end = start.saturating_add(max);
+
+        while out.len() < end {
+            let Some(piece) = self.pieces.front_mut() else {
+                break;
+            };
+            if piece.exhausted() {
+                self.pieces.pop_front();
+                continue;
+            }
+
+            let allowed = self.budget.saturating_sub(self.produced);
+            if allowed == 0 {
+                self.truncated = true;
+                self.pieces.clear();
+                break;
+            }
+
+            let before = out.len();
+            piece.append_to(out, end.min(before.saturating_add(allowed)));
+            self.produced += out.len() - before;
+        }
+
+        out.len() - start
+    }
+
+    /// The bytes of the content that were decoded whole when the reader was made. The caller
+    /// charges these against its own budget, as it did for the whole content.
+    pub fn materialized_len(&self) -> usize {
+        self.materialized
+    }
+
+    /// Whether the content was cut short at its budget (see [`ContentReader`]).
+    pub fn truncated(&self) -> bool {
+        self.truncated
+    }
+}
+
 /// A PDF page.
 pub struct Page<'a> {
     inner: Dict<'a>,
@@ -260,6 +455,25 @@ impl<'a> Page<'a> {
         Some(iter)
     }
 
+    /// PdfCraft patch: the content of the page, to be read a piece at a time (see
+    /// [`ContentReader`]).
+    pub fn content_reader(&self) -> ContentReader<'a> {
+        self.content_reader_within(MAX_DECODED_STREAM)
+    }
+
+    /// PdfCraft patch: [`Page::content_reader`], with `cap` in place of `MAX_DECODED_STREAM`.
+    fn content_reader_within(&self, cap: usize) -> ContentReader<'a> {
+        if let Some(stream) = self.inner.get::<Stream<'a>>(CONTENTS) {
+            ContentReader::new(vec![stream], false, cap)
+        } else if let Some(array) = self.inner.get::<Array<'a>>(CONTENTS) {
+            ContentReader::new(array.iter::<Stream<'a>>().collect(), true, cap)
+        } else {
+            warn!("contents entry of page was neither stream nor array of streams");
+
+            ContentReader::empty()
+        }
+    }
+
     /// Return the decoded content stream of the page.
     pub fn page_stream(&self) -> Option<&[u8]> {
         let convert_single = |s: Stream<'_>| {
@@ -279,8 +493,7 @@ impl<'a> Page<'a> {
                     for stream in array.iter::<Stream<'_>>() {
                         // PdfCraft patch: the streams share one `MAX_DECODED_STREAM` (an array
                         // naming one inflating stream twenty times decoded 5 GB).
-                        let left =
-                            crate::filter::MAX_DECODED_STREAM.saturating_sub(collected.len());
+                        let left = MAX_DECODED_STREAM.saturating_sub(collected.len());
                         if left == 0 {
                             break;
                         }
@@ -606,3 +819,240 @@ pub(crate) mod cached {
         }
     }
 }
+
+#[cfg(test)]
+mod content_reader_tests {
+    use crate::Pdf;
+
+    /// A zlib stream of `data` in stored blocks, which expands by nothing.
+    fn stored_zlib(data: &[u8]) -> Vec<u8> {
+        let mut out = vec![0x78, 0x01];
+        let mut chunks = data.chunks(0xffff).peekable();
+        if chunks.peek().is_none() {
+            out.extend_from_slice(&[1, 0, 0, 0xff, 0xff]);
+        }
+        while let Some(chunk) = chunks.next() {
+            out.push(u8::from(chunks.peek().is_none()));
+            let len = u16::try_from(chunk.len()).expect("a stored block holds at most 65535 bytes");
+            out.extend_from_slice(&len.to_le_bytes());
+            out.extend_from_slice(&(!len).to_le_bytes());
+            out.extend_from_slice(chunk);
+        }
+        out.extend_from_slice(&[0; 4]);
+        out
+    }
+
+    /// A zlib stream of one literal byte and then `count` copies of a 258-byte match from it, in
+    /// fixed Huffman codes: about 160 bytes of output for each byte of input.
+    fn fixed_run_bomb(count: usize) -> Vec<u8> {
+        struct Bits {
+            out: Vec<u8>,
+            buf: u8,
+            len: u32,
+        }
+        impl Bits {
+            /// Bits are sent least significant first.
+            fn put(&mut self, value: u32, bits: u32) {
+                for i in 0..bits {
+                    self.buf |= (((value >> i) & 1) as u8) << self.len;
+                    self.len += 1;
+                    if self.len == 8 {
+                        self.out.push(self.buf);
+                        self.buf = 0;
+                        self.len = 0;
+                    }
+                }
+            }
+
+            /// Huffman codes are sent most significant bit first.
+            fn code(&mut self, code: u32, bits: u32) {
+                for i in (0..bits).rev() {
+                    self.put((code >> i) & 1, 1);
+                }
+            }
+        }
+
+        let mut bits = Bits {
+            out: vec![0x78, 0x01],
+            buf: 0,
+            len: 0,
+        };
+        bits.put(1, 1); // The final block.
+        bits.put(1, 2); // Fixed Huffman codes.
+        bits.code(0x30 + u32::from(b'a'), 8); // The literal 'a'.
+        for _ in 0..count {
+            bits.code(0xc5, 8); // Length 258 (code 285), no extra bits.
+            bits.code(0, 5); // Distance 1 (code 0), no extra bits.
+        }
+        bits.code(0, 7); // End of block (code 256).
+        if bits.len > 0 {
+            bits.out.push(bits.buf);
+        }
+        bits.out.extend_from_slice(&[0; 4]);
+        bits.out
+    }
+
+    /// A one-page PDF whose content is `stream`, with the stream dictionary entries `dict`.
+    fn page_pdf(stream: &[u8], dict: &str) -> Vec<u8> {
+        let mut pdf = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents 4 0 R >> endobj\n4 0 obj << {dict} /Length {} >> stream\n",
+            stream.len()
+        )
+        .into_bytes();
+        pdf.extend_from_slice(stream);
+        pdf.extend_from_slice(b"\nendstream endobj\ntrailer << /Root 1 0 R >>\n%%EOF\n");
+        pdf
+    }
+
+    /// A one-page PDF with an array of content references to `streams`.
+    fn page_pdf_array(streams: &[(&[u8], &str)], refs: &[usize]) -> Vec<u8> {
+        let contents = refs
+            .iter()
+            .map(|index| format!("{} 0 R", 4 + index))
+            .collect::<Vec<_>>()
+            .join(" ");
+        let mut pdf = format!(
+            "%PDF-1.7\n1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj\n2 0 obj << /Type /Pages /Kids [3 0 R] /Count 1 >> endobj\n3 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 40 40] /Contents [{contents}] >> endobj\n"
+        )
+        .into_bytes();
+        for (index, (stream, dict)) in streams.iter().enumerate() {
+            let object = 4 + index;
+            pdf.extend_from_slice(
+                format!("{object} 0 obj << {dict} /Length {} >> stream\n", stream.len())
+                    .as_bytes(),
+            );
+            pdf.extend_from_slice(stream);
+            pdf.extend_from_slice(b"\nendstream endobj\n");
+        }
+        pdf.extend_from_slice(b"trailer << /Root 1 0 R >>\n%%EOF\n");
+        pdf
+    }
+
+    /// The content of the first page, read `piece` bytes at a time, with a budget of `cap`.
+    fn read_content(pdf: Vec<u8>, cap: usize, piece: usize) -> (Vec<u8>, bool) {
+        let doc = Pdf::new(pdf).expect("parses");
+        let page = doc.pages().first().expect("one page");
+        let mut content = page.content_reader_within(cap);
+        let mut out = Vec::new();
+        while content.read_into(&mut out, piece) > 0 {}
+
+        (out, content.truncated())
+    }
+
+    #[test]
+    fn plain_and_whole_pieces_keep_their_bytes() {
+        let plain = b"q 1 0 0 1 0 0 cm Q\n";
+        let whole = b"q 0 0 m Q\n";
+        let encoded: String = whole.iter().map(|byte| format!("{byte:02x}")).collect::<String>() + ">";
+
+        for piece in [1, 7, 4096, 65_536] {
+            let (plain_out, plain_truncated) = read_content(page_pdf(plain, ""), 1 << 20, piece);
+            assert_eq!(plain_out, plain, "plain piece {piece}");
+            assert!(!plain_truncated, "plain piece {piece}");
+
+            let (whole_out, whole_truncated) = read_content(
+                page_pdf(encoded.as_bytes(), "/Filter /ASCIIHexDecode"),
+                1 << 20,
+                piece,
+            );
+            assert_eq!(whole_out, whole, "whole piece {piece}");
+            assert!(!whole_truncated, "whole piece {piece}");
+        }
+    }
+
+    #[test]
+    fn repeated_content_reference_counts_compressed_bytes_once() {
+        let data = vec![b'q'; 1 << 16];
+        let pdf = page_pdf_array(&[(data.as_slice(), "")], &[0, 0]);
+        let doc = Pdf::new(pdf).expect("parses");
+        let page = doc.pages().first().expect("one page");
+        let mut content = page.content_reader_within(1 << 20);
+        let expected_budget = 64 * data.len();
+        assert_eq!(content.budget, expected_budget);
+
+        let mut out = Vec::new();
+        while content.read_into(&mut out, 4096) > 0 {}
+        let mut expected = data.clone();
+        expected.push(b' ');
+        expected.extend_from_slice(&data);
+        expected.push(b' ');
+        assert!(
+            out == expected,
+            "expected {} bytes, got {}",
+            expected.len(),
+            out.len()
+        );
+        assert!(!content.truncated());
+    }
+
+    #[test]
+    fn whole_cap_still_counts_later_unique_streams() {
+        let first = vec![b'q'; 1 << 20];
+        let later = vec![b'Q'; 12_000];
+        let hex = |data: &[u8]| {
+            data.iter()
+                .map(|byte| format!("{byte:02x}"))
+                .collect::<String>()
+                + ">"
+        };
+        let first_raw = hex(&first);
+        let later_raw = hex(&later);
+        let pdf = page_pdf_array(
+            &[
+                (first_raw.as_bytes(), "/Filter /ASCIIHexDecode"),
+                (later_raw.as_bytes(), "/Filter /ASCIIHexDecode"),
+            ],
+            &[0, 1],
+        );
+        let cap = 1 << 20;
+        let doc = Pdf::new(pdf).expect("parses");
+        let page = doc.pages().first().expect("one page");
+        let mut content = page.content_reader_within(cap);
+        let expected_budget = 64 * (first_raw.len() + later_raw.len());
+        assert!(expected_budget > cap);
+        assert_eq!(content.budget, expected_budget);
+        assert_eq!(content.materialized_len(), cap);
+        assert_eq!(content.pieces.len(), 2, "only the first whole stream and separator are kept");
+
+        let mut out = Vec::new();
+        while content.read_into(&mut out, 65_536) > 0 {}
+        let mut expected = first;
+        expected.push(b' ');
+        assert_eq!(out, expected);
+        assert!(!content.truncated());
+    }
+
+    #[test]
+    fn content_past_the_cap_is_read_to_the_end() {
+        let content: Vec<u8> = b"q 1 0 0 1 0 0 cm Q\n".iter().copied().cycle().take(3 << 20).collect();
+        let pdf = page_pdf(&stored_zlib(&content), "/Filter /FlateDecode");
+        // The cap is far below the content, but stored data expands by nothing, so nothing is cut.
+        for piece in [7, 4096, 1 << 16] {
+            let (out, truncated) = read_content(pdf.clone(), 1 << 20, piece);
+            assert_eq!(out.len(), content.len(), "piece {piece}");
+            assert!(out == content, "piece {piece}: the bytes are the content's");
+            assert!(!truncated, "piece {piece}");
+        }
+    }
+
+    #[test]
+    fn a_stream_that_expands_past_the_budget_is_cut_there() {
+        let cap = 1 << 20;
+        let bomb = fixed_run_bomb(400_000);
+        let (out, truncated) = read_content(page_pdf(&bomb, "/Filter /FlateDecode"), cap, 1 << 16);
+
+        assert!(truncated, "the expansion is past the budget");
+        // The budget is 64 times the compressed stream, which is more than the cap here.
+        assert_eq!(out.len(), 64 * bomb.len());
+        assert!(out.iter().all(|&b| b == b'a'));
+    }
+
+    #[test]
+    fn a_small_expansion_under_the_cap_is_not_cut() {
+        let bomb = fixed_run_bomb(1000);
+        let (out, truncated) = read_content(page_pdf(&bomb, "/Filter /FlateDecode"), 1 << 20, 4096);
+
+        assert!(!truncated);
+        assert_eq!(out.len(), 1 + 258 * 1000);
+    }
+}
diff --git a/vendor/hayro/src/renderer.rs b/vendor/hayro/src/renderer.rs
index 482a3455..56e4fc63 100644
--- a/vendor/hayro/src/renderer.rs
+++ b/vendor/hayro/src/renderer.rs
@@ -14,9 +14,10 @@ use std::collections::HashMap;
 use std::mem::size_of;
 use std::rc::Rc;
 use std::sync::Arc;
+use vello_cpu::color::DynamicColor;
 use vello_cpu::color::palette::css::BLACK;
 use vello_cpu::color::{AlphaColor, PremulRgba8, Srgb};
-use vello_cpu::peniko::{Compose, Fill, ImageQuality, ImageSampler, Mix};
+use vello_cpu::peniko::{ColorStop, Compose, Fill, Gradient, ImageQuality, ImageSampler, Mix};
 use vello_cpu::{
     Image, ImageSource, Mask, PaintType, Pixmap, RenderContext, RenderSettings, peniko,
 };
@@ -114,17 +115,23 @@ fn resampling_scratch_byte_len(
 
 /// PdfCraft patch: validate output, crossed intermediate and filter-work bounds before planning.
 /// Source width × target height also bounds PicScale's smaller single-threaded four-row scratch.
+/// Nearest-neighbour (`!interpolate`) has none of those: it copies source pixels into the target,
+/// so only the source and target buffers are bounded.
 fn resampling_byte_len(
     source: (u32, u32),
     target: (u32, u32),
     channels: usize,
     data_len: usize,
     max_pixels: u64,
+    interpolate: bool,
 ) -> Option<usize> {
     if source_byte_len(source.0, source.1, channels, max_pixels)? != data_len {
         return None;
     }
     let target_len = image_byte_len(target.0, target.1, channels, max_pixels)?;
+    if !interpolate {
+        return Some(target_len);
+    }
     resampling_scratch_byte_len(source, target, channels, max_pixels)?;
     source_byte_len(source.0, target.1, channels, max_pixels)?;
     if source.0 > MAX_RESAMPLING_SOURCE_SIDE || source.1 > MAX_RESAMPLING_SOURCE_SIDE {
@@ -141,6 +148,7 @@ fn resampling_byte_len(
 /// PdfCraft patch: image dimensions selected before allocating resampling buffers.
 /// Exported for PdfCraft's small, metadata-only regression tests. `None` rejects invalid
 /// sources/scales or an over-budget target/intermediate; the caller may retain a valid source.
+/// `interpolate` selects the Catmull-Rom limits; nearest-neighbour (`false`) skips them.
 #[doc(hidden)]
 pub fn image_resampling_size(
     width: u32,
@@ -150,6 +158,7 @@ pub fn image_resampling_size(
     x_scale: f32,
     y_scale: f32,
     max_pixels: u64,
+    interpolate: bool,
 ) -> Option<(u32, u32)> {
     if !x_scale.is_finite() || !y_scale.is_finite() || x_scale <= 0.0 || y_scale <= 0.0 {
         return None;
@@ -165,7 +174,14 @@ pub fn image_resampling_size(
     } else {
         (width, height)
     };
-    resampling_byte_len((width, height), target, channels, data_len, max_pixels)?;
+    resampling_byte_len(
+        (width, height),
+        target,
+        channels,
+        data_len,
+        max_pixels,
+        interpolate,
+    )?;
     Some(target)
 }
 
@@ -176,6 +192,49 @@ fn image_buffer(len: usize) -> Option<Vec<u8>> {
     Some(out)
 }
 
+/// PdfCraft patch (#624): the source index that PicScale's nearest-neighbour plan copies for
+/// destination `index` of `dst` samples taken from `src`. It is the same fixed-point centre
+/// sampling as `ResampleNearestPlan`, so these are the samples a nearest resize would copy.
+fn nearest_source_index(src: u32, dst: u32, index: u32) -> usize {
+    let step = (u64::from(src) << 32) / u64::from(dst);
+    ((u64::from(index) * step + (step >> 1)) >> 32) as usize
+}
+
+/// PdfCraft patch (#624): nearest-resizes a colour image and its same-sized soft mask straight
+/// into premultiplied RGBA of `target` size. Colour and mask come from the same source pixel, so
+/// this equals a nearest resize of the expanded RGBA followed by premultiplying each pixel.
+fn nearest_premultiplied_rgba(
+    color: &ImageData,
+    alpha: &[u8],
+    source: (u32, u32),
+    target: (u32, u32),
+) -> Option<Vec<u8>> {
+    let (samples, channels) = match color {
+        ImageData::Luma(luma) => (luma.data.as_slice(), 1),
+        ImageData::Rgb(rgb) => (rgb.data.as_slice(), 3),
+    };
+    let mut out = image_buffer(image_byte_len(target.0, target.1, 4, MAX_IMAGE_PIXELS)?)?;
+    for ty in 0..target.1 {
+        let sy = nearest_source_index(source.1, target.1, ty);
+        for tx in 0..target.0 {
+            let si = sy * source.0 as usize + nearest_source_index(source.0, target.0, tx);
+            let [r, g, b] = match samples.get(si * channels..si * channels + channels)? {
+                [v] => [*v; 3],
+                [r, g, b] => [*r, *g, *b],
+                _ => return None,
+            };
+            let a = *alpha.get(si)?;
+            out.extend_from_slice(
+                &AlphaColor::from_rgba8(r, g, b, a)
+                    .premultiply()
+                    .to_rgba8()
+                    .to_u8_array(),
+            );
+        }
+    }
+    Some(out)
+}
+
 /// PdfCraft patch: most pieces one dashed stroke may be cut into. Stroke expansion keeps every
 /// dash, so a pattern that is tiny next to its path asks for billions: a fuzzed `/D [[11] 0]` on
 /// a line from x = 92234775807 allocated over 5 GB, and `[0.000001] 0 d` on a 20 pt line over
@@ -482,9 +541,19 @@ impl Renderer {
         new_width: u32,
         new_height: u32,
         pixel_format: ImagePixelFormat,
+        interpolate: bool,
     ) -> (Vec<u8>, u32, u32) {
+        // PdfCraft patch (#624): `/Interpolate` governs the pre-minification pass too. Using
+        // Catmull-Rom here for an image that did not request interpolation blends hard edges
+        // before ImageQuality::Low gets a chance to sample it. Keep the pre-resize (and its
+        // bounded memory/performance behaviour), but use nearest-neighbour when interpolation
+        // is disabled. PDF's default for `/Interpolate` is false.
+        let nearest = Scaler::new(ResamplingFunction::Nearest);
+        let scaler = if interpolate { &self.scaler } else { &nearest };
         let resized = match pixel_format {
             ImagePixelFormat::Luma => self.resize_image_data_impl::<1>(
+                scaler,
+                interpolate,
                 data,
                 src_width,
                 src_height,
@@ -495,6 +564,8 @@ impl Renderer {
                 },
             ),
             ImagePixelFormat::Rgb => self.resize_image_data_impl::<3>(
+                scaler,
+                interpolate,
                 data,
                 src_width,
                 src_height,
@@ -505,6 +576,8 @@ impl Renderer {
                 },
             ),
             ImagePixelFormat::Rgba => self.resize_image_data_impl::<4>(
+                scaler,
+                interpolate,
                 data,
                 src_width,
                 src_height,
@@ -528,6 +601,8 @@ impl Renderer {
 
     fn resize_image_data_impl<const N: usize>(
         &self,
+        scaler: &Scaler,
+        interpolate: bool,
         data: Vec<u8>,
         src_width: u32,
         src_height: u32,
@@ -548,19 +623,25 @@ impl Renderer {
                 N,
                 data.len(),
                 MAX_IMAGE_PIXELS,
+                interpolate,
             )?;
             let source_size = ImageSize::new(src_width as usize, src_height as usize);
             let target_size = ImageSize::new(new_width as usize, new_height as usize);
             let src = ImageStore::<u8, N>::from_slice(&data, source_size.width, source_size.height)
                 .ok()?;
-            let plan = plan(&self.scaler, source_size, target_size).ok()?;
+            let plan = plan(scaler, source_size, target_size).ok()?;
             let scratch_len = plan.scratch_size();
-            let scratch_bound = resampling_scratch_byte_len(
-                (src_width, src_height),
-                (new_width, new_height),
-                N,
-                MAX_IMAGE_PIXELS,
-            )?;
+            // Nearest-neighbour needs no scratch, so any scratch it reports is refused.
+            let scratch_bound = if interpolate {
+                resampling_scratch_byte_len(
+                    (src_width, src_height),
+                    (new_width, new_height),
+                    N,
+                    MAX_IMAGE_PIXELS,
+                )?
+            } else {
+                0
+            };
             if scratch_len > scratch_bound {
                 return None;
             }
@@ -642,6 +723,7 @@ impl Renderer {
             x_scale,
             y_scale,
             MAX_IMAGE_PIXELS,
+            interpolate,
         ) {
             Some(target) => target,
             None => {
@@ -657,17 +739,33 @@ impl Renderer {
                 (source_width, source_height)
             }
         };
-        if requested_resize && self.in_type3_glyph {
+        // PdfCraft patch (#624): High is bicubic and would blend the nearest pre-resize of an image
+        // that did not request interpolation, so only interpolated glyph images are promoted.
+        if requested_resize && self.in_type3_glyph && interpolate {
             quality = ImageQuality::High;
         }
         let needs_resize = (new_width, new_height) != (source_width, source_height);
 
+        // PdfCraft patch (#624): a minified image with a soft mask that is not interpolated is
+        // nearest-sampled straight into premultiplied target RGBA. That skips the full-resolution
+        // RGBA copy below and the premultiply pass after it.
+        let direct = match &alpha_data {
+            Some(alpha) if needs_resize && !interpolate => nearest_premultiplied_rgba(
+                &image_data,
+                &alpha.data,
+                (source_width, source_height),
+                (new_width, new_height),
+            ),
+            _ => None,
+        };
+        let premultiplied = direct.is_some();
         // Preserve the single-channel/RGB fast paths. With alpha, expand directly to RGBA;
         // every source and alpha length was validated before zipping or allocating.
-        let (data, format) = match (image_data, alpha_data) {
-            (ImageData::Luma(luma), None) => (luma.data, ImagePixelFormat::Luma),
-            (ImageData::Rgb(rgb), None) => (rgb.data, ImagePixelFormat::Rgb),
-            (image, Some(alpha)) => {
+        let (data, format) = match (direct, image_data, alpha_data) {
+            (Some(rgba), _, _) => (rgba, ImagePixelFormat::Rgba),
+            (None, ImageData::Luma(luma), None) => (luma.data, ImagePixelFormat::Luma),
+            (None, ImageData::Rgb(rgb), None) => (rgb.data, ImagePixelFormat::Rgb),
+            (None, image, Some(alpha)) => {
                 let Some(len) = source_byte_len(source_width, source_height, 4, MAX_IMAGE_PIXELS)
                 else {
                     return;
@@ -701,7 +799,9 @@ impl Renderer {
                 (rgba, ImagePixelFormat::Rgba)
             }
         };
-        let (data, mut img_width, mut img_height) = if needs_resize {
+        let (data, mut img_width, mut img_height) = if premultiplied {
+            (data, new_width, new_height)
+        } else if needs_resize {
             self.resize_image_data(
                 data,
                 source_width,
@@ -709,6 +809,7 @@ impl Renderer {
                 new_width,
                 new_height,
                 format,
+                interpolate,
             )
         } else {
             (data, source_width, source_height)
@@ -745,7 +846,7 @@ impl Renderer {
             }
             rgba
         };
-        if has_alpha {
+        if has_alpha && !premultiplied {
             let (chunks, _) = rgba_data.as_chunks_mut::<4>();
             for chunk in chunks {
                 let [r, g, b, a] = *chunk;
@@ -861,6 +962,20 @@ impl Renderer {
                         // PdfCraft patch: mesh shadings are sampled only inside `bbox` (and a
                         // pixel around it: texels at a fractional edge look one pixel further).
                         let encoded = s.encode_within(Some(bbox.inflate(1.0, 1.0)));
+
+                        // PdfCraft patch (backport of hayro 0.8): axial and radial shadings
+                        // become native gradients instead of a texture sampled pixel by pixel.
+                        // Upstream also shifts by half a pixel for vello_cpu 0.3; 0.0.8 already
+                        // evaluates gradients at pixel centres, like the texture below.
+                        if let Some(native) =
+                            encoded.as_svg_gradient(bbox, NATIVE_GRADIENT_TOLERANCE)
+                        {
+                            self.ctx
+                                .set_paint_transform(path_transform.inverse() * native.transform);
+                            self.ctx.set_paint(native_gradient(native));
+                            return clip_path;
+                        }
+
                         let (image, width, height, transform, may_have_transparency) =
                             render_shading_texture(bbox, &encoded);
                         let may_have_transparency =
@@ -1397,6 +1512,37 @@ impl<'a> Device<'a> for Renderer {
     }
 }
 
+/// PdfCraft patch (backport of hayro 0.8): largest per-channel error allowed when approximating
+/// a shading function by gradient stops.
+const NATIVE_GRADIENT_TOLERANCE: f32 = 0.01;
+
+/// PdfCraft patch (backport of hayro 0.8): a `vello_cpu` gradient for an approximated shading.
+fn native_gradient(native: hayro_interpret::gradient::SvgGradient) -> PaintType {
+    use hayro_interpret::gradient::SvgGradientKind;
+
+    let stops = native
+        .stops
+        .iter()
+        .map(|stop| ColorStop {
+            offset: stop.offset,
+            color: DynamicColor::from_alpha_color(AlphaColor::<Srgb>::new(stop.color)),
+        })
+        .collect::<Vec<_>>();
+
+    match native.kind {
+        SvgGradientKind::Linear { start, end } => Gradient::new_linear(start, end),
+        SvgGradientKind::Radial {
+            start_center,
+            start_radius,
+            end_center,
+            end_radius,
+        } => Gradient::new_two_point_radial(start_center, start_radius, end_center, end_radius),
+    }
+    .with_extend(peniko::Extend::Pad)
+    .with_stops(stops.as_slice())
+    .into()
+}
+
 // TODO: Deduplicate with hayro-svg?
 fn render_shading_texture(
     path_bbox: Rect,
diff --git a/xtask/src/demo_pdf/chrome.rs b/xtask/src/demo_pdf/chrome.rs
index f1a86da1..dda608a6 100644
--- a/xtask/src/demo_pdf/chrome.rs
+++ b/xtask/src/demo_pdf/chrome.rs
@@ -94,6 +94,10 @@ pub fn print_to_pdf(chrome: &Path, html: &Path, pdf: &Path, log: &Path) -> Resul
 
     let started = Instant::now();
     let mut last_len = None;
+    // Chrome's Skia back-end writes the PDF incrementally, and every increment ends with its own
+    // `%%EOF`: a stable file that looks complete can still grow while later pages rasterise. Only
+    // treat the file as finished after the size has been quiet for several consecutive polls.
+    let mut quiet_polls = 0;
     loop {
         if let Some(status) = child.try_wait()? {
             if is_complete(pdf) {
@@ -102,10 +106,15 @@ pub fn print_to_pdf(chrome: &Path, html: &Path, pdf: &Path, log: &Path) -> Resul
             bail!("Chrome exited with {status} without writing {}; see {}", pdf.display(), log.display());
         }
         let len = fs::metadata(pdf).map(|m| m.len()).ok();
-        if len.is_some() && len == last_len && is_complete(pdf) {
-            let _ = child.kill();
-            let _ = child.wait();
-            return Ok(());
+        if len == last_len && len.is_some() && is_complete(pdf) {
+            quiet_polls += 1;
+            if quiet_polls >= 10 {
+                let _ = child.kill();
+                let _ = child.wait();
+                return Ok(());
+            }
+        } else {
+            quiet_polls = 0;
         }
         last_len = len;
         if started.elapsed() > Duration::from_secs(120) {
diff --git a/xtask/src/demo_pdf/mod.rs b/xtask/src/demo_pdf/mod.rs
index 9a21690a..a1bb84db 100644
--- a/xtask/src/demo_pdf/mod.rs
+++ b/xtask/src/demo_pdf/mod.rs
@@ -97,7 +97,13 @@ fn repo_root() -> PathBuf {
 /// A `file://` URL for an absolute path, percent-encoding unsafe bytes.
 pub(crate) fn file_url(path: &Path) -> String {
     let abs = path.canonicalize().unwrap_or_else(|_| path.to_path_buf());
-    let s = abs.to_string_lossy().replace('\\', "/");
+    let mut s = abs.to_string_lossy().replace('\\', "/");
+    // Windows `canonicalize` returns a verbatim `\\?\C:\...` path; after the slash swap that is
+    // `//?/C:/...`, which must not be mistaken for an absolute Unix path, or the URL Chrome is
+    // handed becomes `file:////?/C:/...` and it prints one blank page instead of the document.
+    if let Some(rest) = s.strip_prefix("//?/") {
+        s = rest.to_string();
+    }
     let mut url = String::from(if s.starts_with('/') { "file://" } else { "file:///" });
     for byte in s.bytes() {
         match byte {
@@ -185,3 +191,18 @@ fn foreign_fonts(doc: &lopdf::Document) -> Vec<String> {
     }
     bad.into_iter().collect()
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// On Windows `canonicalize` returns a verbatim `\?\C:\...` path; the URL must not carry the
+    /// `//?/` prefix over (regression test for `file:////?/C:/...`, which Chrome prints as one
+    /// blank page).
+    #[test]
+    fn file_url_has_no_verbatim_prefix() {
+        let url = file_url(&std::env::temp_dir());
+        assert!(!url.contains("//?/"), "{url}");
+        assert!(url.starts_with("file:///"), "{url}");
+    }
+}
diff --git a/xtask/src/gates.rs b/xtask/src/gates.rs
index 106f0e2c..4406a957 100644
--- a/xtask/src/gates.rs
+++ b/xtask/src/gates.rs
@@ -295,6 +295,7 @@ mod tests {
         assert!(pdf.contains("<string>com.adobe.pdf</string>"), "claim PDFs by UTI, not just extension/MIME");
         assert!(pdf.contains("<string>Editor</string>"), "PDF role stays Editor");
         assert!(pdf.contains("<string>Alternate</string>"), "rank stays Alternate: offered without taking over Preview");
+        assert!(pdf.contains("<key>CFBundleTypeIconFile</key>"), "declares document icon file for Finder");
     }
 
     // The bundle id must match the app id the binary uses; renames change both (#174).
diff --git a/xtask/src/layers.rs b/xtask/src/layers.rs
index 72a199c1..1bda1dc4 100644
--- a/xtask/src/layers.rs
+++ b/xtask/src/layers.rs
@@ -55,6 +55,7 @@ pub const TABLE: &[(&str, Class)] = &[
     ("organize", Class::Layer(4)),
     ("security", Class::Layer(4)),
     ("redact", Class::Layer(4)),
+    ("audit", Class::Layer(4)),
     ("xfdf", Class::Layer(4)),
     ("sign", Class::Layer(4)),
     ("ocr", Class::Layer(4)),
@@ -96,6 +97,7 @@ pub const STANDALONE_DEPS: &[(&str, &[&str])] = &[("cos", &["filters", "crypt",
 /// Allowed same-layer edges (architecture §3 rule 1). `forms → js` is deliberately absent.
 pub const SIDEWAYS: &[(&str, &str)] = &[
     ("redact", "edit"),
+    ("audit", "edit"),
     ("a11y", "preflight"),
     ("prepress", "preflight"),
     ("export", "ocr"),